FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Remove client IP query paramter · devhttps/frontend@1c8aa42 · GitHub

/ frontend Public
forked from guardian/frontend

Commit 1c8aa42

Browse files
Mario Galic
committed
Remove client IP query paramter
1 parent 4a9daa3 commit 1c8aa42

4 files changed

Lines changed: 39 additions & 25 deletions

File tree

‎identity/app/controllers/ChangePasswordController.scala‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ class ChangePasswordController(
6464
val form = passwordForm.bindFromFlash.getOrElse(passwordForm)
6565

6666
val idRequest = idRequestParser(request)
67-
api.passwordExists(request.user.auth) map {
67+
api.passwordExists(request.user.auth, idRequest.trackingData) map {
6868
result =>
6969
val pwdExists = result.right.toOption contains true
7070
NoCache(Ok(

‎identity/app/controllers/ResetPasswordController.scala‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -95,13 +95,12 @@ class ResetPasswordController(
9595

9696
def onSuccess(form: (String, String, String, Option[String])): Future[Result] = form match {
9797
case (password, password_confirm, email_address, returnUrl) =>
98-
99-
val authResponse = api.resetPassword(token,password)
98+
val idRequest = idRequestParser(request)
99+
val authResponse = api.resetPassword(token, password, idRequest.trackingData)
100100
signInService.getCookies(authResponse, true) map {
101101
case Left(errors) =>
102102
logger.info(s"reset password errors, ${errors.toString()}")
103103
if (errors.exists("Token expired" == _.message)) {
104-
val idRequest = idRequestParser(request)
105104
NoCache(SeeOther(idUrlBuilder.buildUrl("/reset/resend", idRequest)))
106105
} else {
107106
val formWithError = errors.foldLeft(requestPasswordResetForm) { (form, error) =>

‎identity/app/idapiclient/IdApiClient.scala‎

Lines changed: 31 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ class IdApiClient(
3535
// AUTH
3636
def authBrowser(userAuth: Auth, trackingData: TrackingData, persistent: Option[Boolean] = None): Future[Response[CookiesResponse]] = {
3737
val params = buildParams(None, Some(trackingData), Seq("format" -> "cookies") ++ persistent.map("persistent" -> _.toString))
38-
val headers = buildHeaders(Some(userAuth))
38+
val headers = buildHeaders(Some(userAuth), extra = xForwardedForHeader(trackingData))
3939
val body = write(userAuth)
4040
val response = httpClient.POST(apiUrl("auth"), Some(body), params, headers)
4141
response map extract(jsonField("cookies"))
@@ -95,16 +95,17 @@ class IdApiClient(
9595
def register(user: User, trackingParameters: TrackingData, returnUrl: Option[String] = None): Future[Response[User]] = {
9696
val userData = write(user)
9797
val params = buildParams(tracking = Some(trackingParameters), extra = returnUrl.map(url => Iterable("returnUrl" -> url)))
98-
val headers = buildHeaders(extra = trackingParameters.ipAddress.map(ip => Iterable("X-Forwarded-For" -> ip)))
98+
val headers = buildHeaders(extra = xForwardedForHeader(trackingParameters))
9999
val response = httpClient.POST(apiUrl("user"), Some(userData), params, headers)
100100
response map extractUser
101101
}
102102

103103
// PASSWORD RESET/UPDATE
104104

105-
def passwordExists( auth: Auth ): Future[Response[Boolean]] = {
105+
def passwordExists(auth: Auth, trackingData: TrackingData): Future[Response[Boolean]] = {
106106
val apiPath = urlJoin("user", "password-exists")
107-
val response = httpClient.GET(apiUrl(apiPath), None, buildParams(Some(auth)), buildHeaders(Some(auth)))
107+
val headers = buildHeaders(Some(auth), extra = xForwardedForHeader(trackingData))
108+
val response = httpClient.GET(apiUrl(apiPath), None, buildParams(Some(auth)), headers)
108109
response map extract[Boolean](jsonField("passwordExists"))
109110
}
110111

@@ -122,17 +123,18 @@ class IdApiClient(
122123
response map extractUser
123124
}
124125

