Skip to content
This repository has been archived by the owner on Mar 10, 2023. It is now read-only.

Commit

Permalink
Check cookie exists and subject on cookie before using
Browse files Browse the repository at this point in the history
We were checking if we had a cookie, but not then checking if it was not
empty, and the subject was not empty before using it for redirecting to
the user's dashboard (If they navigated to / or /dashboard)

Tested by deploying new dashboard, deleting cookie, setting cookie to
empty string etc. All returned no error (but did show 401 not
authorized)

Signed-off-by: Alistair Hey <alistair@heyal.co.uk>
  • Loading branch information
Waterdrips authored and alexellis committed May 11, 2020
1 parent 86de83c commit be0955b
Showing 1 changed file with 11 additions and 5 deletions.
16 changes: 11 additions & 5 deletions dashboard/of-cloud-dashboard/handler.js
Original file line number Diff line number Diff line change
Expand Up @@ -101,14 +101,20 @@ module.exports = async (event, context) => {

const isSignedIn = /openfaas_cloud_token=.*\s*/.test(event.headers.cookie);

console.log(path);

if (path === "/" && isSignedIn) {
headers["Location"] = "/dashboard/"+ decodedCookie["sub"];
let statusCode = 404

// If we have a cookie, and it has a subject, then redirect to the subject's dashboard
if (decodedCookie && decodedCookie["sub"]) {
headers["Location"] = "/dashboard/"+ decodedCookie["sub"];
statusCode = 307
}

return context
.headers(headers)
.status(307)
.succeed();
.status(statusCode)
.succeed()

}

let claims = get_all_claims(organizations, decodedCookie);
Expand Down

0 comments on commit be0955b

Please sign in to comment.