darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-05 17:58:25 -04:00
Code Issues Packages Projects Releases Wiki Activity

Properly handling and validating the state for login.gov

Browse Source 
Signed-off-by: Cliff Hill <clifford.hill@gsa.gov>
This commit is contained in:
Cliff Hill
2024-10-25 16:28:25 -04:00
parent a02448a0fa
commit a39c844c30
3 changed files with 37 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
app/main/views/index.py
View File

@@ -35,24 +35,24 @@ def index():
if current_user and current_user.is_authenticated:
return redirect(url_for("main.choose_account"))
token = generate_token(
# make and store the state
state = generate_token(
str(request.remote_addr),
current_app.config["SECRET_KEY"],
current_app.config["DANGEROUS_SALT"],
)
url = os.getenv("LOGIN_DOT_GOV_INITIAL_SIGNIN_URL")
# handle unit tests
current_app.logger.warning(f"############### {str(request.remote_addr)}")
state_key = f"login-nonce-{unquote(state)}"
redis_client.set(state_key, state)
# make and store the nonce
nonce = secrets.token_urlsafe()
nonce_key = f"login-nonce-{unquote(nonce)}"
redis_client.set(nonce_key, nonce)
redis_key = f"login-nonce-{unquote(nonce)}"
redis_client.set(redis_key, nonce)
url = os.getenv("LOGIN_DOT_GOV_INITIAL_SIGNIN_URL")
if url is not None:
url = url.replace("NONCE", nonce)
url = url.replace("STATE", token)
url = url.replace("STATE", state)
return render_template(
"views/signedout.html",
sms_rate=CURRENT_SMS_RATE,