From 817c01faff8231e4c7a8e1535659cde5dd5e506d Mon Sep 17 00:00:00 2001 From: Kenneth Kehl <@kkehl@flexion.us> Date: Tue, 2 Apr 2024 13:32:32 -0700 Subject: [PATCH 1/3] change state to something non-arbitrary --- app/main/views/sign_in.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/app/main/views/sign_in.py b/app/main/views/sign_in.py index 5ca935e56..e6e0f51d0 100644 --- a/app/main/views/sign_in.py +++ b/app/main/views/sign_in.py @@ -16,6 +16,7 @@ from flask import ( url_for, ) from flask_login import current_user +from notifications_utils.url_safe_token import generate_token from app import login_manager, user_api_client from app.main import main @@ -175,7 +176,14 @@ def sign_in(): other_device = current_user.logged_in_elsewhere() - initial_signin_url = os.getenv("LOGIN_DOT_GOV_INITIAL_SIGNIN_URL") + token = generate_token( + str(request.remote_addr), + current_app.config["SECRET_KEY"], + current_app.config["DANGEROUS_SALT"], + ) + url = os.environ["LOGIN_DOT_GOV_INITIAL_SIGNIN_URL"] + url = url.replace("NONCE", token) + url = url.replace("STATE", token) return render_template( "views/signin.html", @@ -184,7 +192,7 @@ def sign_in(): other_device=other_device, login_gov_enabled=True, password_reset_url=password_reset_url, - initial_signin_url=initial_signin_url, + initial_signin_url=url, ) From 10ed1dab22560f77f42ba7fe4902efbc120b4798 Mon Sep 17 00:00:00 2001 From: Kenneth Kehl <@kkehl@flexion.us> Date: Tue, 2 Apr 2024 13:46:47 -0700 Subject: [PATCH 2/3] fixes --- .github/workflows/deploy-demo.yml | 2 +- .github/workflows/deploy-prod.yml | 2 +- .github/workflows/deploy.yml | 2 +- app/main/views/sign_in.py | 6 ++++-- 4 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/deploy-demo.yml b/.github/workflows/deploy-demo.yml index 57f11acf9..66697bd57 100644 --- a/.github/workflows/deploy-demo.yml +++ b/.github/workflows/deploy-demo.yml @@ -62,7 +62,7 @@ jobs: LOGIN_DOT_GOV_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&post_logout_redirect_uri=https://notify-demo.app.cloud.gov/sign-out" LOGIN_DOT_GOV_BASE_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?" LOGIN_DOT_GOV_SIGNOUT_REDIRECT: "https://notify-demo.app.cloud.gov/sign-out" - LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=01234567890123456789012345&prompt=select_account&redirect_uri=https://notify-demo.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=abcdefghijklmnopabcdefghijklmnop" + LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=NONCE&prompt=select_account&redirect_uri=https://notify-demo.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=STATE" with: cf_username: ${{ secrets.CLOUDGOV_USERNAME }} cf_password: ${{ secrets.CLOUDGOV_PASSWORD }} diff --git a/.github/workflows/deploy-prod.yml b/.github/workflows/deploy-prod.yml index 3e169cdc9..dd7b6c875 100644 --- a/.github/workflows/deploy-prod.yml +++ b/.github/workflows/deploy-prod.yml @@ -62,7 +62,7 @@ jobs: LOGIN_DOT_GOV_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&post_logout_redirect_uri=https://beta.notify.gov/sign-out" LOGIN_DOT_GOV_BASE_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?" LOGIN_DOT_GOV_SIGNOUT_REDIRECT: "https://beta.notify.gov/sign-out" - LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=01234567890123456789012345&prompt=select_account&redirect_uri=https://beta.notify.gov/sign-in&response_type=code&scope=openid+email&state=abcdefghijklmnopabcdefghijklmnop" + LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=NONCE&prompt=select_account&redirect_uri=https://beta.notify.gov/sign-in&response_type=code&scope=openid+email&state=STATE" with: cf_username: ${{ secrets.CLOUDGOV_USERNAME }} cf_password: ${{ secrets.CLOUDGOV_PASSWORD }} diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index f620bd662..e08923d13 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -68,7 +68,7 @@ jobs: LOGIN_DOT_GOV_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&post_logout_redirect_uri=https://notify-staging.app.cloud.gov/sign-out" LOGIN_DOT_GOV_BASE_LOGOUT_URL: "https://secure.login.gov/openid_connect/logout?" LOGIN_DOT_GOV_SIGNOUT_REDIRECT: "https://notify-staging.app.cloud.gov/sign-out" - LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=01234567890123456789012345&prompt=select_account&redirect_uri=https://notify-staging.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=abcdefghijklmnopabcdefghijklmnop" + LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=NONCE&prompt=select_account&redirect_uri=https://notify-staging.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=STATEE" with: cf_username: ${{ secrets.CLOUDGOV_USERNAME }} cf_password: ${{ secrets.CLOUDGOV_PASSWORD }} diff --git a/app/main/views/sign_in.py b/app/main/views/sign_in.py index e6e0f51d0..62daf1286 100644 --- a/app/main/views/sign_in.py +++ b/app/main/views/sign_in.py @@ -182,8 +182,10 @@ def sign_in(): current_app.config["DANGEROUS_SALT"], ) url = os.environ["LOGIN_DOT_GOV_INITIAL_SIGNIN_URL"] - url = url.replace("NONCE", token) - url = url.replace("STATE", token) + # handle unit tests + if url is not None: + url = url.replace("NONCE", token) + url = url.replace("STATE", token) return render_template( "views/signin.html", From cde0ab018a6c5a013a1c273f36b7c5001527f8b1 Mon Sep 17 00:00:00 2001 From: Kenneth Kehl <@kkehl@flexion.us> Date: Tue, 2 Apr 2024 14:02:04 -0700 Subject: [PATCH 3/3] fix null on some unit tests --- app/main/views/sign_in.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/main/views/sign_in.py b/app/main/views/sign_in.py index 62daf1286..402e61a08 100644 --- a/app/main/views/sign_in.py +++ b/app/main/views/sign_in.py @@ -181,7 +181,7 @@ def sign_in(): current_app.config["SECRET_KEY"], current_app.config["DANGEROUS_SALT"], ) - url = os.environ["LOGIN_DOT_GOV_INITIAL_SIGNIN_URL"] + url = os.getenv("LOGIN_DOT_GOV_INITIAL_SIGNIN_URL") # handle unit tests if url is not None: url = url.replace("NONCE", token)