Merge pull request #1391 from alphagov/add_proxy_header_check

Add proxy header check

app/__init__.py

@@ -3,14 +3,13 @@ import random
 import string
 import uuid
 
-from flask import Flask, _request_ctx_stack
-from flask import request, g, jsonify
+from flask import Flask, _request_ctx_stack, request, g, jsonify
 from flask_sqlalchemy import SQLAlchemy
 from flask_marshmallow import Marshmallow
 from monotonic import monotonic
 from notifications_utils.clients.statsd.statsd_client import StatsdClient
 from notifications_utils.clients.redis.redis_client import RedisClient
-from notifications_utils import logging, request_id
+from notifications_utils import logging, request_helper
 from werkzeug.local import LocalProxy
 
 from app.celery.celery import NotifyCelery
@@ -56,7 +55,7 @@ def create_app(app_name=None):
         application.config['NOTIFY_APP_NAME'] = app_name
 
     init_app(application)
-    request_id.init_app(application)
+    request_helper.init_app(application)
     db.init_app(application)
     ma.init_app(application)
     statsd_client.init_app(application)
@@ -206,6 +205,8 @@ def init_app(app):
     def record_user_agent():
         statsd_client.incr("user-agent.{}".format(process_user_agent(request.headers.get('User-Agent', None))))
 
+    app.before_request(request_helper.check_proxy_header_before_request)
+
     @app.before_request
     def record_request_details():
         g.start = monotonic()

app/authentication/auth.py

@@ -45,56 +45,7 @@ def requires_no_auth():
     pass
 
 
-def check_route_secret():
-    # Check route of inbound sms (Experimental)
-    # Custom header for route security
-    auth_error_msg = ''
-    if request.headers.get("X-Custom-Forwarder"):
-        route_secret_key = request.headers.get("X-Custom-Forwarder")
-
-        if route_secret_key is None:
-            # Not blocking at the moment
-            # raise AuthError('invalid secret key', 403)
-            auth_error_msg = auth_error_msg + 'invalid secret key, '
-        else:
-
-            key_1 = current_app.config.get('ROUTE_SECRET_KEY_1')
-            key_2 = current_app.config.get('ROUTE_SECRET_KEY_2')
-
-            if key_1 == '' and key_2 == '':
-                # Not blocking at the moment
-                # raise AuthError('X-Custom-Forwarder, no secret was set on server', 503)
-                auth_error_msg = auth_error_msg + 'no secret was set on server, '
-            else:
-
-                key_used = None
-                route_allowed = False
-                if route_secret_key == key_1:
-                    key_used = 1
-                    route_allowed = True
-                elif route_secret_key == key_2:
-                    key_used = 2
-                    route_allowed = True
-
-                if not key_used:
-                    # Not blocking at the moment
-                    # raise AuthError('X-Custom-Forwarder, wrong secret', 403)
-                    auth_error_msg = auth_error_msg + 'wrong secret'
-
-        current_app.logger.info({
-            'message': 'X-Custom-Forwarder',
-            'log_contents': {
-                'passed': route_allowed,
-                'key_used': key_used,
-                'error': auth_error_msg
-            }
-        })
-        return jsonify(key_used=key_used), 200
-
-
 def restrict_ip_sms():
-    check_route_secret()
-
     # Check IP of SMS providers
     if request.headers.get("X-Forwarded-For"):
         # X-Forwarded-For looks like "203.0.113.195, 70.41.3.18, 150.172.238.178"

app/config.py

@@ -121,6 +121,8 @@ class Config(object):
     ONE_OFF_MESSAGE_FILENAME = 'Report'
     MAX_VERIFY_CODE_COUNT = 10
 
+    CHECK_PROXY_HEADER = False
+
     NOTIFY_SERVICE_ID = 'd6aa2c68-a2d9-4437-ab19-3ae8eb202553'
     NOTIFY_USER_ID = '6af522d0-2915-4e52-83a3-3690455a5fe6'
     INVITATION_EMAIL_TEMPLATE_ID = '4f46df42-f795-4cc4-83bb-65ca312f49cc'
@@ -371,6 +373,7 @@ class Preview(Config):
     DVLA_RESPONSE_BUCKET_NAME = 'notify.works-ftp'
     FROM_NUMBER = 'preview'
     API_RATE_LIMIT_ENABLED = True
+    CHECK_PROXY_HEADER = True
 
 
 class Staging(Config):
@@ -381,6 +384,7 @@ class Staging(Config):
     STATSD_ENABLED = True
     FROM_NUMBER = 'stage'
     API_RATE_LIMIT_ENABLED = True
+    CHECK_PROXY_HEADER = True
 
 
 class Live(Config):
@@ -394,6 +398,7 @@ class Live(Config):
     FUNCTIONAL_TEST_PROVIDER_SMS_TEMPLATE_ID = 'ba9e1789-a804-40b8-871f-cc60d4c1286f'
     PERFORMANCE_PLATFORM_ENABLED = True
     API_RATE_LIMIT_ENABLED = True
+    CHECK_PROXY_HEADER = False
 
 
 class CloudFoundryConfig(Config):