🐛 add middleware to handle social auth provider unavailability gracefully

[manuel-sommer]

-->

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request modifies a sensitive file (dojo/middleware.py) multiple times; the scanner flags these as sensitive codepath edits and recommends configuring allowed paths/authors in .dryrunsecurity.yaml. Review and approve or restrict these changes per your sensitivity policy.

🔴 Configured Codepaths Edit in dojo/middleware.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/middleware.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/middleware.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/middleware.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/middleware.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/middleware.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/middleware.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.

[valentijnscholten]

Is there not a better/cleaner way to do this, for example by subclassing the social auth middleware?
It feels like a lot of extra code and configuration to handle a case which is probably not even that common.
I think name, path_prefix, check_path are not needed. The rest can be loaded straight from settings?
I also wonder if the standard login is always available as fallback.

[manuel-sommer]

Is there not a better/cleaner way to do this, for example by subclassing the social auth middleware? It feels like a lot of extra code and configuration to handle a case which is probably not even that common. I think name, path_prefix, check_path are not needed. The rest can be loaded straight from settings? I also wonder if the standard login is always available as fallback.

I adapted the code. Also, the standard login is always available as fallback.

[valentijnscholten]

Thanks for the efforts @manuel-sommer , but did you consider other approaches? I am not yet convinced this middleware solution is the best way to implement this. When I look at the Django Social Auth app I see some pointers around customizing the middleware and exception handling:

• https://github.com/omab/django-social-auth/blob/699571a3b6d84aa2c25ffce59daa4c7f3559a0e4/example/example/middleware.py
• https://github.com/omab/edx-platform/blob/f098633cee8b941d04e1beb1ff3b3acd5a3511e4/common/djangoapps/third_party_auth/middleware.py
• https://github.com/omab/django-social-auth/blob/699571a3b6d84aa2c25ffce59daa4c7f3559a0e4/doc/configuration.rst#exceptions-middleware

Could you take a look and/or convince us that the proposed solution in this PR is the best fit?

[manuel-sommer]

Thanks for the efforts @manuel-sommer , but did you consider other approaches? I am not yet convinced this middleware solution is the best way to implement this. When I look at the Django Social Auth app I see some pointers around customizing the middleware and exception handling:

* https://github.com/omab/django-social-auth/blob/699571a3b6d84aa2c25ffce59daa4c7f3559a0e4/example/example/middleware.py

* https://github.com/omab/edx-platform/blob/f098633cee8b941d04e1beb1ff3b3acd5a3511e4/common/djangoapps/third_party_auth/middleware.py

* https://github.com/omab/django-social-auth/blob/699571a3b6d84aa2c25ffce59daa4c7f3559a0e4/doc/configuration.rst#exceptions-middleware

Could you take a look and/or convince us that the proposed solution in this PR is the best fit?

Thank you for the guidance here @valentijnscholten. Learned something new :-)
How about the PR now?

[valentijnscholten]

Looks nice and clean @manuel-sommer :-) I don't have a way to test this. Dis you manage to test these specific types or errors? We need to make sure we don't break the SSO for the Pro clients :-)

[manuel-sommer]

@valentijnscholten, I implemented a unittest, but don't have the chance to test all different possibilities in a real environment.

[mtesauro]

Approved

[mtesauro]

@kiblik Are you good with this? Wanted to ask before we merged it since you had requested changes that haven't been dismissed.

[Maffooch]

@kiblik I'm gonna go ahead and merge this one so that the changes can be used in #13572