From d0cda995cf23bef9153c6224490b70f38995de6d Mon Sep 17 00:00:00 2001
From: Cliff Hill <clifford.hill@gsa.gov>
Date: Tue, 15 Oct 2024 09:27:34 -0400
Subject: [PATCH] Standardising nonce storage/retrieval through redis for both
 login and invite.

Signed-off-by: Cliff Hill <clifford.hill@gsa.gov>
---
 app/main/views/index.py                | 6 +++---
 app/main/views/register.py             | 2 +-
 app/main/views/sign_in.py              | 8 ++++----
 app/notify_client/invite_api_client.py | 2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/app/main/views/index.py b/app/main/views/index.py
index 012383f84..6dd528e9a 100644
--- a/app/main/views/index.py
+++ b/app/main/views/index.py
@@ -7,12 +7,11 @@ from flask import (
     redirect,
     render_template,
     request,
-    session,
     url_for,
 )
 from flask_login import current_user
 
-from app import status_api_client
+from app import status_api_client, redis_client
 from app.formatters import apply_html_class, convert_markdown_template
 from app.main import main
 from app.main.views.pricing import CURRENT_SMS_RATE
@@ -34,7 +33,8 @@ def index():
     # handle unit tests
 
     nonce = secrets.token_urlsafe()
-    session["nonce"] = nonce
+
+    redis_client.set(f"login-nonce-{token}", nonce)
 
     if url is not None:
         url = url.replace("NONCE", nonce)
diff --git a/app/main/views/register.py b/app/main/views/register.py
index a8de8d1e8..5b69a7f84 100644
--- a/app/main/views/register.py
+++ b/app/main/views/register.py
@@ -170,7 +170,7 @@ def set_up_your_profile():
         request_json = request.json()
         id_token = get_id_token(request_json)
         nonce = id_token["nonce"]
-        stored_nonce = redis_client.get(f"invitenonce-{state}")
+        stored_nonce = redis_client.get(f"login-nonce-{state}")
         if nonce != stored_nonce:
             current_app.logger.error(f"Nonce Error: {nonce} != {stored_nonce}")
             abort(403)
diff --git a/app/main/views/sign_in.py b/app/main/views/sign_in.py
index 700b01a02..a2dc36a2a 100644
--- a/app/main/views/sign_in.py
+++ b/app/main/views/sign_in.py
@@ -13,12 +13,11 @@ from flask import (
     redirect,
     render_template,
     request,
-    session,
     url_for,
 )
 from flask_login import current_user
 
-from app import login_manager, user_api_client
+from app import login_manager, user_api_client, redis_client
 from app.main import main
 from app.main.views.index import error
 from app.main.views.verify import activate_user
@@ -66,7 +65,8 @@ def _get_access_token(code, state):  # pragma: no cover
     response_json = response.json()
     id_token = get_id_token(response_json)
     nonce = id_token["nonce"]
-    stored_nonce = session.pop("nonce")
+    stored_nonce = redis_client.get(f"login-nonce-{state}")
+
     if nonce != stored_nonce:
         current_app.logger.error(f"Nonce Error: {nonce} != {stored_nonce}")
         abort(403)
@@ -209,7 +209,7 @@ def sign_in():  # pragma: no cover
     url = os.getenv("LOGIN_DOT_GOV_INITIAL_SIGNIN_URL")
 
     nonce = secrets.token_urlsafe()
-    session["nonce"] = nonce
+    redis_client.set(f"login-nonce-{token}", nonce)
 
     # handle unit tests
     if url is not None:
diff --git a/app/notify_client/invite_api_client.py b/app/notify_client/invite_api_client.py
index 25a69967b..9bff63f22 100644
--- a/app/notify_client/invite_api_client.py
+++ b/app/notify_client/invite_api_client.py
@@ -46,7 +46,7 @@ class InviteApiClient(NotifyAdminAPIClient):
 
         # make and store the nonce
         nonce = secrets.token_urlsafe()
-        redis_client.set(f"invitenonce-{state}", nonce)  # save the nonce to redis.
+        redis_client.set(f"login-nonce-{state}", nonce)  # save the nonce to redis.
         data["nonce"] = nonce  # This is passed to api for the invite url.
 
         resp = self.post(url=f"/service/{service_id}/invite", data=data)