fix(authentication): make cookie name unique between environments #2095
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -109,7 +109,7 @@ end | |
| -- generic function to decode and encode base32/base64 | ||
| -------------------------------------------------------------------------------- | ||
|
|
||
| function from_basexx( str, alphabet, bits ) | ||
| local result = {} | ||
| for i = 1, #str do | ||
| local c = string.sub( str, i, i ) | ||
|
|
@@ -127,7 +127,7 @@ local function from_basexx( str, alphabet, bits ) | |
| return pure_from_bit( string.sub( value, 1, #value - pad ) ) | ||
| end | ||
|
|
||
| function to_basexx( str, alphabet, bits, pad ) | ||
| local bitString = basexx.to_bit( str ) | ||
|
|
||
| local chunks = divide_string( bitString, bits ) | ||
|
|
@@ -160,6 +160,22 @@ function basexx.to_base32( str ) | |
| return to_basexx( str, base32Alphabet, 5, base32PadMap[ #str % 5 + 1 ] ) | ||
| end | ||
|
|
||
| -------------------------------------------------------------------------------- | ||
| -- dsp-api custom variant | ||
| -------------------------------------------------------------------------------- | ||
|
|
||
| local base32CustomAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567" | ||
| local base32CustomPadMap = { "", "999999", "9999", "999", "9" } | ||
|
|
||
| function basexx.from_base32Custom( str, ignore ) | ||
| str = ignore_set( str, ignore ) | ||
| return from_basexx( string.upper( str ), base32CustomAlphabet, 5 ) | ||
| end | ||
|
|
||
| function basexx.to_base32Custom( str ) | ||
| return to_basexx( str, base32CustomAlphabet, 5, base32CustomPadMap[ #str % 5 + 1 ] ) | ||
| end | ||
|
|
||
| -------------------------------------------------------------------------------- | ||
| -- crockford: http://www.crockford.com/wrmg/base32.html | ||
| -------------------------------------------------------------------------------- | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -36,12 +36,14 @@ function get_session_id(cookie) | |
| host_port = webapi_hostname .. ':' .. webapi_port | ||
| server.log("host_port: " .. host_port, server.loglevel.LOG_DEBUG) | ||
|
|
||
| host_port_base32 = basexx.to_base32Custom(host_port) | ||
| server.log("host_port_base32: " .. host_port_base32, server.loglevel.LOG_DEBUG) | ||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
| -- tries to extract the Knora session id from the cookie: | ||
| -- gets the digits between "sid=" and the closing ";" (only given in case of several key value pairs) | ||
| -- ";" is expected to separate different key value pairs (https://tools.ietf.org/html/rfc6265#section-4.2.1) | ||
|
|
@@ -51,6 +53,10 @@ function get_session_id(cookie) | |
| local session_id = string.match(cookie, "KnoraAuthentication" .. host_port_base32 .. "=([^%s;]+)") | ||
| server.log("extracted session_id: " .. session_id, server.loglevel.LOG_DEBUG) | ||
|
|
||
| local session = {} | ||
| session["id"] = session_id | ||
| session["name"] = "KnoraAuthentication" .. host_port_base32 | ||
|
|
||
| return session | ||
|
|
||
| end | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -42,17 +42,18 @@ function pre_flight(prefix, identifier, cookie) | |
|
|
||
| if cookie ~='' then | ||
|
|
||
| -- tries to extract the Knora session name and id from the cookie: | ||
| -- gets the digits between "sid=" and the closing ";" (only given in case of several key value pairs) | ||
| -- returns nil if it cannot find it | ||
| session = get_session_id(cookie) | ||
|
|
||
| if session == nil then | ||
| -- no session could be extracted | ||
| print("cookie key is invalid: " .. cookie) | ||
| server.log("cookie key is invalid: " .. cookie, server.loglevel.LOG_ERR) | ||
|
