Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

GAP-2572: Login Bug Fix #206

Merged
merged 3 commits into from
Apr 22, 2024
Merged

GAP-2572: Login Bug Fix #206

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f55bd5f
Make secure cookie builder set domain.
IlyasBaqqari-CabinetOffice Apr 19, 2024
4cf0d96
Update test
IlyasBaqqari-CabinetOffice Apr 19, 2024
06af97a
Refactor method buildSecureCookie for consistency
IlyasBaqqari-CabinetOffice Apr 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions src/main/java/gov/cabinetoffice/gapuserservice/util/WebUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,15 @@ public static Cookie buildSecureCookie(final String name, final String value) {
return cookie;
}

public static Cookie buildSecureCookie(final String name, final String value, final String domain) {
final Cookie cookie = new Cookie(name, value);
cookie.setSecure(true);
cookie.setHttpOnly(true);
cookie.setDomain(domain);
cookie.setPath("/");
return cookie;
}

public static Cookie buildSecureCookie(final String name, final String value, final Integer maxAge) {
final Cookie cookie = buildSecureCookie(name, value);
cookie.setMaxAge(maxAge);
Expand Down
5 changes: 4 additions & 1 deletion src/main/java/gov/cabinetoffice/gapuserservice/web/LoginControllerV2.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,9 @@ public class LoginControllerV2 {
@Value("${jwt.cookie-name}")
public String userServiceCookieName;

@Value("${jwt.cookie-domain")
public String userServiceCookieDomain;

@Value("${admin-base-url}")
private String adminBaseUrl;

Expand Down Expand Up @@ -248,7 +251,7 @@ private Cookie addCustomJwtCookie(final HttpServletResponse response,
final boolean isAdmin) {
final Map<String, String> customJwtClaims = oneLoginService.generateCustomJwtClaims(userInfo, idToken);
final String customServiceJwt = customJwtService.generateToken(customJwtClaims, isAdmin);
final Cookie customJwt = WebUtil.buildSecureCookie(userServiceCookieName, customServiceJwt);
final Cookie customJwt = WebUtil.buildSecureCookie(userServiceCookieName, customServiceJwt, userServiceCookieDomain);
response.addCookie(customJwt);
return customJwt;
}
Expand Down
3 changes: 2 additions & 1 deletion src/test/java/gov/cabinetoffice/gapuserservice/web/LoginControllerV2Test.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,7 @@ void setUp() {

loginController = new LoginControllerV2(oneLoginService, customJwtService, configProperties, encryptionService, oneLoginUserService, findProperties, loggingUtils);
ReflectionTestUtils.setField(loginController, "userServiceCookieName", "userServiceCookieName");
ReflectionTestUtils.setField(loginController, "userServiceCookieDomain", "userServiceCookieDomain");
ReflectionTestUtils.setField(loginController, "adminBaseUrl", "http:localhost:3000/adminBaseUrl");
ReflectionTestUtils.setField(loginController, "applicantBaseUrl", "http:localhost:3000/applicantBaseUrl");
ReflectionTestUtils.setField(loginController, "techSupportAppBaseUrl", "http:localhost:3000/techSupportAppBaseUrl");
Expand Down Expand Up @@ -290,7 +291,7 @@ void shouldCreateJwtCookie() throws JSONException {
final String customToken = "a-custom-valid-token";
final HttpServletResponse response = Mockito.spy(new MockHttpServletResponse());
final Map<String, String> claims = Map.of("claim1", "value1", "claim2", "value2");
final Cookie cookie = WebUtil.buildSecureCookie("userServiceCookieName", "jwtToken");
final Cookie cookie = WebUtil.buildSecureCookie("userServiceCookieName", "jwtToken", "userServiceCookieDomain");
final JSONObject tokenResponse = new JSONObject();
tokenResponse.put("id_token", idToken).put("access_token", accessToken);

Expand Down
Loading