Raise an error if trusted_hosts isn't set, with override flag

Author: danielrichman

tests/test_auth_decorator.py

@@ -140,6 +140,8 @@ def __init__(self, cls=AuthDecorator, *args, **kwargs):
         self.app.testing = True
         self.app.secret_key = str(random.random())
 
+        kwargs.setdefault("can_trust_request_host", True)
+
         self.authdecorator = cls(*args, **kwargs)
         view = self.authdecorator(self.decorated)
 
@@ -574,8 +576,8 @@ def test_require_combo(self):
 
     def test_custom_check_auth(self):
         class MyAuthDecorator(AuthDecorator):
-            def __init__(self):
-                AuthDecorator.__init__(self)
+            def __init__(self, *args, **kwargs):
+                AuthDecorator.__init__(self, *args, **kwargs)
                 self._expect_check = []
 
             def check_authorised(self, principal, ptags):
@@ -934,3 +936,19 @@ def test_params_token_doesnt_break_multiple_auths(self):
             self.os.set_urandom("ffff")
             response = client.get("/decorated", follow_redirects=True)
             assert response.status_code == 200
+
+    def test_trusted_hosts(self):
+        self.check_auth(TestRig())
+
+        rig = TestRig(can_trust_request_host=False)
+        class R(flask.Request):
+            trusted_hosts = {'localhost'}
+        rig.app.request_class = R
+        self.check_auth(rig)
+
+        rig = TestRig(can_trust_request_host=False)
+        with rig as (client, wls, views):
+            wls.expect({}, make_response(principal='djr61'))
+
+            assert_raises(RuntimeError,
+                          client.get, "/decorated", follow_redirects=True)

ucam_webauth/flask_glue.py

@@ -60,6 +60,22 @@ def my_view():
     Note that since it uses flask.session, you'll need to set
     :attr:`app.secret_key`.
 
+    We need to be able to reliably determine the hostname of the current
+    website. This is retrieved from :attr:`flask.Request.url`.
+    By default, Werkzeug will respect the value of a ``X-Forwarded-Host``
+    header, which means that a man-in-the-middle can have someone authenticate
+    to *their* website, and forward the response from the WLS on to you.
+    You must either set :attr:`flask.Request.trusted_hosts`, for example
+    like so::
+
+        class R(flask.Request):
+            trusted_hosts = {'www.danielrichman.co.uk'}
+        app.request_class = R
+
+    ... or sanitise both the `Host` header *and* the `X-Forwarded-Host`
+    header in your web-server. If you choose the second option, set
+    `can_trust_request_host`.
+
     This tries to emulate the feel of applying mod_ucam_webauth to a file.
 
     The decorator wraps the view in a function that calls
@@ -106,6 +122,10 @@ def my_view():
     :type require_ptags: :class:`set` of :class:`str`, or ``None``
     :param require_ptags: require the ptags to contain `any` string in
                           `require_ptags` (i.e., non empty intersection)
+    :type can_trust_request_host: :class:`bool`
+    :param can_trust_request_host: Can we trust the hostname in
+                                   ``request.url``?
+                                   (see :ref:`checking-response-values`)
 
     More complex customisation is possible:
 
@@ -149,7 +169,8 @@ def __init__(self, desc=None, aauth=None, iact=None, msg=None,
                     max_life=7200, use_wls_life=False,
                     inactive_timeout=None, issue_bounds=(15,5),
                     require_principal=None,
-                    require_ptags=frozenset(["current"])):
+                    require_ptags=frozenset(["current"]),
+                    can_trust_request_host=False):
         self.desc = desc
         self.aauth = aauth
         self.iact = iact
@@ -160,6 +181,7 @@ def __init__(self, desc=None, aauth=None, iact=None, msg=None,
         self.issue_bounds = issue_bounds
         self.require_principal = require_principal
         self.require_ptags = require_ptags
+        self.can_trust_request_host = can_trust_request_host
 
     def __call__(self, view_function):
         """
@@ -423,6 +445,11 @@ def _check_url(self, wls_response_url):
         redirected after authentication.
         """
 
+        if not self.can_trust_request_host and request.trusted_hosts is None:
+            raise RuntimeError("Either set request.trusted_hosts, or sanitise "
+                               "Host/X-Forwarded-Host headers and pass "
+                               "can_trust_request_host = True")
+
         actual_url = request.url
 
         # note: mod_ucam_webauth simply strips everything up to a ?