Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add no-store to the Cache-Control header on auth responses #916

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Add no-store to the Cache-Control header on auth responses #916

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e3ac1c2
Add no-store and no-cache to the Cache-Control header on auth responses
JackLewis-digirati Nov 14, 2024
9437b6c
Update to use custom action attribute that doesn't send headers on fa…
JackLewis-digirati Nov 14, 2024
526eb94
allow caching only on BadRequest types, rather than all failures
JackLewis-digirati Nov 14, 2024
e7c8655
move back to using inbuilt response cache
JackLewis-digirati Nov 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions src/protagonist/Orchestrator.Tests/Integration/AuthHandlingTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ public async Task Get_Clickthrough_UnknownCustomer_Returns400()

// Assert
response.StatusCode.Should().Be(HttpStatusCode.BadRequest);
response.Headers.CacheControl!.NoStore.Should().BeTrue();
}

[Fact]
Expand All @@ -67,6 +68,7 @@ public async Task Get_UnknownRole_Returns404()

// Assert
response.StatusCode.Should().Be(HttpStatusCode.NotFound);
response.Headers.CacheControl!.NoStore.Should().BeTrue();
}

[Fact]
Expand Down Expand Up @@ -110,6 +112,7 @@ public async Task Get_Token_Returns401_WithErrorJson_IfNoCookie_AndMessageIdNotP

// Assert
response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
response.Headers.CacheControl!.NoStore.Should().BeTrue();

var responseBody = JObject.Parse(await response.Content.ReadAsStringAsync());
responseBody["error"].Value<string>().Should().Be("missingCredentials");
Expand All @@ -129,6 +132,7 @@ public async Task Get_Token_Returns403_WithErrorJson_IfCookieDoesNotContainId_An

// Assert
response.StatusCode.Should().Be(HttpStatusCode.Forbidden);
response.Headers.CacheControl!.NoStore.Should().BeTrue();

var responseBody = JObject.Parse(await response.Content.ReadAsStringAsync());
responseBody["error"].Value<string>().Should().Be("invalidCredentials");
Expand All @@ -148,6 +152,7 @@ public async Task Get_Token_Returns403_WithErrorJson_IfCookieDoesNotContainKnown

// Assert
response.StatusCode.Should().Be(HttpStatusCode.Forbidden);
response.Headers.CacheControl!.NoStore.Should().BeTrue();

var responseBody = JObject.Parse(await response.Content.ReadAsStringAsync());
responseBody["error"].Value<string>().Should().Be("invalidCredentials");
Expand All @@ -169,6 +174,7 @@ public async Task Get_Token_Returns403_WithErrorJson_IfCookieContainsId_ForDiffe

// Assert
response.StatusCode.Should().Be(HttpStatusCode.Forbidden);
response.Headers.CacheControl!.NoStore.Should().BeTrue();

var responseBody = JObject.Parse(await response.Content.ReadAsStringAsync());
responseBody["error"].Value<string>().Should().Be("invalidCredentials");
Expand All @@ -190,6 +196,7 @@ public async Task Get_Token_Returns403_WithErrorJson_IfCookieContainsExpiredId_A

// Assert
response.StatusCode.Should().Be(HttpStatusCode.Forbidden);
response.Headers.CacheControl!.NoStore.Should().BeTrue();

var responseBody = JObject.Parse(await response.Content.ReadAsStringAsync());
responseBody["error"].Value<string>().Should().Be("invalidCredentials");
Expand All @@ -215,6 +222,7 @@ public async Task Get_Token_Returns200_WithAccessToken_IfSuccess_AndMessageIdNot
var responseBody = JObject.Parse(await response.Content.ReadAsStringAsync());
responseBody["accessToken"].Value<string>().Should().Be(token.Entity.BearerToken);
responseBody["expiresIn"].Value<int>().Should().Be(token.Entity.Ttl);
response.Headers.CacheControl!.NoStore.Should().BeTrue();
}
#endregion

Expand All @@ -234,6 +242,7 @@ public async Task Get_Token_ReturnsView_WithErrorJson_IfNoCookie()
var responseBody = await ParseHtmlTokenReponse(response);
responseBody["error"].Value<string>().Should().Be("missingCredentials");
responseBody["description"].Value<string>().Should().Be("Required cookie missing");
response.Headers.CacheControl!.NoStore.Should().BeTrue();
}

[Fact]
Expand All @@ -253,6 +262,7 @@ public async Task Get_Token_ReturnsView_WithErrorJson_IfCookieDoesNotContainId()
var responseBody = await ParseHtmlTokenReponse(response);
responseBody["error"].Value<string>().Should().Be("invalidCredentials");
responseBody["description"].Value<string>().Should().Be("Id not found in cookie");
response.Headers.CacheControl!.NoStore.Should().BeTrue();
}

[Fact]
Expand All @@ -272,6 +282,7 @@ public async Task Get_Token_ReturnsView_WithErrorJson_IfCookieDoesNotContainKnow
var responseBody = await ParseHtmlTokenReponse(response);
responseBody["error"].Value<string>().Should().Be("invalidCredentials");
responseBody["description"].Value<string>().Should().Be("Credentials provided unknown or expired");
response.Headers.CacheControl!.NoStore.Should().BeTrue();
}

[Fact]
Expand All @@ -293,6 +304,7 @@ public async Task Get_Token_ReturnsView_WithErrorJson_IfCookieContainsId_ForDiff
var responseBody = await ParseHtmlTokenReponse(response);
responseBody["error"].Value<string>().Should().Be("invalidCredentials");
responseBody["description"].Value<string>().Should().Be("Credentials provided unknown or expired");
response.Headers.CacheControl!.NoStore.Should().BeTrue();
}

[Fact]
Expand All @@ -314,6 +326,7 @@ public async Task Get_Token_ReturnsView_WithErrorJson_IfCookieContainsExpiredId(
var responseBody = await ParseHtmlTokenReponse(response);
responseBody["error"].Value<string>().Should().Be("invalidCredentials");
responseBody["description"].Value<string>().Should().Be("Credentials provided unknown or expired");
response.Headers.CacheControl!.NoStore.Should().BeTrue();
}

[Fact]
Expand All @@ -336,6 +349,7 @@ public async Task Get_Token_ReturnsView_WithAccessToken_IfSuccess()
responseBody["accessToken"].Value<string>().Should().Be(token.Entity.BearerToken);
responseBody["expiresIn"].Value<int>().Should().Be(token.Entity.Ttl);
responseBody["messageId"].Value<string>().Should().Be("123");
response.Headers.CacheControl!.NoStore.Should().BeTrue();
}
#endregion

Expand Down Expand Up @@ -369,6 +383,7 @@ public async Task ProbeService_404_IfAssetNotFound()

// Assert
result.StatusCode.Should().Be(HttpStatusCode.NotFound);
result.Headers.CacheControl.Should().BeNull();
result.Content.Headers.ContentType.MediaType
.Should().Be("application/problem+json", "this isn't an AuthProbeResult2");
}
Expand Down
5 changes: 5 additions & 0 deletions src/protagonist/Orchestrator/Features/Auth/AuthController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ public AuthController(IMediator mediator, IOptions<CacheSettings> cacheSettings,
/// Handle clickthrough auth request - create a new auth cookie and return View for user to close
/// </summary>
[Route("{customer}/clickthrough")]
[ResponseCache(NoStore = true)]
[HttpGet]
public async Task<IActionResult> Clickthrough(int customer)
{
Expand All @@ -47,6 +48,7 @@ public async Task<IActionResult> Clickthrough(int customer)
/// See https://iiif.io/api/auth/1.0/#access-token-service
/// </summary>
[Route("{customer}/token")]
[ResponseCache(NoStore = true)]
[HttpGet]
public async Task<IActionResult> Token(int customer, string? messageId, string? origin)
{
Expand Down Expand Up @@ -87,6 +89,7 @@ public async Task<IActionResult> Token(int customer, string? messageId, string?
/// <param name="authService">Name of authService to initiate.</param>
/// <returns>Redirect to downstream role-provider login service</returns>
[Route("{customer}/{authService}")]
[ResponseCache(NoStore = true)]
[HttpGet]
public async Task<IActionResult> InitiateAuthService(int customer, string authService)
{
Expand All @@ -104,6 +107,7 @@ public async Task<IActionResult> InitiateAuthService(int customer, string authSe
/// <param name="authService">Name of authService.</param>
/// <param name="token">Role-provider token</param>
[Route("{customer}/{authService}")]
[ResponseCache(NoStore = true)]
[HttpGet]
public async Task<IActionResult> RoleProviderToken(int customer, string authService,
[RequiredFromQuery] string token)
Expand All @@ -125,6 +129,7 @@ public async Task<IActionResult> RoleProviderToken(int customer, string authServ
/// <param name="authService">Name of authService.</param>
/// <returns></returns>
[Route("{customer}/{authService}/logout")]
[ResponseCache(NoStore = true)]
[HttpGet]
public async Task<IActionResult> Logout(int customer, string authService)
{
Expand Down
Loading