From a898f5ea6af9a93c4a7550825884af464cb0a86d Mon Sep 17 00:00:00 2001 From: jaxoncreed Date: Fri, 18 Oct 2019 16:52:19 -0400 Subject: [PATCH 1/3] Remove confusing 2 from message --- lib/requests/sharing-request.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/requests/sharing-request.js b/lib/requests/sharing-request.js index f534f3110..64e16658b 100644 --- a/lib/requests/sharing-request.js +++ b/lib/requests/sharing-request.js @@ -146,7 +146,7 @@ class SharingRequest extends AuthRequest { // Ensure the user arrived here by logging in if (!this.session.subject || !this.session.subject._id) { this.response.status(401) - this.response.send('User not logged in 2') + this.response.send('User not logged in') return false } return true From 8e9820d4347832697e312ecc3d5e6b37d4b41813 Mon Sep 17 00:00:00 2001 From: Ubuntu Date: Wed, 6 Nov 2019 20:31:56 +0000 Subject: [PATCH 2/3] Fixed user not logged in 2 --- lib/create-app.js | 1 + lib/requests/sharing-request.js | 11 +++++------ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/lib/create-app.js b/lib/create-app.js index 5cff5d5a9..6bb8c09ea 100644 --- a/lib/create-app.js +++ b/lib/create-app.js @@ -296,6 +296,7 @@ function initAuthentication (app, argv) { */ function sessionSettings (secureCookies, host) { let sessionSettings = { + name: 'solid.auth', secret: uuid.v1(), saveUninitialized: false, resave: false, diff --git a/lib/requests/sharing-request.js b/lib/requests/sharing-request.js index 64e16658b..01052eeba 100644 --- a/lib/requests/sharing-request.js +++ b/lib/requests/sharing-request.js @@ -82,6 +82,8 @@ class SharingRequest extends AuthRequest { } else { request.renderForm(null, req, appOrigin) } + } else { + request.redirectPostSharing() } } @@ -119,6 +121,8 @@ class SharingRequest extends AuthRequest { // Redirect once that's all done request.redirectPostSharing() + } else { + request.redirectPostSharing() } } @@ -144,12 +148,7 @@ class SharingRequest extends AuthRequest { isUserLoggedIn () { // Ensure the user arrived here by logging in - if (!this.session.subject || !this.session.subject._id) { - this.response.status(401) - this.response.send('User not logged in') - return false - } - return true + return !!(this.session.subject && this.session.subject._id) } getAppUrl () { From 7e5ef824a13546dcf652759ac0de0b45c145e370 Mon Sep 17 00:00:00 2001 From: jaxoncreed Date: Wed, 6 Nov 2019 15:51:00 -0500 Subject: [PATCH 3/3] Fix tests for new cookie name --- lib/create-app.js | 2 +- test/integration/authentication-oidc-test.js | 12 ++++++------ ...ation-oidc-with-strict-origins-turned-off-test.js | 4 ++-- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/lib/create-app.js b/lib/create-app.js index 6bb8c09ea..0d7a365a2 100644 --- a/lib/create-app.js +++ b/lib/create-app.js @@ -296,7 +296,7 @@ function initAuthentication (app, argv) { */ function sessionSettings (secureCookies, host) { let sessionSettings = { - name: 'solid.auth', + name: 'nssidp.sid', secret: uuid.v1(), saveUninitialized: false, resave: false, diff --git a/test/integration/authentication-oidc-test.js b/test/integration/authentication-oidc-test.js index 76422fc0f..77a74abb0 100644 --- a/test/integration/authentication-oidc-test.js +++ b/test/integration/authentication-oidc-test.js @@ -137,7 +137,7 @@ describe('Authentication API (OIDC)', () => { }) it('should set the cookie', () => { - expect(cookie).to.match(/connect.sid=\S{65,100}/) + expect(cookie).to.match(/nssidp.sid=\S{65,100}/) }) it('should set the cookie with HttpOnly', () => { @@ -247,7 +247,7 @@ describe('Authentication API (OIDC)', () => { describe('with malicious cookie but without origin', () => { let response before(done => { - var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') alice.get('/private-for-alice.txt') .set('Cookie', malcookie) .end((err, res) => { @@ -353,7 +353,7 @@ describe('Authentication API (OIDC)', () => { describe('with malicious cookie but with globally configured origin', () => { let response before(done => { - var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') alice.get('/private-for-alice.txt') .set('Cookie', malcookie) .set('Origin', 'https://apps.solid.invalid') @@ -407,7 +407,7 @@ describe('Authentication API (OIDC)', () => { describe('with malicious cookie and our origin', () => { let response before(done => { - var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') alice.get('/private-for-alice.txt') .set('Cookie', malcookie) .set('Origin', aliceServerUri) @@ -425,7 +425,7 @@ describe('Authentication API (OIDC)', () => { describe('with malicious cookie and a non-matching origin', () => { let response before(done => { - var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') alice.get('/private-for-owner.txt') .set('Cookie', malcookie) .set('Origin', bobServerUri) @@ -455,7 +455,7 @@ describe('Authentication API (OIDC)', () => { describe('with trusted app and malicious cookie', () => { before(done => { - var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') alice.get('/private-for-alice.txt') .set('Cookie', malcookie) .set('Origin', trustedAppUri) diff --git a/test/integration/authentication-oidc-with-strict-origins-turned-off-test.js b/test/integration/authentication-oidc-with-strict-origins-turned-off-test.js index 104e103b9..e2a5cf489 100644 --- a/test/integration/authentication-oidc-with-strict-origins-turned-off-test.js +++ b/test/integration/authentication-oidc-with-strict-origins-turned-off-test.js @@ -134,7 +134,7 @@ describe('Authentication API (OIDC) - With strict origins turned off', () => { }) it('should set the cookie', () => { - expect(cookie).to.match(/connect.sid=\S{65,100}/) + expect(cookie).to.match(/nssidp.sid=\S{65,100}/) }) it('should set the cookie with HttpOnly', () => { @@ -286,7 +286,7 @@ describe('Authentication API (OIDC) - With strict origins turned off', () => { let malcookie before(() => { // How Mallory might set their cookie: - malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') }) describe('and no origin set', () => { before(done => {