fix(authentication): make cookie name unique between environments #2091
Conversation
…-prod-domain-is-used-on-all-other-domains
…-prod-domain-is-used-on-all-other-domains
| host_port = webapi_hostname .. ':' .. webapi_port | ||
| server.log("host_port: " .. host_port, server.loglevel.LOG_DEBUG) | ||
|
|
||
| local customPadMap = { "", "999999", "9999", "999", "9" } |
There was a problem hiding this comment.
just out of curiosity: what's the deal with this padMap?
There was a problem hiding this comment.
the standard padding is = which is not allowed because then the header is going to be something like KnoraAuthenticationDFJSKLFJDSLJ===JWT. No additional equal signs are allowed. This is why I changed it to 9 which is not used as part of the alphabet in the algorithm.
| "succeed with generating the name" in { | ||
| Authenticator.calculateCookieName(settings) should equal("KnoraAuthenticationGAXDALRQFYYDUMZTGMZQ9999") | ||
| } |
There was a problem hiding this comment.
is there an unhappy path that you could test? (if you made a copy of the settings where the .externalKnoraApiHostPort is an empty string or an invalid value, you'd expect a certain error, right?)
There was a problem hiding this comment.
no, the code expects this to be a valid thing. If this is not valid, then the whole API would not work. This would be something to test in the config or something for a valueobject.
webapi/src/main/scala/org/knora/webapi/routing/Authenticator.scala
Outdated
Show resolved
Hide resolved
webapi/src/main/scala/org/knora/webapi/routing/Authenticator.scala
Outdated
Show resolved
Hide resolved
webapi/src/test/scala/org/knora/webapi/e2e/admin/FilesADME2ESpec.scala
Outdated
Show resolved
Hide resolved
webapi/src/test/scala/org/knora/webapi/e2e/v1/AuthenticationV1E2ESpec.scala
Outdated
Show resolved
Hide resolved
|
Kudos, SonarCloud Quality Gate passed!
|
subotic
deleted the
wip/DEV-994-dsp-app-dsp-api-auth-cookie-from-prod-domain-is-used-on-all-other-domains
branch
Resolves DEV-994
PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
What is the current behavior?
Issue Number: DEV-994
What is the new behavior?
Does this PR introduce a breaking change?
Other information