From dea3904b1734a78210594fdb3fac271a0e0fce4a Mon Sep 17 00:00:00 2001 From: Tim Babych Date: Tue, 2 Dec 2014 15:45:31 +0200 Subject: [PATCH] Check issuer --- notesapi/v1/permissions.py | 10 +++++++++- notesapi/v1/tests/helpers.py | 1 + 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/notesapi/v1/permissions.py b/notesapi/v1/permissions.py index 42fd15d3..7bd1a969 100644 --- a/notesapi/v1/permissions.py +++ b/notesapi/v1/permissions.py @@ -5,6 +5,9 @@ logger = logging.getLogger(__name__) +class TokenWrongIssuer(Exception): + pass + class HasAccessToken(BasePermission): """ Allow requests having valid ID Token. @@ -19,6 +22,8 @@ def has_permission(self, request, view): try: data = jwt.decode(token, settings.CLIENT_SECRET) auth_user = data['sub'] + if data['aud'] != settings.CLIENT_ID: + raise TokenWrongIssuer for request_field in ('GET', 'POST', 'DATA'): if 'user' in getattr(request, request_field): req_user = getattr(request, request_field)['user'] @@ -30,9 +35,12 @@ def has_permission(self, request, view): )) return False logger.info("No user was present to compare in GET, POST or DATA") - # but user still has valid token, so let them pass + # but user still has valid token, and request is not user-specific so let them pass? + # have to make sure they will not be able to grab ALL data with that... return True except jwt.ExpiredSignature: logger.exception("Token was expired: {}".format(token)) except jwt.DecodeError: logger.exception("Could not decode token {}".format(token)) + except TokenWrongIssuer: + logger.exception("Token has wrong issuer {}".format(token)) diff --git a/notesapi/v1/tests/helpers.py b/notesapi/v1/tests/helpers.py index 234e49c1..3f5be322 100644 --- a/notesapi/v1/tests/helpers.py +++ b/notesapi/v1/tests/helpers.py @@ -29,6 +29,7 @@ def mock_authorizer(*args, **kwargs): def get_id_token(user): now = datetime.utcnow() return jwt.encode({ + 'aud': settings.CLIENT_ID, 'sub': user, 'iat': timegm(now.utctimetuple()), 'exp': timegm((now + timedelta(seconds=30)).utctimetuple()),