3e6d9a564b
Some email clients will pre-fetch links in emails to check whether they’re safe. This has the unfortunate side effect of claiming the token that’s in the link. Long term, we don’t want to let the link be used multiple times, because this reduces how secure it is (eg someone with access to your browser history could re-use the link even if you’d signed out). Instead, this commit adds an extra page which is served when the user clicks the link from the email. This page includes a form which submits to the actual URL that uses the token, thereby not claiming the token as soon as the page is loaded. For convenience, this page also includes some Javascript which clicks the link on the user’s behalf. If the user has Javascript turned off they will see the link and can click it themselves. This is going on the assumption that whatever the email clients are doing when prefetching the link doesn’t involve running any Javascript. This Javascript is inlined so that: - it is run as fast as possible - it’s more resilient – even if our assets domain is unreachable or the connection is interrupted, it will still run
notifications-admin
GOV.UK Notify admin application.
Features of this application
- Register and manage users
- Create and manage services
- Send batch emails and SMS by uploading a CSV
- Show history of notifications
First-time setup
Brew is a package manager for OSX. The following command installs brew:
/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
Languages needed
brew install node
NPM is Node's package management tool. n is a tool for managing
different versions of Node. The following installs n and uses the long term support (LTS)
version of Node.
npm install -g n
n lts
npm rebuild node-sass
The app runs within a virtual environment. We use mkvirtualenv for easier working with venvs
pip install virtualenvwrapper
mkvirtualenv -p /usr/local/bin/python3 notifications-admin
Install dependencies and build the frontend assets:
workon notifications-admin
./scripts/bootstrap.sh
Rebuilding the frontend assets
If you want the front end assets to re-compile on changes, leave this running in a separate terminal from the app
npm run watch
Create a local environment.sh file containing the following:
echo "
export NOTIFY_ENVIRONMENT='development'
export FLASK_APP=application.py
export FLASK_DEBUG=1
export WERKZEUG_DEBUG_PIN=off
"> environment.sh
AWS credentials
Your aws credentials should be stored in a folder located at ~/.aws. Follow Amazon's instructions for storing them correctly
Running the application
workon notifications-admin
./scripts/run_app.sh
Then visit localhost:6012
Updating application dependencies
requirements.txt file is generated from the requirements-app.txt in order to pin
versions of all nested dependencies. If requirements-app.txt has been changed (or
we want to update the unpinned nested dependencies) requirements.txt should be
regenerated with
make freeze-requirements
requirements.txt should be committed alongside requirements-app.txt changes.
Working with static assets
When running locally static assets are served by Flask at http://localhost:6012/static/…
When running on preview, staging and production there’s a bit more to it:
