GSF.Web: Updated primary login page to use post-based authentication This forces use and validation of anti-forgery tokens

J. Ritchie Carroll committed 5 years ago

Commit 67449d21 parent e60ff236 files · +45 −23Browse files

Showing the changes to Source/Libraries/GSF.Web/Security/Scripts (2 of 6 files). Show all

Unified · Split

2 files

Source/Libraries/GSF.Web/Security/Scripts/Login.js +9 −1
Source/Libraries/GSF.Web/Security/Scripts/ntlm.js +9 −3

Source/Libraries/GSF.Web/Security/Scripts/Login.js+9−1

 //   boolean unsecureConnection: flag that indicates if connection is secure
 //   string verificationHeader: HTTP header name used to transmit anti-forgery value
 //   string verificationValue: server generated anti-forgery verification token value
+//   string useAjaxVerfication: HTTP header named use to indicate an AJAX post
 //   string redirectPageLabel: user label for redirect location, e.g., main or target
 function loadSettings() {
     $.ajax({
         cache: false,
         url: securePage,
+        type: "post",
         complete: function (xhr) {
             switch (xhr.status) {
                 case 200:
             xhr.setRequestHeader("Authorization", "Basic " + btoa(username + ":" + password));
             xhr.setRequestHeader(verificationHeader, verificationValue);
+            xhr.setRequestHeader(useAjaxVerfication, "true");
         }
     });
 }
             loginComplete(true);
         else
             loginFailed(response);
-    }, verificationHeader, verificationValue);
+    },
+    verificationHeader, verificationValue, useAjaxVerfication);
 }
 // Authorize user with pass-through basic authentication without credentials
     $.ajax({
         cache: false,
         url: securePage,
+        type: "post",
         complete: function (xhr) {
             switch (xhr.status) {
                 case 200:
         },
         beforeSend: function (xhr) {
             xhr.setRequestHeader(verificationHeader, verificationValue);
+            xhr.setRequestHeader(useAjaxVerfication, "true");
         }
     });
 }
     $.ajax({
         cache: false,
         url: securePage + "?scheme=NTLM",
+        type: "post",
         complete: function (xhr) {
             if (xhr.status === 200) {
                 loginComplete(true);
         },
         beforeSend: function (xhr) {
             xhr.setRequestHeader(verificationHeader, verificationValue);
+            xhr.setRequestHeader(useAjaxVerfication, "true");
         }
     });
 }

Source/Libraries/GSF.Web/Security/Scripts/ntlm.js+9−3

     return header && header.indexOf("NTLM") !== -1;
 };
-Ntlm.authenticate = function(url, handleResponse, verificationHeader, verificationValue) {
+Ntlm.authenticate = function (url, handleResponse, verificationHeader, verificationValue, useAjaxVerfication) {
     if (!Ntlm.domain || !Ntlm.username || !Ntlm.lmHashedPassword || !Ntlm.ntHashedPassword) {
         Ntlm.error("No NTLM credentials specified. Use Ntlm.setCredentials(...) before making calls.");
         return;
     $.ajax({
         url: url,
+        type: "post",
         cache: false,
         crossDomain: false,
         xhrFields: {
                 case 401:
                     $.ajax({
                         url: url,
+                        type: "post",
                         cache: false,
                         crossDomain: false,
                         xhrFields: {
                             xhr2.setRequestHeader("Authorization", "NTLM " + msg3.toBase64());
-                            if (verificationHeader && verificationValue)
+                            if (verificationHeader && verificationValue) {
                                 xhr2.setRequestHeader(verificationHeader, verificationValue);
+                                xhr2.setRequestHeader(useAjaxVerfication, "true");
+                            }
                         }
                     });
                     break;
             const msg1 = Ntlm.createMessage1(hostname);
             xhr.setRequestHeader("Authorization", "NTLM " + msg1.toBase64());
-            if (verificationHeader && verificationValue)
+            if (verificationHeader && verificationValue) {
                 xhr.setRequestHeader(verificationHeader, verificationValue);
+                xhr.setRequestHeader(useAjaxVerfication, "true");
+            }
         }
     });
 };

GSF.Web: Updated primary login page to use post-based authentication This forces use and validation of anti-forgery tokens

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code