dan/Portfolio
1
0
Fork 0
mirror of https://github.com/danbulant/Portfolio synced 2026-06-24 17:11:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: do not unwrap cookies in guards, use private cookies

Browse source
This commit is contained in:
EETagent 2022-11-07 13:56:25 +01:00
parent 6f608fc8df
commit 0cf6c4418d
4 changed files with 23 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
api/src/guards/request/auth/admin.rs
View file

@ -19,7 +19,14 @@ impl Into<Admin> for AdminAuth {
impl<'r> FromRequest<'r> for AdminAuth { impl<'r> FromRequest<'r> for AdminAuth {
type Error = Option<String>; type Error = Option<String>;
async fn from_request(req: &'r Request<'_>) -> Outcome<AdminAuth, (Status, Self::Error), ()> { async fn from_request(req: &'r Request<'_>) -> Outcome<AdminAuth, (Status, Self::Error), ()> {
let session_id = req.cookies().get("id").unwrap().name_value().1; let cookie = req.cookies().get_private("id");
let Some(cookie) = cookie else {
return Outcome::Failure((Status::Unauthorized, None));
};
let session_id = cookie.name_value().1;
let conn = &req.rocket().state::<Db>().unwrap().conn; let conn = &req.rocket().state::<Db>().unwrap().conn;
let uuid = match Uuid::parse_str(&session_id) { let uuid = match Uuid::parse_str(&session_id) {

18
api/src/guards/request/auth/candidate.rs
View file

@ -14,12 +14,21 @@ impl Into<Candidate> for CandidateAuth {
self.0 self.0
} }
} }
#[rocket::async_trait] #[rocket::async_trait]
impl<'r> FromRequest<'r> for CandidateAuth { impl<'r> FromRequest<'r> for CandidateAuth {
type Error = Option<String>; type Error = Option<String>;
async fn from_request(req: &'r Request<'_>) -> Outcome<CandidateAuth, (Status, Self::Error), ()> { async fn from_request(
let session_id = req.cookies().get("id").unwrap().name_value().1; req: &'r Request<'_>,
) -> Outcome<CandidateAuth, (Status, Self::Error), ()> {
let cookie = req.cookies().get_private("id");
let Some(cookie) = cookie else {
return Outcome::Failure((Status::Unauthorized, None));
};
let session_id = cookie.name_value().1;
let conn = &req.rocket().state::<Db>().unwrap().conn; let conn = &req.rocket().state::<Db>().unwrap().conn;
let uuid = match Uuid::parse_str(&session_id) { let uuid = match Uuid::parse_str(&session_id) {
@ -33,6 +42,5 @@ impl<'r> FromRequest<'r> for CandidateAuth {
Ok(model) => Outcome::Success(CandidateAuth(model)), Ok(model) => Outcome::Success(CandidateAuth(model)),
Err(_) => Outcome::Failure((Status::Unauthorized, None)), Err(_) => Outcome::Failure((Status::Unauthorized, None)),
} }
} }
} }

3
api/src/routes/admin.rs
View file

@ -38,8 +38,7 @@ pub async fn login(
)); ));
} else { } else {
let session_token = session_token.unwrap(); let session_token = session_token.unwrap();
// Todo: Add private? cookies.add_private(Cookie::new("id", session_token.clone()));
cookies.add(Cookie::new("id", session_token.clone()));
return Ok(session_token); return Ok(session_token);
} }

3
api/src/routes/candidate.rs
View file

@ -35,8 +35,7 @@ pub async fn login(
)); ));
} else { } else {
let session_token = session_token.unwrap(); let session_token = session_token.unwrap();
// Todo: Add private? cookies.add_private(Cookie::new("id", session_token.clone()));
cookies.add(Cookie::new("id", session_token.clone()));
return Ok(session_token); return Ok(session_token);
} }