Fail if window.localStorage is disabled

RabbitMQ should never rely on cookies to store tokens. If the window.localStorage is disabled in the browser, the management ui should fail rather than fallback to cookies.
rabbitmq · Dec 13, 2022 · be85e06 · be85e06
1 parent 81524ad
commit be85e06
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 12 deletions.
diff --git a/deps/rabbitmq_management/priv/www/js/prefs.js b/deps/rabbitmq_management/priv/www/js/prefs.js
@@ -13,14 +13,14 @@ const AUTH_SCHEME = "auth-scheme"
 const LOGGED_IN = 'loggedIn'
 
 function has_auth_credentials() {
-    return get_pref(CREDENTIALS) != undefined && get_pref(AUTH_SCHEME) != undefined &&
+    return get_local_pref(CREDENTIALS) != undefined && get_local_pref(AUTH_SCHEME) != undefined &&
       get_cookie_value(LOGGED_IN) != undefined
 }
 function get_auth_credentials() {
-    return get_pref(CREDENTIALS)
+    return get_local_pref(CREDENTIALS)
 }
 function get_auth_scheme() {
-    return get_pref(AUTH_SCHEME)
+    return get_local_pref(AUTH_SCHEME)
 }
 function clear_auth() {
     clear_local_pref(CREDENTIALS)
@@ -36,8 +36,8 @@ function set_token_auth(token) {
 function set_auth(auth_scheme, credentials, validUntil) {
     clear_local_pref(CREDENTIALS)
     clear_local_pref(AUTH_SCHEME)
-    store_pref(CREDENTIALS, credentials)
-    store_pref(AUTH_SCHEME, auth_scheme)
+    store_local_pref(CREDENTIALS, credentials)
+    store_local_pref(AUTH_SCHEME, auth_scheme)
     store_cookie_value_with_expiration(LOGGED_IN, "true", validUntil) // session marker
 }
 function authorization_header() {
@@ -101,6 +101,18 @@ function get_cookie_value(k) {
     r = parse_cookie()[short_key(k)];
     return r == undefined ? default_pref(k) : r;
 }
+function store_local_pref(k, v) {
+    if (local_storage_available()) {
+        window.localStorage.setItem('rabbitmq.' + k, v);
+    }else {
+      throw "Local Storage not available. RabbitMQ requires localStorage"
+    }
+}
+function clear_local_pref(k) {
+    if (local_storage_available()) {
+        window.localStorage.removeItem('rabbitmq.' + k);
+    }
+}
 
 function store_pref(k, v) {
     if (local_storage_available()) {
@@ -123,11 +135,12 @@ function clear_pref(k) {
         store_cookie(d);
     }
 }
-
-function clear_local_pref(k) {
-    if (local_storage_available()) {
-        window.localStorage.removeItem('rabbitmq.' + k);
-    }
+function get_local_pref(k) {
+  if (local_storage_available()) {
+      return window.localStorage.getItem('rabbitmq.' + k)
+  }else {
+    throw "Local Storage not available. RabbitMQ requires localStorage"
+  }
 }
 
 function get_pref(k) {
@@ -212,7 +225,7 @@ function store_cookie_with_expiration(dict, expiration_date) {
 function get_cookie(key) {
     var cookies = document.cookie.split(';');
     for (var i in cookies) {
-        var kv = jQuery.trim(cookies[i]).split('=');
+        var kv = cookies[i].trim().split('=');
         if (kv[0] == key) return kv[1];
     }
     return '';

diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_login.erl b/deps/rabbitmq_management/src/rabbit_mgmt_login.erl
@@ -23,7 +23,6 @@ init(Req0, State) ->
       cowboy_req:stream_body("<html><head></head>", nofin, Req2),
       cowboy_req:stream_body("<body>", nofin, Req2),
       cowboy_req:stream_body("<script src='js/prefs.js'></script>", nofin, Req2),
-      cowboy_req:stream_body("<script src='js/jquery-3.5.1.min.js'></script>", nofin, Req2),
       cowboy_req:stream_body("<script type='text/javascript'>", nofin, Req2),
       cowboy_req:stream_body("set_token_auth('", nofin, Req2),
       cowboy_req:stream_body(AccessToken, nofin, Req2),