There was a problem hiding this comment. nope, removed the print |
||
| else | ||
| knora_cookie_header = { Cookie = session["name"] .. "=" .. session["id"] } | ||
| server.log("pre_flight - knora_cookie_header: " .. knora_cookie_header["Cookie"], server.loglevel.LOG_DEBUG) | ||
| end | ||
| end | ||
|
|
||
|
|
@@ -78,7 +79,6 @@ function pre_flight(prefix, identifier, cookie) | |
|
|
||
| -- print("knora_url: " .. knora_url) | ||
|
|
||
| server.log("pre_flight - knora_url: " .. knora_url, server.loglevel.LOG_DEBUG) | ||
|
|
||
| success, result = server.http("GET", knora_url, knora_cookie_header, 5000) | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -433,7 +433,7 @@ class ApplicationActor( | |
| new ProjectsRouteADM(routeData).knoraApiPath ~ | ||
| new StoreRouteADM(routeData).knoraApiPath ~ | ||
| new UsersRouteADM(routeData).knoraApiPath ~ | ||
| new FilesRouteADM(routeData).knoraApiPath ~ | ||
| new SwaggerApiDocsRoute(routeData).knoraApiPath | ||
| } | ||
| } | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -17,7 +17,7 @@ import org.knora.webapi.routing.RouteUtilADM | |
| /** | ||
| * Provides a routing function for the API that Sipi connects to. | ||
| */ | ||
| class FilesRouteADM(routeData: KnoraRouteData) extends KnoraRoute(routeData) with Authenticator { | ||
|
|
||
| /** | ||
| * A routing function for the API that Sipi connects to. | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -37,12 +37,10 @@ | |
| <logger name="kamon.metric" level="ERROR"/> | ||
| <logger name="org.apache.http" level="INFO"/> | ||
| <logger name="org.apache.http.wire" level="INFO"/> | ||
| <logger name="org.testcontainers" level="WARN" /> | ||
| <logger name="com.github.dockerjava" level="WARN" /> | ||
| <logger name="ch.qos.logback" level="WARN" /> | ||
|
|
||
|
|
||
| <!-- Logging inside ZIO --> | ||
| <logger name="zio-slf4j-logger" level="INFO"/> | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -21,6 +21,7 @@ import org.knora.webapi.util.MutableTestString | |
|
|
||
| import scala.concurrent.Await | ||
| import scala.concurrent.duration._ | ||
| import org.knora.webapi.routing.Authenticator | ||
|
|
||
| object AuthenticationV2E2ESpec { | ||
| val config: Config = ConfigFactory.parseString(""" | ||
|
|
@@ -212,6 +213,24 @@ class AuthenticationV2E2ESpec | |
| assert(response.status === StatusCodes.OK) | ||
| } | ||
|
|
||
| "authenticate with token in cookie" in { | ||
| val KnoraAuthenticationCookieName = Authenticator.calculateCookieName(settings) | ||
| val cookieHeader = headers.Cookie(KnoraAuthenticationCookieName, token.get) | ||
|
|
||
| val request = Get(baseApiUrl + "/v2/authentication") ~> addHeader(cookieHeader) | ||
| val response = singleAwaitingRequest(request) | ||
| assert(response.status === StatusCodes.OK) | ||
| } | ||
|
|
||
| "fail authentication with invalid token in cookie" in { | ||
| val KnoraAuthenticationCookieName = Authenticator.calculateCookieName(settings) | ||
| val cookieHeader = headers.Cookie(KnoraAuthenticationCookieName, "not_a_valid_token") | ||
|
|
||
| val request = Get(baseApiUrl + "/v2/authentication") ~> addHeader(cookieHeader) | ||
| val response = singleAwaitingRequest(request) | ||
| assert(response.status === StatusCodes.Unauthorized) | ||
| } | ||
|
|
||
| "logout when providing token in header" in { | ||
| // do logout with stored token | ||
| val request = | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we still need the commented out command? As far as I understand, for tests we need the
sipi.docker-test-config.lua. On test/staging/prod/project servers there is another lua config anyway, right?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
good catch. no, it is only needed for some manual testing. I reverted the change