Merge pull request 'use name 'oauth_payload' for data received from oauth authentication request' (!10) from bugfix/fix-conflicting-session-keys into master

Reviewed-on: #10

public/index.php

@@ -29,13 +29,13 @@ if ($match !== null) {
     }
 
     if (!$authorized) {
-        Container::$request->session()->set('redirect_after_login', '/' . $url);
+        Container::$request->session()->set('redirect_after_login', $url);
         $response = new Redirect(Container::$routeCollection->getRoute('login')->generateLink(), IRedirect::TEMPORARY);
         header('Location: ' . $response->getUrl(), true, $response->getHttpCode());
         return;
     }
 
-    if ($method === 'post' && Container::$request->post('anti_csrf_token') !== Container::$request->session()->get('anti_csrf_token')) {
+    if ($method === 'post' && !in_array($url, $antiCsrfTokenExceptions) && Container::$request->post('anti_csrf_token') !== Container::$request->session()->get('anti_csrf_token')) {
         $content = new SokoWeb\Response\JsonContent(['error' => 'no_valid_anti_csrf_token']);
         header('Content-Type: text/html; charset=UTF-8', true, 403);
         $content->render();

src/Controller/LoginController.php

@@ -47,7 +47,7 @@ class LoginController
             return new Redirect($this->redirectUrl, IRedirect::TEMPORARY);
         }
 
-        return new HtmlContent('login/login', ['redirectUrl' => $this->redirectUrl]);
+        return new HtmlContent('login/login', ['redirectUrl' => '/' . $this->redirectUrl]);
     }
 
     public function getGoogleLoginRedirect(): IRedirect
@@ -99,7 +99,7 @@ class LoginController
 
         $user = $this->userRepository->getById($resetter->getUserId());
 
-        return new HtmlContent('login/reset_password', ['success' => true, 'token' => $token, 'email' => $user->getEmail(), 'redirectUrl' => $this->redirectUrl]);
+        return new HtmlContent('login/reset_password', ['success' => true, 'token' => $token, 'email' => $user->getEmail(), 'redirectUrl' => '/' . $this->redirectUrl]);
     }
 
     public function login(): IContent
@@ -183,7 +183,7 @@ class LoginController
             $this->deleteRedirectUrl();
             return new JsonContent([
                 'redirect' => [
-                    'target' => $this->redirectUrl
+                    'target' => '/' . $this->redirectUrl
                 ]
             ]);
         }
@@ -247,7 +247,7 @@ class LoginController
             $this->deleteRedirectUrl();
             return new JsonContent([
                 'redirect' => [
-                    'target' => $this->redirectUrl
+                    'target' => '/' . $this->redirectUrl
                 ]
             ]);
         }

src/Controller/OAuthLoginController.php

@@ -36,7 +36,7 @@ class OAuthLoginController
             return new HtmlContent('oauth/oauth_error', ['error' => 'An invalid request was made. Please start authentication again.']);
         }
 
-        $this->request->session()->set('oauth_state', [
+        $this->request->session()->set('oauth_payload', [
             'redirect_uri' => $redirectUri,
             'state' => $state,
             'nonce' => $nonce === null ? '' : $nonce
@@ -49,12 +49,12 @@ class OAuthLoginController
 
     public function finishOauth()
     {
-        $oauthState = $this->request->session()->get('oauth_state');
-        if ($oauthState === null) {
+        $oAuthPayload = $this->request->session()->get('oauth_payload');
+        if ($oAuthPayload === null) {
             return new HtmlContent('oauth/oauth_error', ['error' => 'An invalid request was made. Please start authentication again.']);
         }
 
-        $this->request->session()->delete('oauth_state');
+        $this->request->session()->delete('oauth_payload');
 
         /**
          * @var ?User $user
@@ -67,16 +67,16 @@ class OAuthLoginController
         $code = bin2hex(random_bytes(16));
 
         $token = new OAuthToken();
-        $token->setNonce($oauthState['nonce']);
+        $token->setNonce($oAuthPayload['nonce']);
         $token->setUser($user);
         $token->setCode($code);
         $token->setCreatedDate(new DateTime());
         $token->setExpiresDate(new DateTime('+5 minutes'));
         $this->pdm->saveToDb($token);
 
-        $redirectUri = $oauthState['redirect_uri'];
+        $redirectUri = $oAuthPayload['redirect_uri'];
         $additionalUriParams = [
-            'state' => $oauthState['state'],
+            'state' => $oAuthPayload['state'],
             'code' => $code
         ];
         $and = (strpos($redirectUri, '?') !== false) ? '&' : '?';
@@ -89,7 +89,7 @@ class OAuthLoginController
     {
         $oAuthTokenRepository = new OAuthTokenRepository();
         $userRepository = new UserRepository();
-        $token = $oAuthTokenRepository->getByCode($this->request->query('code'));
+        $token = $oAuthTokenRepository->getByCode($this->request->post('code'));
 
         if ($token === null || $token->getExpiresDate() < new DateTime()) {
             return new JsonContent([

web.php

@@ -23,8 +23,8 @@ Container::$routeCollection->group('login', function (SokoWeb\Routing\RouteColle
 Container::$routeCollection->group('oauth', function (SokoWeb\Routing\RouteCollection $routeCollection) {
     $routeCollection->get('oauth-start', 'start', [RVR\Controller\OAuthLoginController::class, 'startOauth']);
     $routeCollection->get('oauth-finish', 'finish', [RVR\Controller\OAuthLoginController::class, 'finishOauth']);
-    $routeCollection->get('oauth-getToken', 'getToken', [RVR\Controller\OAuthLoginController::class, 'getToken']);
-    $routeCollection->get('oauth-getJwtPublicKey', 'getJwtPublicKey', [RVR\Controller\OAuthLoginController::class, 'getJwtPublicKey']);
+    $routeCollection->post('oauth-token', 'token', [RVR\Controller\OAuthLoginController::class, 'getToken']);
+    $routeCollection->get('oauth-jwtPublicKey', 'jwtPublicKey', [RVR\Controller\OAuthLoginController::class, 'getJwtPublicKey']);
 });
 Container::$routeCollection->group('password', function (SokoWeb\Routing\RouteCollection $routeCollection) {
     $routeCollection->get('password-requestReset', 'requestReset', [RVR\Controller\LoginController::class, 'getRequestPasswordResetForm']);
@@ -78,3 +78,6 @@ Container::$request = new SokoWeb\Request\Request(
 if (!Container::$request->session()->has('anti_csrf_token')) {
     Container::$request->session()->set('anti_csrf_token', bin2hex(random_bytes(16)));
 }
+
+//TODO: make a nicer logic
+$antiCsrfTokenExceptions = ['oauth/token'];