Skip to content
This repository was archived by the owner on Sep 26, 2024. It is now read-only.

Check for open redirection attacks #2

Merged
slewis74 merged 3 commits into from
Nov 14, 2016
Merged

Check for open redirection attacks #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5b39081
package update to support cases where the Octopus Deploy server is be…
slewis74 Nov 11, 2016
a5e2c60
package updates to handle AbsoluteVirtualDirectoryPath better, and al…
slewis74 Nov 11, 2016
8366b3c
updates so the truested redirect Urls can be set through configure
slewis74 Nov 14, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions ...ibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,12 +75,12 @@
<HintPath>..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="Octopus.Server.Extensibility, Version=1.0.39.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.1.0.39\lib\net45\Octopus.Server.Extensibility.dll</HintPath>
<Reference Include="Octopus.Server.Extensibility, Version=1.1.45.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.1.1.45\lib\net45\Octopus.Server.Extensibility.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="Octopus.Server.Extensibility.Authentication, Version=1.0.11.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.Authentication.1.0.11\lib\net45\Octopus.Server.Extensibility.Authentication.dll</HintPath>
<Reference Include="Octopus.Server.Extensibility.Authentication, Version=1.1.13.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.Authentication.1.1.13\lib\net45\Octopus.Server.Extensibility.Authentication.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="Octopus.Time, Version=1.0.8.0, Culture=neutral, processorArchitecture=MSIL">
Expand Down
4 changes: 3 additions & 1 deletion ...ctopus.Server.Extensibility.Authentication.AzureAD/Web/AzureADUserAuthenticationAction.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Issuer;
using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Web;
using Octopus.Server.Extensibility.Extensions.Infrastructure.Web.Api;
using Octopus.Server.Extensibility.HostServices.Web;

namespace Octopus.Server.Extensibility.Authentication.AzureAD.Web
{
Expand All @@ -14,7 +15,8 @@ public AzureADUserAuthenticationAction(
IAzureADConfigurationStore configurationStore,
IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer,
IAzureADAuthorizationEndpointUrlBuilder urlBuilder,
IApiActionResponseCreator responseCreator) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator)
IApiActionResponseCreator responseCreator,
IWebPortalConfigurationStore webPortalConfigurationStore) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator, webPortalConfigurationStore)
{
}
}
Expand Down
4 changes: 2 additions & 2 deletions source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@
<package id="Octopus.Configuration" version="1.0.10" targetFramework="net451" />
<package id="Octopus.Data" version="1.0.18" targetFramework="net451" />
<package id="Octopus.Diagnostics" version="1.0.11" targetFramework="net451" />
<package id="Octopus.Server.Extensibility" version="1.0.39" targetFramework="net451" />
<package id="Octopus.Server.Extensibility.Authentication" version="1.0.11" targetFramework="net451" />
<package id="Octopus.Server.Extensibility" version="1.1.45" targetFramework="net451" />
<package id="Octopus.Server.Extensibility.Authentication" version="1.1.13" targetFramework="net451" />
<package id="Octopus.Time" version="1.0.8" targetFramework="net451" />
<package id="System.Collections" version="4.0.11" targetFramework="net452" />
<package id="System.IdentityModel.Tokens.Jwt" version="5.0.0" targetFramework="net452" />
Expand Down
8 changes: 4 additions & 4 deletions ...y.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,12 +75,12 @@
<HintPath>..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="Octopus.Server.Extensibility, Version=1.0.39.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.1.0.39\lib\net45\Octopus.Server.Extensibility.dll</HintPath>
<Reference Include="Octopus.Server.Extensibility, Version=1.1.45.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.1.1.45\lib\net45\Octopus.Server.Extensibility.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="Octopus.Server.Extensibility.Authentication, Version=1.0.11.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.Authentication.1.0.11\lib\net45\Octopus.Server.Extensibility.Authentication.dll</HintPath>
<Reference Include="Octopus.Server.Extensibility.Authentication, Version=1.1.13.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.Authentication.1.1.13\lib\net45\Octopus.Server.Extensibility.Authentication.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="Octopus.Time, Version=1.0.8.0, Culture=neutral, processorArchitecture=MSIL">
Expand Down
4 changes: 3 additions & 1 deletion ....Server.Extensibility.Authentication.GoogleApps/Web/GoogleAppsUserAuthenticationAction.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Issuer;
using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Web;
using Octopus.Server.Extensibility.Extensions.Infrastructure.Web.Api;
using Octopus.Server.Extensibility.HostServices.Web;