125-
def resetPassword( token : String, newPassword : String ): Future[Response[CookiesResponse]] = {
126+
def resetPassword( token : String, newPassword: String, trackingData: TrackingData): Future[Response[CookiesResponse]] = {
126127
val apiPath = urlJoin("pwd-reset", "reset-pwd-for-user")
127128
val postBody = write(TokenPassword(token, newPassword))
128-
val response = httpClient.POST(apiUrl(apiPath), Some(postBody), clientAuth.parameters, clientAuth.headers)
129+
val headers = clientAuth.headers ++ buildHeaders(extra = xForwardedForHeader(trackingData))
130+
val response = httpClient.POST(apiUrl(apiPath), Some(postBody), clientAuth.parameters, headers)
129131
response map extract(jsonField("cookies"))
130132
}
131133

132134
def sendPasswordResetEmail(emailAddress : String, trackingParameters: TrackingData): Future[Response[Unit]] = {
133135
val apiPath = urlJoin("pwd-reset", "send-password-reset-email")
134136
val params = buildParams(tracking = Some(trackingParameters), extra = Iterable("email-address" -> emailAddress, "type" -> "reset"))
135-
val response = httpClient.GET(apiUrl(apiPath), None, params, buildHeaders())
137+
val response = httpClient.GET(apiUrl(apiPath), None, params, buildHeaders(extra = xForwardedForHeader(trackingParameters)))
136138
response map extractUnit
137139
}
138140

@@ -141,7 +143,7 @@ class IdApiClient(
141143
def userEmails(userId: String, trackingParameters: TrackingData): Future[Response[Subscriber]] = {
142144
val apiPath = urlJoin("useremails", userId)
143145
val params = buildParams(tracking = Some(trackingParameters))
144-
val response = httpClient.GET(apiUrl(apiPath), None, params, buildHeaders())
146+
val response = httpClient.GET(apiUrl(apiPath), None, params, buildHeaders(extra = xForwardedForHeader(trackingParameters)))
145147
response map extract(jsonField("result"))
146148
}
147149

@@ -168,7 +170,13 @@ class IdApiClient(
168170

169171
def resendEmailValidationEmail(auth: Auth, trackingParameters: TrackingData, returnUrlOpt: Option[String]): Future[Response[Unit]] = {
170172
val extraParams = returnUrlOpt.map(url => List("returnUrl" -> url))
171-
httpClient.POST(apiUrl("user/send-validation-email"), None, buildParams(Some(auth), Some(trackingParameters), extraParams), buildHeaders(Some(auth))) map extractUnit
173+
httpClient
174+
.POST(
175+
apiUrl("user/send-validation-email"),
176+
None,
177+
buildParams(Some(auth), Some(trackingParameters), extraParams),
178+
buildHeaders(Some(auth), xForwardedForHeader(trackingParameters)))
179+
.map(extractUnit)
172180
}
173181

174182
def deleteTelephone(auth: Auth): Future[Response[Unit]] =
@@ -197,8 +205,13 @@ class IdApiClient(
197205
def post(apiPath: String,
198206
auth: Option[Auth] = None,
199207
trackingParameters: Option[TrackingData] = None,
200-
body: Option[String] = None): Future[Response[HttpResponse]] =
201-
httpClient.POST(apiUrl(apiPath), body, buildParams(auth, trackingParameters), buildHeaders(auth))
208+
body: Option[String] = None): Future[Response[HttpResponse]] = {
209+
httpClient.POST(
210+
apiUrl(apiPath),
211+
body,
212+
buildParams(auth, trackingParameters),
213+
buildHeaders(auth, trackingParameters.map(xForwardedForHeader)))
214+
}
202215

203216
def delete(apiPath: String,
204217
auth: Option[Auth] = None,
@@ -213,11 +226,7 @@ class IdApiClient(
213226
private def buildParams(auth: Option[Auth] = None,
214227
tracking: Option[TrackingData] = None,
215228
extra: Parameters = Iterable.empty): Parameters = {
216-
extra ++ clientAuth.parameters ++
217-
auth.map(_.parameters) ++
218-
tracking.map({ trackingData =>
219-
trackingData.parameters ++ trackingData.ipAddress.map(ip => "ip" -> ip)
220-
})
229+
extra ++ clientAuth.parameters ++ auth.map(_.parameters)
221230
}
222231

