Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Workaround csrf redirects #667

Merged
merged 10 commits into from Nov 4, 2020
Merged

fix: Workaround csrf redirects #667

merged 10 commits into from Nov 4, 2020

Conversation

marikaner
Copy link
Contributor

@marikaner marikaner commented Nov 4, 2020

Context

The issue behind csrf requests not working on On-Premise systems is a bug in axios (axios/axios#3369). The http proxy agent config is missing in the second request, when there is a redirect. I added a workaround to achieve the correct redirect behavior. This issue was opened by a user here: #617

Definition of Done

Please consider all items and remove only if not applicable.

  • Tests created/adjusted for your changes.
  • Release notes updated.
    • Provide sufficient context so that each entry can be understood on its own.
    • Be specific about names of functions, classes, modules, etc.
    • Describe when or where this is relevant
    • Use indicative and present tense. For example, write "Provide function name that does X in order to Y" over "Now X can be done by calling a new function".
  • PR title adheres to conventional commit guidelines (please note that only fix: and feat: will end up in the release notes)
  • If applicable: Properly documented (JSDoc of public API)
  • If applicable: Check if yarn run doc still works.

@marikaner marikaner changed the title Csrf fix fix: Workaround csrf redirects Nov 4, 2020
@marikaner marikaner marked this pull request as ready for review November 4, 2020 13:35
@@ -0,0 +1,46 @@
# How to remote debug an application on SAP Cloud Platform
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this got in by accident?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes

if (error.request._isRedirect) {
return makeCsrfRequest(destination, {
...axiosConfig,
url: error.request._options.path
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a API to get the path? Accessing _options is potentially dangerous because this variable is not part of the public API of the request object.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps a check with good logs statement in case the path is not present.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will do

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a log statement. I don't think that there is another api for the request, but for extra safety I added a check that the path exists.

Copy link
Contributor

@FrankEssenberger FrankEssenberger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM only a minor comment.

@marikaner marikaner merged commit b2bf86f into main Nov 4, 2020
@marikaner marikaner deleted the csrf-fix branch November 4, 2020 16:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants