entrouvert
/
django-mellon
16
0
Fork 0
Code Issues Pull Requests 1 Releases Activity

middleware: check ajax request with sec-fetch-mode header header (#81211) #8

Merged
bdauvergne merged 1 commits from wip/81211-Middleware-mauvaise-detection-d into main 2023-09-18 10:41:00 +02:00
Conversation 1 Commits 1 Files Changed 2 +21
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
mellon/middleware.py
View File

@ -46,6 +46,9 @@ class PassiveAuthenticationMiddleware(MiddlewareMixin):
# Skip AJAX requests
if request.headers.get('x-requested-with') == 'XMLHttpRequest':
return
sec_fetch_mode = request.headers.get('sec-fetch-mode')
if sec_fetch_mode and sec_fetch_mode != 'navigate':
return
# Skip AJAX and media/script requests, unless mellon_no_passive is False on the view
if getattr(view_func, 'mellon_no_passive', True) and 'text/html' not in request.headers.get(
'Accept', ''

18
tests/test_sso_slo.py
View File

@ -766,6 +766,24 @@ def test_passive_auth_middleware_no_passive_auth_parameter(db, app, idp, caplog,
app.get('/?no-passive-auth', headers={'Accept': 'text/html'}, status=200)
def test_passive_auth_middleware_ajax_x_requested_with(db, app, idp, caplog, settings):
settings.MELLON_OPENED_SESSION_COOKIE_NAME = 'IDP_SESSION'
assert 'MELLON_PASSIVE_TRIED' not in app.cookies
# webtest-lint is against unicode
app.set_cookie('IDP_SESSION', '1234')
response = app.get('/', headers={'Accept': 'text/html', 'X-Requested-With': 'XMLHttpRequest'}, status=200)
assert 'MELLON_PASSIVE_TRIED' not in app.cookies
def test_passive_auth_middleware_ajax_sec_fetch_mode(db, app, idp, caplog, settings):
settings.MELLON_OPENED_SESSION_COOKIE_NAME = 'IDP_SESSION'
assert 'MELLON_PASSIVE_TRIED' not in app.cookies
# webtest-lint is against unicode
app.set_cookie('IDP_SESSION', '1234')
response = app.get('/', headers={'Accept': 'text/html', 'Sec-Fetch-Mode': 'cors'}, status=200)
assert 'MELLON_PASSIVE_TRIED' not in app.cookies
def test_sso_user_change(db, app, idp, caplog, sp_settings):
response = app.get(reverse('mellon_login') + '?next=/whatever/')
url, body, relay_state = idp.process_authn_request_redirect(response['Location'])