From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 84AA21FF183 for ; Wed, 17 Dec 2025 15:25:44 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 2923A542A; Wed, 17 Dec 2025 15:26:32 +0100 (CET) From: Shannon Sterz To: yew-devel@lists.proxmox.com Date: Wed, 17 Dec 2025 15:26:13 +0100 Message-ID: <20251217142613.277559-3-s.sterz@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20251217142613.277559-2-s.sterz@proxmox.com> References: <20251217142613.277559-2-s.sterz@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1765981578622 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.088 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [yew-devel] [PATCH yew-comp 1/2] http wasm client: load csrf token from global Proxmox object X-BeenThere: yew-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Yew framework devel list at Proxmox List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Yew framework devel list at Proxmox Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: yew-devel-bounces@lists.proxmox.com Sender: "yew-devel" previously csrf tokens were only loaded from session storage. this could lead to two scenarios: - the csrf token expired while the newer authentication ticket was still valid. - when restoring a session, session cookies were restored, but session storage seemingly isn't always restored (tested in chromium and ff). this lead to no csrf token being loaded here, the `unwrap_or_default()` would then return the empty string as a csrf token. both scenarios would lead to a situation where a valid authentication cookie was present, but the csrf token was empty or expired. the result is that all GET requests would work properly, as we don't check csrf tokens there. however, the first non-GET request would lead to a logout. to fix this, we first load the token from the Proxmox object that is injected via a script in the index.html for all proxmox products. we prefer this token over the one in session storage. authentication_from_cookie (that calls the extract_auth_from_cookie function), is and should only be called when the page was just loaded. so the csrf token in the Proxmox object will always be fresher than the one in the session storage. additionally, split out the csrf token portion of extract_auth_from_cookie into its own function to more cleanily separate these concern. authentication_from_cookie, extract_auth_from_cookie's only user, has been adapted to trigger a new log in if no csrf token can be found as well. Signed-off-by: Shannon Sterz --- src/http_client_wasm.rs | 43 ++++++++++++++++++++++++++++------------- 1 file changed, 30 insertions(+), 13 deletions(-) diff --git a/src/http_client_wasm.rs b/src/http_client_wasm.rs index 25d0dd2..51933bb 100644 --- a/src/http_client_wasm.rs +++ b/src/http_client_wasm.rs @@ -3,6 +3,7 @@ use std::pin::Pin; use std::rc::Rc; use std::sync::Mutex; +use js_sys::Reflect; use percent_encoding::percent_decode_str; use serde::Serialize; use serde_json::Value; @@ -20,23 +21,25 @@ fn convert_js_error(js_err: ::wasm_bindgen::JsValue) -> Error { } pub fn authentication_from_cookie(project: &dyn ProjectInfo) -> Option { - if let Some((ticket, csrfprevention_token)) = extract_auth_from_cookie(project) { - let ticket: Result = ticket.parse(); - if let Ok(ticket) = ticket { - return Some(Authentication { - api_url: String::new(), - userid: ticket.userid().to_string(), - ticket, - clustername: None, - csrfprevention_token, - }); + if let Some(ticket) = extract_auth_from_cookie(project) { + if let Some(csrfprevention_token) = current_csrf_token() { + let ticket: Result = ticket.parse(); + if let Ok(ticket) = ticket { + return Some(Authentication { + api_url: String::new(), + userid: ticket.userid().to_string(), + ticket, + clustername: None, + csrfprevention_token, + }); + } } } None } -fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<(String, String)> { +fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option { let cookie = crate::get_cookie(); //log::info!("COOKIE: {}", cookie); @@ -55,8 +58,7 @@ fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<(String, String if key == name { let items: Vec<&str> = value.split(':').take(2).collect(); if prefixes.contains(&items[0]) { - let csrf_token = crate::load_csrf_token().unwrap_or_default(); - return Some((value.to_string(), csrf_token)); + return Some(value.to_string()); } } } @@ -65,6 +67,21 @@ fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<(String, String None } +fn current_csrf_token() -> Option { + let window = gloo_utils::window(); + + // prefer the fresh CSRFPreventionToken from the `Proxmox` global object set via a script in + // the document index on first load. + if let Ok(proxmox) = Reflect::get(&window, &"Proxmox".into()) { + if let Ok(token) = Reflect::get(&proxmox, &"CSRFPreventionToken".into()) { + return token.as_string(); + } + } + + // fall back to the csrf token stored in the session storage if no fresher token has been set + crate::load_csrf_token() +} + pub struct HttpClientWasm { project: &'static dyn ProjectInfo, auth: Mutex>, -- 2.47.3 _______________________________________________ yew-devel mailing list yew-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/yew-devel