embarklabs
/
embark
mirror of https://github.com/embarklabs/embark.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix(cockpit/AppContainer): allow bootstrap with query params 

Cockpit allows for authentication via a `token` query parameter a la

```
http://localhost:8000/embark?token=xxxx-xxxx-xxxx-xxxx
```

So far, this was the only query parameter cockpit knew about, which is
why the algorithm during bootstrap always assumed that, if we have
query parameters, there has to be a `token` query parameter.

However, since 20831179fc, this turns out to be a problem. The hashing algorithm
for the request headers will throw, when `token` is not defined, which
can be possible with future features that add new query parameters.

This can be easily reproduced by bootstrapping/refreshing Cockpit using
any arbitrary query string parameter that is not `token`.

With this commit we ensure that we only perform query string authentication
when a `token` parameter is available.
This commit is contained in:
Pascal Precht 2018-10-18 14:25:19 +02:00
parent 8562a3f6c8
commit 98fc1ab51e
No known key found for this signature in database
GPG Key ID: 0EE28D8D6FD85D7D
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
embark-ui/src/containers/AppContainer.js
View File

@ -30,10 +30,11 @@ class AppContainer extends Component {
}
queryStringAuthenticate() {
if (!this.props.location.search) {
const token = qs.parse(this.props.location.search, {ignoreQueryPrefix: true}).token;
if (!token) {
return;
}
const token = qs.parse(this.props.location.search, {ignoreQueryPrefix: true}).token;
const host = process.env.NODE_ENV === 'development' ? DEFAULT_HOST : window.location.host;
if (token === this.props.credentials.token && this.props.credentials.host === host) {
return;