Codestin Search App

thewilkybarkid · 2018-01-03T09:50:38Z

A little more code (have to implement a custom Guard authenticator), but I'm happier with how this bundle works.

I think that currently-logged-in users will see a 500 page (as their session contains a serialized class that no longer exists), but will be logged out and subsequent pages will work (sessions currently expire after 24 hours too). Trying to think of a way of invalidating existing sessions.

thewilkybarkid · 2018-01-03T09:51:12Z

+use League\OAuth2\Client\Tool\BearerAuthorizationTrait;
+use Psr\Http\Message\ResponseInterface;
+
+final class ElifeProvider extends AbstractProvider


This could be a library.

thewilkybarkid · 2018-01-03T09:51:32Z

+
+use Symfony\Component\Security\Core\User\UserInterface;
+
+final class OAuthUser implements UserInterface


Might be useful upstream so will open a PR.

Opened knpuniversity/oauth2-client-bundle#72.

thewilkybarkid · 2018-01-03T11:23:24Z

+
+    private function getClient() : OAuth2Client
+    {
+        return $this->clientRegistry->getClient('elife');


This allows for lazy loading of the service (supports() is called on every request). Could use a proper lazy service instead.

thewilkybarkid · 2018-01-03T11:28:52Z

+
+        $parameters = array_filter($parameters);
+
+        ksort($parameters);


This all just makes the tests a bit simpler. However, it'd be better to compare URIs safely instead and not worry about order.

thewilkybarkid · 2018-01-03T12:58:57Z

+
+    private function normalize(RequestInterface $request) : RequestInterface
+    {
+        $headers = array_change_key_case($request->getHeaders());


Need to finish off csarrazi/CsaGuzzleBundle#202 as it's an upstream bug.

…t be unserialized from the session (thewilkybarkid) This PR was merged into the 2.7 branch. Discussion ---------- [Security] Fail gracefully if the security token cannot be unserialized from the session | Q | A | ------------- | --- | Branch? | 2.7 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | | License | MIT | Doc PR | If the security token in the session can't be unserialized, an `E_NOTICE` is issued. This prevents it (and provides a better log message if it's not even a `__PHP_Incomplete_Class`). This is similar to #24731, but I saw it triggered when changing OAuth library (elifesciences/journal#824), so the token class itself no longer exists. (I want to avoid having to manually invalidate all sessions, as not all sessions use that token class.) Commits ------- 053fa43 [Security] Fail gracefully if the security token cannot be unserialized from the session

giorgiosironi · 2018-01-29T15:51:11Z

-        $subRequest = $request->duplicate([], null, $path);
+        if ($referer = trim($request->headers->get('Referer'))) {
+            $firewall = $this->get('security.firewall.map')->getFirewallConfig($request);
+            $this->saveTargetPath($request->getSession(), $firewall->getName(), $referer);


Is there any validation on the Referer that checks the host matches for example? Is it coincevable for someone external to send a user with its own Referer and getting it redirected there (and is it a problem?)

Yep, already present

journal/test/Controller/AuthenticationTest.php

Lines 86 to 119 in f2ccd2f

/**

* @test

* @dataProvider refererProvider

*/

public function it_uses_the_referer_header_for_redirecting_after_logging_in(string $referer, string $expectedRedirect)

{

$client = static::createClient();

$client->followRedirects(false);

$client->request('GET', '/log-in?open-sesame', [], [], array_filter(['HTTP_REFERER' => $referer]));

$response = $client->getResponse();

$this->assertTrue($response->isRedirect());

$state = parse_query((new Uri($response->headers->get('Location')))->getQuery())['state'];

$this->readyToken();

$client->request('GET', "/log-in/check?code=foo&state=$state");

$response = $client->getResponse();

$this->assertTrue($response->isRedirect());

$this->assertSame($expectedRedirect, $response->headers->get('Location'));

}

public function refererProvider() : Traversable

{

yield 'no header' => ['', 'http://localhost/'];

yield 'homepage' => ['http://localhost/', 'http://localhost/'];

yield 'local path' => ['http://localhost/foo', 'http://localhost/foo'];

yield 'local path with query string' => ['http://localhost/foo?bar', 'http://localhost/foo?bar'];

yield 'external site' => ['http://www.example.com/', 'http://localhost/'];

yield 'external site with path' => ['http://www.example.com/foo', 'http://localhost/'];

}

giorgiosironi · 2018-01-29T15:52:07Z

+
+    public function onAuthenticationFailure(Request $request, AuthenticationException $exception) : Response
+    {
+        $this->saveAuthenticationErrorToSession($request, $exception);


does this go to a flash message or similar user-visible place?

