ZeusWPI/kers
9
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity

csrf

Browse source
This commit is contained in:
Francis 2020-07-22 05:28:46 +02:00
parent e066cf2c03
commit 2b0bd411a0
No known key found for this signature in database
GPG key ID: 071BEA4C2B10077C
1 changed files with 17 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
oauth/views.py
View file

@ -25,17 +25,23 @@ def register(_):
def register_callback(req: HttpRequest): def register_callback(req: HttpRequest):
code = req.GET['code'] code = req.GET['code']
csrftoken = req.COOKIES.get('csrftoken')
print(csrftoken)
response = requests.post(settings.OAUTH["AUTHORIZE_URI"], response = requests.post(settings.OAUTH["AUTHORIZE_URI"],
data={'code': code, data={'code': code,
'grant_type': 'authorization_code', 'grant_type': 'authorization_code',
'client_id': settings.OAUTH["CLIENT_ID"], 'client_id': settings.OAUTH["CLIENT_ID"],
'client_secret': settings.OAUTH["CLIENT_SECRET"], 'client_secret': settings.OAUTH["CLIENT_SECRET"],
'redirect_uri': settings.OAUTH["REDIRECT_URI"]}) 'redirect_uri': settings.OAUTH["REDIRECT_URI"]},
cookies=None,
headers={'Referer': f'{settings.SERVER_URL}/login/zeus/register'})
try: try:
if response.status_code == 200: if response.status_code == 200:
json: dict = response.json() json: dict = response.json()
csrftoken = response.cookies['csrftoken']
print(response.cookies)
# TODO: maybe later do something with the refresh token. # TODO: maybe later do something with the refresh token.
user: dict = user_info(json['access_token']) user: dict = user_info(json['access_token'], csrftoken)
if 'username' not in user.keys() or 'id' not in user.keys(): if 'username' not in user.keys() or 'id' not in user.keys():
raise OAuthException(f'username and id are expected values: {user}') raise OAuthException(f'username and id are expected values: {user}')
else: else:
@ -44,11 +50,12 @@ def register_callback(req: HttpRequest):
login(req, validated_user) login(req, validated_user)
redirect('/') redirect('/')
else: else:
raise OAuthException(f'Status code not 200, response: {response.json()}') print(response.request)
raise OAuthException(f'Status code not 200, response: {response}')
except OAuthException as e: except OAuthException as e:
logger.error(e) logger.error(e)
return register('') return redirect('/')
def validate_user(zeus_id, username) -> CustomUser: def validate_user(zeus_id, username) -> CustomUser:
@ -60,6 +67,10 @@ def validate_user(zeus_id, username) -> CustomUser:
return user return user
def user_info(access_token): def user_info(access_token, csrftoken):
r = requests.get(settings.OAUTH["USER_API_URI"], headers={'Authorization': f'Bearer {access_token}'}) r = requests.get(
settings.OAUTH["USER_API_URI"],
headers={'Authorization': f'Bearer {access_token}'},
cookies={'csrftoken': csrftoken}
)
return r.json() return r.json()