namespace Octopus.Server.Extensibility.Authentication.GoogleApps.Web
{
Expand All @@ -14,7 +15,8 @@ public GoogleAppsUserAuthenticationAction(
IGoogleAppsConfigurationStore configurationStore,
IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer,
IGoogleAppsAuthorizationEndpointUrlBuilder urlBuilder,
IApiActionResponseCreator responseCreator) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator)
IApiActionResponseCreator responseCreator,
IWebPortalConfigurationStore webPortalConfigurationStore) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator, webPortalConfigurationStore)
{
}
}
Expand Down
4 changes: 2 additions & 2 deletions source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@
<package id="Octopus.Configuration" version="1.0.10" targetFramework="net451" />
<package id="Octopus.Data" version="1.0.18" targetFramework="net451" />
<package id="Octopus.Diagnostics" version="1.0.11" targetFramework="net451" />
<package id="Octopus.Server.Extensibility" version="1.0.39" targetFramework="net451" />
<package id="Octopus.Server.Extensibility.Authentication" version="1.0.11" targetFramework="net451" />
<package id="Octopus.Server.Extensibility" version="1.1.45" targetFramework="net451" />
<package id="Octopus.Server.Extensibility.Authentication" version="1.1.13" targetFramework="net451" />
<package id="Octopus.Time" version="1.0.8" targetFramework="net451" />
<package id="System.Collections" version="4.0.11" targetFramework="net452" />
<package id="System.IdentityModel.Tokens.Jwt" version="5.0.0" targetFramework="net452" />
Expand Down
8 changes: 4 additions & 4 deletions ...entication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,12 +77,12 @@
<HintPath>..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="Octopus.Server.Extensibility, Version=1.0.39.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.1.0.39\lib\net45\Octopus.Server.Extensibility.dll</HintPath>
<Reference Include="Octopus.Server.Extensibility, Version=1.1.45.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.1.1.45\lib\net45\Octopus.Server.Extensibility.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="Octopus.Server.Extensibility.Authentication, Version=1.0.11.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.Authentication.1.0.11\lib\net45\Octopus.Server.Extensibility.Authentication.dll</HintPath>
<Reference Include="Octopus.Server.Extensibility.Authentication, Version=1.1.13.0, Culture=neutral, processorArchitecture=MSIL">
<HintPath>..\packages\Octopus.Server.Extensibility.Authentication.1.1.13\lib\net45\Octopus.Server.Extensibility.Authentication.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="Octopus.Time, Version=1.0.8.0, Culture=neutral, processorArchitecture=MSIL">
Expand Down
2 changes: 1 addition & 1 deletion ....Server.Extensibility.Authentication.OpenIDConnect/OpenIDConnectAuthenticationProvider.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ private bool IsProviderConfigComplete()

public bool SupportsPasswordManagement => false;

public string AuthenticateUri => $"/api/users/authenticate/{ConfigurationStore.ConfigurationSettingsName}";
public string AuthenticateUri => $"/users/authenticate/{ConfigurationStore.ConfigurationSettingsName}";

protected abstract string LoginLinkHtml(string requestDirectoryPath);

