Standardising nonce storage/retrieval through redis for both login and

invite.

Signed-off-by: Cliff Hill <clifford.hill@gsa.gov>

app/main/views/index.py

@@ -7,12 +7,11 @@ from flask import (
     redirect,
     render_template,
     request,
-    session,
     url_for,
 )
 from flask_login import current_user
 
-from app import status_api_client
+from app import status_api_client, redis_client
 from app.formatters import apply_html_class, convert_markdown_template
 from app.main import main
 from app.main.views.pricing import CURRENT_SMS_RATE
@@ -34,7 +33,8 @@ def index():
     # handle unit tests
 
     nonce = secrets.token_urlsafe()
-    session["nonce"] = nonce
+
+    redis_client.set(f"login-nonce-{token}", nonce)
 
     if url is not None:
         url = url.replace("NONCE", nonce)

app/main/views/register.py

@@ -170,7 +170,7 @@ def set_up_your_profile():
         request_json = request.json()
         id_token = get_id_token(request_json)
         nonce = id_token["nonce"]
-        stored_nonce = redis_client.get(f"invitenonce-{state}")
+        stored_nonce = redis_client.get(f"login-nonce-{state}")
         if nonce != stored_nonce:
             current_app.logger.error(f"Nonce Error: {nonce} != {stored_nonce}")
             abort(403)

app/main/views/sign_in.py

@@ -13,12 +13,11 @@ from flask import (
     redirect,
     render_template,
     request,
-    session,
     url_for,
 )
 from flask_login import current_user
 
-from app import login_manager, user_api_client
+from app import login_manager, user_api_client, redis_client
 from app.main import main
 from app.main.views.index import error
 from app.main.views.verify import activate_user
@@ -66,7 +65,8 @@ def _get_access_token(code, state):  # pragma: no cover
     response_json = response.json()
     id_token = get_id_token(response_json)
     nonce = id_token["nonce"]
-    stored_nonce = session.pop("nonce")
+    stored_nonce = redis_client.get(f"login-nonce-{state}")
+
     if nonce != stored_nonce:
         current_app.logger.error(f"Nonce Error: {nonce} != {stored_nonce}")
         abort(403)
@@ -209,7 +209,7 @@ def sign_in():  # pragma: no cover
     url = os.getenv("LOGIN_DOT_GOV_INITIAL_SIGNIN_URL")
 
     nonce = secrets.token_urlsafe()
-    session["nonce"] = nonce
+    redis_client.set(f"login-nonce-{token}", nonce)
 
     # handle unit tests
     if url is not None:

app/notify_client/invite_api_client.py

@@ -46,7 +46,7 @@ class InviteApiClient(NotifyAdminAPIClient):
 
         # make and store the nonce
         nonce = secrets.token_urlsafe()
-        redis_client.set(f"invitenonce-{state}", nonce)  # save the nonce to redis.
+        redis_client.set(f"login-nonce-{state}", nonce)  # save the nonce to redis.
         data["nonce"] = nonce  # This is passed to api for the invite url.
 
         resp = self.post(url=f"/service/{service_id}/invite", data=data)