Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Less information in auth error messages (DEV-3260) #3019

Merged
merged 3 commits into from
Feb 5, 2024
Merged

fix: Less information in auth error messages (DEV-3260) #3019

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9e7fb1f
fix: Less information in auth error messages (DEV-3260)
siers Feb 2, 2024
fe71048
Merge branch 'main' into fix/authentication-secure-errors
seakayone Feb 2, 2024
579dcab
Merge branch 'main' into fix/authentication-secure-errors
siers Feb 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 2 additions & 1 deletion integration/src/test/scala/org/knora/webapi/routing/AuthenticatorSpec.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ import org.knora.webapi.messages.v2.routing.authenticationmessages.CredentialsId
import org.knora.webapi.messages.v2.routing.authenticationmessages.KnoraCredentialsV2.KnoraJWTTokenCredentialsV2
import org.knora.webapi.messages.v2.routing.authenticationmessages.KnoraCredentialsV2.KnoraPasswordCredentialsV2
import org.knora.webapi.routing.Authenticator.AUTHENTICATION_INVALIDATION_CACHE_NAME
import org.knora.webapi.routing.Authenticator.BAD_CRED_NOT_VALID
import org.knora.webapi.sharedtestdata.SharedTestDataADM
import org.knora.webapi.slice.admin.domain.model.Email
import org.knora.webapi.slice.admin.domain.model.User
Expand Down Expand Up @@ -43,7 +44,7 @@ class AuthenticatorSpec extends CoreSpec with ImplicitSender with PrivateMethodT

"fail with the wrong 'email' " in {
val actual = UnsafeZioRun.run(Authenticator.getUserByEmail(Email.unsafeFrom("wronguser@example.com")))
assertFailsWithA[BadCredentialsException](actual)
assertFailsWithA[BadCredentialsException](actual, BAD_CRED_NOT_VALID)
}
}

Expand Down
17 changes: 6 additions & 11 deletions webapi/src/main/scala/org/knora/webapi/routing/Authenticator.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,6 @@ import org.knora.webapi.messages.v2.routing.authenticationmessages.*
import org.knora.webapi.routing.Authenticator.AUTHENTICATION_INVALIDATION_CACHE_NAME
import org.knora.webapi.routing.Authenticator.BAD_CRED_NONE_SUPPLIED
import org.knora.webapi.routing.Authenticator.BAD_CRED_NOT_VALID
import org.knora.webapi.routing.Authenticator.BAD_CRED_USER_INACTIVE
import org.knora.webapi.routing.Authenticator.BAD_CRED_USER_NOT_FOUND
import org.knora.webapi.slice.admin.domain.model.Email
import org.knora.webapi.slice.admin.domain.model.User
import org.knora.webapi.slice.admin.domain.model.UserIri
Expand Down Expand Up @@ -149,11 +147,8 @@ trait Authenticator {
}

object Authenticator {

val BAD_CRED_USER_NOT_FOUND = "bad credentials: user not found"
val BAD_CRED_NONE_SUPPLIED = "bad credentials: none found"
val BAD_CRED_USER_INACTIVE = "bad credentials: user inactive"
val BAD_CRED_NOT_VALID = "bad credentials: not valid"
val BAD_CRED_NONE_SUPPLIED = "bad credentials: none found"
val BAD_CRED_NOT_VALID = "bad credentials: not valid"

val AUTHENTICATION_INVALIDATION_CACHE_NAME = "authenticationInvalidationCache"
}
Expand Down Expand Up @@ -407,7 +402,7 @@ final case class AuthenticatorLive(
}

/* check if the user is active, if not, then no need to check the password */
_ <- ZIO.fail(BadCredentialsException(BAD_CRED_USER_INACTIVE)).when(!user.isActive)
_ <- ZIO.fail(BadCredentialsException(BAD_CRED_NOT_VALID)).when(!user.isActive)
_ <- ZIO
.fail(BadCredentialsException(BAD_CRED_NOT_VALID))
.when(!user.passwordMatch(passCreds.password))
Expand Down Expand Up @@ -661,7 +656,7 @@ final case class AuthenticatorLive(
messageRelay
.ask[Option[User]](UserGetByIriADM(iri, UserInformationTypeADM.Full, KnoraSystemInstances.Users.SystemUser))
.flatMap(ZIO.fromOption(_))
.orElseFail(BadCredentialsException(BAD_CRED_USER_NOT_FOUND))
.orElseFail(BadCredentialsException(BAD_CRED_NOT_VALID))

/**
* Tries to get a [[User]].
Expand All @@ -677,7 +672,7 @@ final case class AuthenticatorLive(
UserGetByEmailADM(email, UserInformationTypeADM.Full, KnoraSystemInstances.Users.SystemUser)
)
.flatMap(ZIO.fromOption(_))
.orElseFail(BadCredentialsException(BAD_CRED_USER_NOT_FOUND))
.orElseFail(BadCredentialsException(BAD_CRED_NOT_VALID))

/**
* Tries to get a [[User]].
Expand All @@ -693,7 +688,7 @@ final case class AuthenticatorLive(
UserGetByUsernameADM(username, UserInformationTypeADM.Full, KnoraSystemInstances.Users.SystemUser)
)
.flatMap(ZIO.fromOption(_))
.orElseFail(BadCredentialsException(BAD_CRED_USER_NOT_FOUND))
.orElseFail(BadCredentialsException(BAD_CRED_NOT_VALID))

/**
* Calculates the cookie name, where the external host and port are encoded as a base32 string
Expand Down