[16.0][IMP]auth_jwt: Allow to not renew the cookie in the responses #825
Conversation
|
Hi @sbidoul, |
| return validator._decode(token, secret=validator._get_jwt_cookie_secret()) | ||
| secret = None | ||
| if validator.renew_cookie_on_response: | ||
| secret = validator._get_jwt_cookie_secret() |
There was a problem hiding this comment.
I don't understand this part. If we don't check that the cookie is signed with the expected secret, a malicious client could send a forged cookie, right?
There was a problem hiding this comment.
No, if renew_cookie_on_response is False, _decode will be called with secret=None, so the funcion will check the cookie with the secret or public key configured in the validator.
| raise UnauthorizedCompositeJwtError(exceptions) | ||
|
|
||
| if validator.cookie_enabled: | ||
| if validator.cookie_enabled and validator.renew_cookie_on_response: |
There was a problem hiding this comment.
This completely disable the cookie setting mechanism is renew_cookie_on_response is not set, so that's probably not what you intended?
There was a problem hiding this comment.
yes, is the idea. We need a flow where odoo only checks the cookie/header and validate against the secret/public key configured in the validator, we dont need the cookie to be setted again in the response
There was a problem hiding this comment.
I don't get it, sorry. What will then set the cookie in the first place?
There was a problem hiding this comment.
Another service in the same domain, the cookie can be shared, or odoo itself in a public controller who checks the credentials and sets the cookie.
Our goal is to implement a flow in the module where it only checks the token and give access to the endpoint.
This can be done with the token in the header, but is a problem with cookies, because odoo set it again with his own secret and also extends the expire time.
jesusVMayor
force-pushed
the
16.0_auth_jwt_cookie_renew_field
branch
from
c480a25 to
2721a0c
Compare
|
There hasn't been any activity on this pull request in the past 4 months, so it has been marked as stale and it will be closed automatically if no further activity occurs in the next 30 days. |
github-actions
bot
added
the
stale
3 participants
No description provided.