Skip to content
This repository was archived by the owner on Mar 10, 2023. It is now read-only.

Commit be0955b

Browse files
Waterdripsalexellis
authored andcommitted
Check cookie exists and subject on cookie before using
We were checking if we had a cookie, but not then checking if it was not empty, and the subject was not empty before using it for redirecting to the user's dashboard (If they navigated to / or /dashboard) Tested by deploying new dashboard, deleting cookie, setting cookie to empty string etc. All returned no error (but did show 401 not authorized) Signed-off-by: Alistair Hey <alistair@heyal.co.uk>
1 parent 86de83c commit be0955b

1 file changed

Lines changed: 11 additions & 5 deletions

File tree

dashboard/of-cloud-dashboard/handler.js

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,14 +101,20 @@ module.exports = async (event, context) => {
101101

102102
const isSignedIn = /openfaas_cloud_token=.*\s*/.test(event.headers.cookie);
103103

104-
console.log(path);
105-
106104
if (path === "/" && isSignedIn) {
107-
headers["Location"] = "/dashboard/"+ decodedCookie["sub"];
105+
let statusCode = 404
106+
107+
// If we have a cookie, and it has a subject, then redirect to the subject's dashboard
108+
if (decodedCookie && decodedCookie["sub"]) {
109+
headers["Location"] = "/dashboard/"+ decodedCookie["sub"];
110+
statusCode = 307
111+
}
112+
108113
return context
109114
.headers(headers)
110-
.status(307)
111-
.succeed();
115+
.status(statusCode)
116+
.succeed()
117+
112118
}
113119

114120
let claims = get_all_claims(organizations, decodedCookie);

0 commit comments

Comments
 (0)