[yew-devel] [PATCH yew-comp 0/2] make http wasm client get fresh csrf tokens from index document

[yew-devel] [PATCH yew-comp 0/2] make http wasm client get fresh csrf tokens from index document

[Shannon Sterz]

this series makes the http wasm client respect the fresher csrf token
in the document index. fixing a bug that would kick out users after
the first non-GET request. for a more detailed explanation see patch
1.

changes since v1:

* split csrf token portion of extract_auth_from_cookie into a separate
  function and add better documentation (thanks @ Thomas Lamprecht)
* add a patch that refactors extract_auth_from_cookie to return a
  ticket and be more efficient and legible.

Shannon Sterz (2):
  http wasm client: load csrf token from global Proxmox object
  http wasm client: refactor extract_auth_from_cookie to return a Ticket

 src/http_client_wasm.rs | 54 ++++++++++++++++++++++++++---------------
 1 file changed, 35 insertions(+), 19 deletions(-)

--
2.47.3



_______________________________________________
yew-devel mailing list
yew-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/yew-devel

[yew-devel] [PATCH yew-comp 1/2] http wasm client: load csrf token from global Proxmox object

[Shannon Sterz]

previously csrf tokens were only loaded from session storage. this
could lead to two scenarios:

- the csrf token expired while the newer authentication ticket was
still valid.
- when restoring a session, session cookies were restored, but session
storage seemingly isn't always restored (tested in chromium and ff).
this lead to no csrf token being loaded here, the
`unwrap_or_default()` would then return the empty string as a csrf
token.

both scenarios would lead to a situation where a valid authentication
cookie was present, but the csrf token was empty or expired. the
result is that all GET requests would work properly, as we don't check
csrf tokens there. however, the first non-GET request would lead to a
logout.

to fix this, we first load the token from the Proxmox object that is
injected via a script in the index.html for all proxmox products. we
prefer this token over the one in session storage.
authentication_from_cookie (that calls the extract_auth_from_cookie
function), is and should only be called when the page was just loaded.
so the csrf token in the Proxmox object will always be fresher than
the one in the session storage.

additionally, split out the csrf token portion of
extract_auth_from_cookie into its own function to more cleanily
separate these concern. authentication_from_cookie,
extract_auth_from_cookie's only user, has been adapted to trigger a
new log in if no csrf token can be found as well.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/http_client_wasm.rs | 43 ++++++++++++++++++++++++++++-------------
 1 file changed, 30 insertions(+), 13 deletions(-)

diff --git a/src/http_client_wasm.rs b/src/http_client_wasm.rs
index 25d0dd2..51933bb 100644
--- a/src/http_client_wasm.rs
+++ b/src/http_client_wasm.rs
@@ -3,6 +3,7 @@ use std::pin::Pin;
 use std::rc::Rc;
 use std::sync::Mutex;
 
+use js_sys::Reflect;
 use percent_encoding::percent_decode_str;
 use serde::Serialize;
 use serde_json::Value;
@@ -20,23 +21,25 @@ fn convert_js_error(js_err: ::wasm_bindgen::JsValue) -> Error {
 }
 
 pub fn authentication_from_cookie(project: &dyn ProjectInfo) -> Option<Authentication> {
-    if let Some((ticket, csrfprevention_token)) = extract_auth_from_cookie(project) {
-        let ticket: Result<Ticket, _> = ticket.parse();
-        if let Ok(ticket) = ticket {
-            return Some(Authentication {
-                api_url: String::new(),
-                userid: ticket.userid().to_string(),
-                ticket,
-                clustername: None,
-                csrfprevention_token,
-            });
+    if let Some(ticket) = extract_auth_from_cookie(project) {
+        if let Some(csrfprevention_token) = current_csrf_token() {
+            let ticket: Result<Ticket, _> = ticket.parse();
+            if let Ok(ticket) = ticket {
+                return Some(Authentication {
+                    api_url: String::new(),
+                    userid: ticket.userid().to_string(),
+                    ticket,
+                    clustername: None,
+                    csrfprevention_token,
+                });
+            }
         }
     }
 
     None
 }
 
-fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<(String, String)> {
+fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<String> {
     let cookie = crate::get_cookie();
     //log::info!("COOKIE: {}", cookie);
 
