IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-25 02:11:08 -06:00
Code Issues Packages Projects Releases Wiki Activity

DEV: Update DiscourseConnect nonce errors to be more descriptive (#14858)

Browse Source
This commit is contained in:
David Taylor 2021-11-09 17:39:05 +00:00 committed by GitHub
parent 769d53ff09
commit 5ac10e2e79
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/models/discourse_single_sign_on.rb
View File

@ -50,8 +50,10 @@ class DiscourseSingleSignOn < SingleSignOn
def nonce_error def nonce_error
if Discourse.cache.read(used_nonce_key).present? if Discourse.cache.read(used_nonce_key).present?
"Nonce has already been used" "Nonce has already been used"
elsif SiteSetting.discourse_connect_csrf_protection
"Nonce is incorrect, was generated in a different browser session, or has expired"
else else
"Nonce has expired" "Nonce is incorrect, or has expired"
end end
end end

13
spec/models/discourse_single_sign_on_spec.rb
View File

@ -544,7 +544,18 @@ describe DiscourseSingleSignOn do
expect(sso.nonce_valid?).to eq true expect(sso.nonce_valid?).to eq true
Discourse.cache.delete(sso.used_nonce_key) Discourse.cache.delete(sso.used_nonce_key)
expect(sso.nonce_error).to eq("Nonce has expired") expect(sso.nonce_error).to eq("Nonce is incorrect, was generated in a different browser session, or has expired")
end
it "generates correct error message when nonce is expired, and csrf protection disabled" do
SiteSetting.discourse_connect_csrf_protection = false
_ , payload = DiscourseSingleSignOn.generate_url(secure_session: secure_session).split("?")
sso = DiscourseSingleSignOn.parse(payload, secure_session: secure_session)
expect(sso.nonce_valid?).to eq true
Discourse.cache.delete(sso.used_nonce_key)
expect(sso.nonce_error).to eq("Nonce is incorrect, or has expired")
end end
end end