Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(sessions): add a verification cookie [PPT-870] [PPT-872] #111

Merged
merged 10 commits into from
Sep 7, 2023
Merged

feat(sessions): add a verification cookie [PPT-870] [PPT-872] #111

merged 10 commits into from
Sep 7, 2023

Conversation

stakach
Copy link
Member

@stakach stakach commented Sep 1, 2023

used to indicate if the user has authenticated and can access static assets

@stakach
feat(sessions): add a verification cookie
5445eaa 
used to indicate if the user has authenticated and can access static assets
@stakach stakach requested a review from w-le September 1, 2023 08:37
@stakach stakach self-assigned this Sep 1, 2023
@github-actions github-actions bot added the type: enhancement new feature or request label Sep 1, 2023
@w-le w-le requested a review from naqvis September 1, 2023 08:39
@stakach stakach marked this pull request as ready for review September 6, 2023 04:20
@stakach stakach changed the title feat(sessions): add a verification cookie feat(sessions): add a verification cookie [PPT-870] [PPT-872] Sep 7, 2023
@github-actions github-actions bot added type: enhancement new feature or request and removed type: enhancement new feature or request labels Sep 7, 2023
w-le
w-le approved these changes Sep 7, 2023
View reviewed changes
Copy link
Contributor

@w-le w-le left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested OK on fresh placeos/local deployment, including:

  • denial of static assets when not logged in
  • serving of static assets when logged in (due to cookie)
  • no more xss vulnerability at /auth/failure?message=<html/text>

@stakach
configure_asset_access if bearer present for auth/authority
ca6029c 
logged in users won't need to refresh the page
@stakach stakach merged commit ba33fb7 into master Sep 7, 2023
2 of 4 checks passed
@stakach stakach deleted the pre-auth-asset-security branch September 7, 2023 03:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@w-le w-le w-le approved these changes

@naqvis naqvis Awaiting requested review from naqvis

Assignees

@stakach stakach

Labels
type: enhancement new feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@stakach @w-le