darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-07 06:58:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

fixing so nonce check works correctly.

Browse Source 
Signed-off-by: Cliff Hill <clifford.hill@gsa.gov>
This commit is contained in:
Cliff Hill
2024-09-25 16:01:13 -04:00
parent 47f0952125
commit 7b2d495c1b
1 changed files with 8 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
app/main/views/sign_in.py
View File

@@ -1,6 +1,5 @@
import json import json
import os import os
import secrets
import time import time
import uuid import uuid
@@ -18,7 +17,7 @@ from flask import (
) )
from flask_login import current_user from flask_login import current_user
from app import login_manager, redis_client, user_api_client from app import login_manager, user_api_client
from app.main import main from app.main import main
from app.main.views.index import error from app.main.views.index import error
from app.main.views.verify import activate_user from app.main.views.verify import activate_user
@@ -89,12 +88,12 @@ def _get_access_token(code, state): # pragma: no cover
nonce = id_token["nonce"] nonce = id_token["nonce"]
state = request.args.get("state") state = request.args.get("state")
redis_key = f"token-nonce-{state}"
token_nonce = redis_client.get(redis_key) if nonce != state:
redis_client.delete(redis_key) current_app.logger.warning(f"{nonce} != {state}")
if nonce != token_nonce: abort(403)
current_app.logger.warning(f"{nonce} != {token_nonce}")
login_manager.unauthorized() # redis_client.delete(redis_key)
try: try:
access_token = response_json["access_token"] access_token = response_json["access_token"]
@@ -226,12 +225,10 @@ def sign_in(): # pragma: no cover
current_app.config["DANGEROUS_SALT"], current_app.config["DANGEROUS_SALT"],
) )
url = os.getenv("LOGIN_DOT_GOV_INITIAL_SIGNIN_URL") url = os.getenv("LOGIN_DOT_GOV_INITIAL_SIGNIN_URL")
nonce = secrets.token_urlsafe()
state = request.args.get("state") state = request.args.get("state")
redis_client.set(f"token-nonce-{state}", nonce)
# handle unit tests # handle unit tests
if url is not None: if url is not None:
url = url.replace("NONCE", nonce) url = url.replace("NONCE", state) # We are getting the state back as the nonce.
url = url.replace("STATE", token) url = url.replace("STATE", token)
return render_template( return render_template(
"views/signin.html", "views/signin.html",