@@ -55,8 +58,7 @@ fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<(String, String
             if key == name {
                 let items: Vec<&str> = value.split(':').take(2).collect();
                 if prefixes.contains(&items[0]) {
-                    let csrf_token = crate::load_csrf_token().unwrap_or_default();
-                    return Some((value.to_string(), csrf_token));
+                    return Some(value.to_string());
                 }
             }
         }
@@ -65,6 +67,21 @@ fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<(String, String
     None
 }
 
+fn current_csrf_token() -> Option<String> {
+    let window = gloo_utils::window();
+
+    // prefer the fresh CSRFPreventionToken from the `Proxmox` global object set via a script in
+    // the document index on first load.
+    if let Ok(proxmox) = Reflect::get(&window, &"Proxmox".into()) {
+        if let Ok(token) = Reflect::get(&proxmox, &"CSRFPreventionToken".into()) {
+            return token.as_string();
+        }
+    }
+
+    // fall back to the csrf token stored in the session storage if no fresher token has been set
+    crate::load_csrf_token()
+}
+
 pub struct HttpClientWasm {
     project: &'static dyn ProjectInfo,
     auth: Mutex<Option<Authentication>>,
-- 
2.47.3



_______________________________________________
yew-devel mailing list
yew-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/yew-devel

[yew-devel] [PATCH yew-comp 2/2] http wasm client: refactor extract_auth_from_cookie to return a Ticket

[Shannon Sterz]

instead of a `String`. this saves us the parsing step in the only
caller of this function `authentication_from_cookie`. also refactors
this function to be more efficient (by e.g., not percent decoding
every cookie until we find the ticket cookie) and legible.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/http_client_wasm.rs | 49 ++++++++++++++++++++---------------------
 1 file changed, 24 insertions(+), 25 deletions(-)

diff --git a/src/http_client_wasm.rs b/src/http_client_wasm.rs
index 51933bb..5bf67a0 100644
--- a/src/http_client_wasm.rs
+++ b/src/http_client_wasm.rs
@@ -23,42 +23,41 @@ fn convert_js_error(js_err: ::wasm_bindgen::JsValue) -> Error {
 pub fn authentication_from_cookie(project: &dyn ProjectInfo) -> Option<Authentication> {
     if let Some(ticket) = extract_auth_from_cookie(project) {
         if let Some(csrfprevention_token) = current_csrf_token() {
-            let ticket: Result<Ticket, _> = ticket.parse();
-            if let Ok(ticket) = ticket {
-                return Some(Authentication {
-                    api_url: String::new(),
-                    userid: ticket.userid().to_string(),
-                    ticket,
-                    clustername: None,
-                    csrfprevention_token,
-                });
-            }
+            return Some(Authentication {
+                api_url: String::new(),
+                userid: ticket.userid().to_string(),
+                ticket,
+                clustername: None,
+                csrfprevention_token,
+            });
         }
     }
 
     None
 }
 
-fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<String> {
+fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<Ticket> {
     let cookie = crate::get_cookie();
-    //log::info!("COOKIE: {}", cookie);
-
     let name = project.auth_cookie_name();
-    let prefixes = project.auth_cookie_prefixes();
+    let prefixes = project
+        .auth_cookie_prefixes()
+        .iter()
+        .map(|p| format!("{p}:"))
+        .collect::<Vec<String>>();
 
     for part in cookie.split(';') {
-        let part = part.trim();
-        if let Some((key, value)) = part.split_once('=') {
-            // cookie value can be percent encoded
-            let value = match percent_decode_str(value).decode_utf8() {
-                Ok(value) => value,
-                Err(_) => continue,
-            };
-
+        if let Some((key, value)) = part.trim().split_once('=') {
+            // check if current cookie is the ticket cookie
             if key == name {
-                let items: Vec<&str> = value.split(':').take(2).collect();
-                if prefixes.contains(&items[0]) {
-                    return Some(value.to_string());
+                // cookie value can be percent encoded
+                if let Ok(value) = percent_decode_str(value).decode_utf8() {
+                    // check that the ticket prefix matches the ones defined by the current project
+                    if prefixes.iter().any(|p| value.starts_with(p)) {
+                        // parse ticket and return; if this fails keep looking for a valid ticket
+                        if let Ok(ticket) = value.to_string().parse() {
+                            return Some(ticket);
+                        }
+                    }
                 }
             }
         }
-- 
2.47.3



_______________________________________________
yew-devel mailing list
yew-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/yew-devel