223232
private def buildHeaders(auth: Option[Auth] = None, extra: Parameters = Iterable.empty): Parameters = {
@@ -231,6 +240,12 @@ class IdApiClient(
231240
slug.stripPrefix("/").stripSuffix("/")
232241
}) mkString "/"
233242
}
243+
244+
private def xForwardedForHeader(trackingParameters: TrackingData): Parameters =
245+
trackingParameters
246+
.ipAddress
247+
.map(ip => Iterable("X-Forwarded-For" -> ip))
248+
.getOrElse(Iterable.empty)
234249
}
235250

236251

‎identity/test/controllers/ResetPasswordControllerTest.scala‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -97,12 +97,12 @@ class ResetPasswordControllerTest
9797

9898
val fakeRequest = FakeRequest(POST, "/reset_password" ).withFormUrlEncodedBody("password" -> "newpassword", "password-confirm" -> "newpassword", "email-address" -> "test@somewhere.com")
9999
"when the token provided is valid" - {
100-
when(api.resetPassword(MockitoMatchers.any[String], MockitoMatchers.any[String])).thenReturn(Future.successful(Right(cookieResponse)))
100+
when(api.resetPassword(MockitoMatchers.any[String], MockitoMatchers.any[String], MockitoMatchers.any[TrackingData])).thenReturn(Future.successful(Right(cookieResponse)))
101101
when(signInService.getCookies(MockitoMatchers.any[Future[Response[CookiesResponse]]], MockitoMatchers.anyBoolean())(MockitoMatchers.any[ExecutionContext])).thenReturn(Future.successful(Right(cookieList)))
102102

103103
"should call the api the password with the provided new password and token" in Fake {
104104
resetPasswordController.resetPassword("1234", None)(fakeRequest)
105-
verify(api).resetPassword(MockitoMatchers.eq("1234"), MockitoMatchers.eq("newpassword"))
105+
verify(api).resetPassword(MockitoMatchers.eq("1234"), MockitoMatchers.eq("newpassword"), MockitoMatchers.eq(identityRequest.trackingData))
106106
}
107107
"should return password confirmation view in" in Fake {
108108
val result = resetPasswordController.resetPassword("1234", None)(fakeRequest)
@@ -112,10 +112,10 @@ class ResetPasswordControllerTest
112112
}
113113

114114
"when the reset token has expired" - {
115-
when(api.resetPassword(MockitoMatchers.any[String], MockitoMatchers.any[String])).thenReturn(Future.successful(Right(cookieResponse)))
115+
when(api.resetPassword(MockitoMatchers.any[String], MockitoMatchers.any[String], MockitoMatchers.any[TrackingData])).thenReturn(Future.successful(Right(cookieResponse)))
116116
when(signInService.getCookies(MockitoMatchers.any[Future[Response[CookiesResponse]]], MockitoMatchers.anyBoolean())(MockitoMatchers.any[ExecutionContext])).thenReturn(Future.successful(Left(tokenExpired)))
117117

118-
when(api.resetPassword("1234","newpassword")).thenReturn(Future.successful(Left(tokenExpired)))
118+
when(api.resetPassword("1234","newpassword", identityRequest.trackingData)).thenReturn(Future.successful(Left(tokenExpired)))
119119
"should redirect to request request new password with a token expired" in Fake {
120120
val result = resetPasswordController.resetPassword("1234", None)(fakeRequest)
121121
status(result) should equal(SEE_OTHER)
@@ -126,7 +126,7 @@ class ResetPasswordControllerTest
126126
"when the reset token is not valid" - {
127127
when(signInService.getCookies(MockitoMatchers.any[Future[Response[CookiesResponse]]], MockitoMatchers.anyBoolean())(MockitoMatchers.any[ExecutionContext])).thenReturn(Future.successful(Left(accesssDenied)))
128128

129-
when(api.resetPassword("1234", "newpassword")).thenReturn(Future.successful(Left(accesssDenied)))
129+
when(api.resetPassword("1234", "newpassword", identityRequest.trackingData)).thenReturn(Future.successful(Left(accesssDenied)))
130130
"should redirect to request new password with a problem resetting your password" in Fake {
131131
val result = resetPasswordController.resetPassword("1234", None)(fakeRequest)
132132
status(result) should equal(SEE_OTHER)

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL