darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2026-07-27 11:19:56 -04:00
Code Issues Packages Projects Releases Wiki Activity

Use function from utils to check secret header value

Browse Source 
This adds a before_request handler to check whether all incoming
requests have the proxy header configured.
This commit is contained in:
Athanasios Voutsadakis
2017-11-14 14:26:00 +00:00
parent 62629e4eae
commit 0f696aa3e8
3 changed files with 34 additions and 203 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
app/__init__.py
View File

@@ -3,14 +3,13 @@ import random
import string
import uuid
from flask import Flask, _request_ctx_stack
from flask import request, g, jsonify
from flask import Flask, _request_ctx_stack, request, g, jsonify, abort
from flask_sqlalchemy import SQLAlchemy
from flask_marshmallow import Marshmallow
from monotonic import monotonic
from notifications_utils.clients.statsd.statsd_client import StatsdClient
from notifications_utils.clients.redis.redis_client import RedisClient
from notifications_utils import logging, request_id
from notifications_utils import logging, request_helper
from werkzeug.local import LocalProxy
from app.celery.celery import NotifyCelery
@@ -56,7 +55,7 @@ def create_app(app_name=None):
application.config['NOTIFY_APP_NAME'] = app_name
init_app(application)
request_id.init_app(application)
request_helper.init_app(application)
db.init_app(application)
ma.init_app(application)
statsd_client.init_app(application)
@@ -206,6 +205,8 @@ def init_app(app):
def record_user_agent():
statsd_client.incr("user-agent.{}".format(process_user_agent(request.headers.get('User-Agent', None))))
app.before_request(request_helper.check_proxy_header_before_request)
@app.before_request
def record_request_details():
g.start = monotonic()

49
app/authentication/auth.py
View File

@@ -45,56 +45,7 @@ def requires_no_auth():
pass
def check_route_secret():
# Check route of inbound sms (Experimental)
# Custom header for route security
auth_error_msg = ''
if request.headers.get("X-Custom-Forwarder"):
route_secret_key = request.headers.get("X-Custom-Forwarder")
if route_secret_key is None:
# Not blocking at the moment
# raise AuthError('invalid secret key', 403)
auth_error_msg = auth_error_msg + 'invalid secret key, '
else:
key_1 = current_app.config.get('ROUTE_SECRET_KEY_1')
key_2 = current_app.config.get('ROUTE_SECRET_KEY_2')
if key_1 == '' and key_2 == '':
# Not blocking at the moment
# raise AuthError('X-Custom-Forwarder, no secret was set on server', 503)
auth_error_msg = auth_error_msg + 'no secret was set on server, '
else:
key_used = None
route_allowed = False
if route_secret_key == key_1:
key_used = 1
route_allowed = True
elif route_secret_key == key_2:
key_used = 2
route_allowed = True
if not key_used:
# Not blocking at the moment
# raise AuthError('X-Custom-Forwarder, wrong secret', 403)
auth_error_msg = auth_error_msg + 'wrong secret'
current_app.logger.info({
'message': 'X-Custom-Forwarder',
'log_contents': {
'passed': route_allowed,
'key_used': key_used,
'error': auth_error_msg
}
})
return jsonify(key_used=key_used), 200
def restrict_ip_sms():
check_route_secret()
# Check IP of SMS providers
if request.headers.get("X-Forwarded-For"):
# X-Forwarded-For looks like "203.0.113.195, 70.41.3.18, 150.172.238.178"