AuthenticationErrorSubscriber turns it into a flash message.

giorgiosironi · 2018-01-29T15:52:37Z

+    {
+        $this->saveAuthenticationErrorToSession($request, $exception);
+
+        return new RedirectResponse($this->urlGenerator->generate('home'));


and would it be actually shown on the homepage or would the user just see a cached version identical for everyone?

There's a session so isn't cached.

giorgiosironi · 2018-01-29T15:53:59Z

+use Psr\Http\Message\UriInterface;
+use function GuzzleHttp\Psr7\uri_for;
+
+trait Assertions


a bit like the Utils class. Name it UriAssertions for cohesion?

Could do, had though any other assertions could be put here but a trait each is also fine.

Switch to knpuniversity/oauth2-client-bundle

7ef9e63

thewilkybarkid commented Jan 3, 2018

View reviewed changes

CS fixes

b4bbf92

thewilkybarkid commented Jan 3, 2018

View reviewed changes

Message is the same as error_description so it's redundant

d73f9fa

thewilkybarkid commented Jan 3, 2018

View reviewed changes

Normalize mocked requests

0d0b86b

thewilkybarkid commented Jan 3, 2018

View reviewed changes

Simpler

d0e6f12

thewilkybarkid mentioned this pull request Jan 3, 2018

[Security] Fail gracefully if the security token cannot be unserialized from the session symfony/symfony#25669

Merged

thewilkybarkid and others added 8 commits January 10, 2018 14:41

Use bundle's user provider

27c550d

*Ahem*

de93224

Redundant

13b7342

Match #836

d995127

Merge branch 'develop' into oauth2-client-bundle

9156aa2

Tis no more

128239a

Fix test case

fbc8516

Merge branch 'develop' into oauth2-client-bundle

c72d1f5

thewilkybarkid changed the title ~~[WIP] Switch to knpuniversity/oauth2-client-bundle~~ Switch to knpuniversity/oauth2-client-bundle Jan 29, 2018

thewilkybarkid requested a review from giorgiosironi January 29, 2018 14:54

giorgiosironi reviewed Jan 29, 2018

View reviewed changes

giorgiosironi approved these changes Jan 29, 2018

View reviewed changes

Merge branch 'develop' into oauth2-client-bundle

5857173

thewilkybarkid merged commit 30d258c into develop Jan 30, 2018

thewilkybarkid deleted the oauth2-client-bundle branch January 30, 2018 11:20

thewilkybarkid mentioned this pull request Jan 30, 2018

Hard-code firewall name #849

Merged


		use Symfony\Component\Security\Core\User\UserInterface;

		final class OAuthUser implements UserInterface

	/**
	* @test
	* @dataProvider refererProvider
	*/
	public function it_uses_the_referer_header_for_redirecting_after_logging_in(string $referer, string $expectedRedirect)
	{
	$client = static::createClient();
	$client->followRedirects(false);

	$client->request('GET', '/log-in?open-sesame', [], [], array_filter(['HTTP_REFERER' => $referer]));
	$response = $client->getResponse();

	$this->assertTrue($response->isRedirect());

	$state = parse_query((new Uri($response->headers->get('Location')))->getQuery())['state'];

	$this->readyToken();

	$client->request('GET', "/log-in/check?code=foo&state=$state");
	$response = $client->getResponse();

	$this->assertTrue($response->isRedirect());
	$this->assertSame($expectedRedirect, $response->headers->get('Location'));
	}

	public function refererProvider() : Traversable
	{
	yield 'no header' => ['', 'http://localhost/'];
	yield 'homepage' => ['http://localhost/', 'http://localhost/'];
	yield 'local path' => ['http://localhost/foo', 'http://localhost/foo'];
	yield 'local path with query string' => ['http://localhost/foo?bar', 'http://localhost/foo?bar'];
	yield 'external site' => ['http://www.example.com/', 'http://localhost/'];
	yield 'external site with path' => ['http://www.example.com/foo', 'http://localhost/'];
	}

Conversation

thewilkybarkid commented Jan 3, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

thewilkybarkid commented Jan 3, 2018 •

edited

Loading