Expand Down
24 changes: 22 additions & 2 deletions ...Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Issuer;
using Octopus.Server.Extensibility.Extensions.Infrastructure.Web.Api;
using Octopus.Diagnostics;
using Octopus.Server.Extensibility.Authentication.HostServices;
using Octopus.Server.Extensibility.HostServices.Web;

namespace Octopus.Server.Extensibility.Authentication.OpenIDConnect.Web
Expand All @@ -20,16 +21,19 @@ public abstract class UserAuthenticationAction<TStore> : IAsyncApiAction

protected readonly TStore ConfigurationStore;
protected readonly IApiActionResponseCreator ResponseCreator;
readonly IWebPortalConfigurationStore webPortalConfigurationStore;

protected UserAuthenticationAction(
ILog log,
TStore configurationStore,
IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer,
IAuthorizationEndpointUrlBuilder urlBuilder,
IApiActionResponseCreator responseCreator)
IApiActionResponseCreator responseCreator,
IWebPortalConfigurationStore webPortalConfigurationStore)
{
this.log = log;
ResponseCreator = responseCreator;
this.webPortalConfigurationStore = webPortalConfigurationStore;
ConfigurationStore = configurationStore;
this.identityProviderConfigDiscoverer = identityProviderConfigDiscoverer;
this.urlBuilder = urlBuilder;
Expand All @@ -46,17 +50,33 @@ public async Task<Response> ExecuteAsync(NancyContext context, IResponseFormatte
if (context.Request.Url.SiteBase.StartsWith("https://", StringComparison.OrdinalIgnoreCase) == false)
log.Warn($"{ConfigurationStore.ConfigurationSettingsName} user authentication API was called without using https.");

var directoryPathResult = context.Request.AbsoluteVirtualDirectoryPath();
if (!directoryPathResult.IsValid)
{
return ResponseCreator.BadRequest(directoryPathResult.InvalidReason);
}

var postLoginRedirectTo = context.Request.Query["redirectTo"];
var state = "~/app";
if (string.IsNullOrWhiteSpace(postLoginRedirectTo) == false)
state = postLoginRedirectTo;

var whitelist = webPortalConfigurationStore.GetTrustedRedirectUrls();

if (!Requests.IsLocalUrl(directoryPathResult.Path, state, whitelist))
{
log.WarnFormat("Prevented potential Open Redirection attack on an authentication request from the local instance {0} to the non-local url {1}", directoryPathResult.Path, state);
return ResponseCreator.BadRequest("Request not allowed, due to potential Open Redirection attack");
}

var nonce = Nonce.GenerateUrlSafeNonce();

try
{
var issuer = ConfigurationStore.GetIssuer();
var issuerConfig = await identityProviderConfigDiscoverer.GetConfigurationAsync(issuer);
var url = urlBuilder.Build(context.Request.DirectoryPath(), issuerConfig, nonce, state);

var url = urlBuilder.Build(directoryPathResult.Path, issuerConfig, nonce, state);

return response.AsRedirect(url)
.WithCookie(new NancyCookie("s", State.Protect(state), true, false, DateTime.UtcNow.AddMinutes(20)))
Expand Down
4 changes: 2 additions & 2 deletions source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@
<package id="Octopus.Configuration" version="1.0.10" targetFramework="net451" />
<package id="Octopus.Data" version="1.0.18" targetFramework="net451" />
<package id="Octopus.Diagnostics" version="1.0.11" targetFramework="net451" />
<package id="Octopus.Server.Extensibility" version="1.0.39" targetFramework="net451" />
<package id="Octopus.Server.Extensibility.Authentication" version="1.0.11" targetFramework="net451" />
<package id="Octopus.Server.Extensibility" version="1.1.45" targetFramework="net451" />
<package id="Octopus.Server.Extensibility.Authentication" version="1.1.13" targetFramework="net451" />
<package id="Octopus.Time" version="1.0.8" targetFramework="net451" />
<package id="System.Collections" version="4.0.11" targetFramework="net451" />
<package id="System.IdentityModel.Tokens.Jwt" version="5.0.0" targetFramework="net451" />
Expand Down