Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add dialog token auth check on subscriptions #1104

Closed
1 of 4 tasks
oskogstad opened this issue Sep 9, 2024 · 0 comments
Closed
1 of 4 tasks

Add dialog token auth check on subscriptions #1104

oskogstad opened this issue Sep 9, 2024 · 0 comments
Assignees

Comments

@oskogstad
Copy link
Collaborator

oskogstad commented Sep 9, 2024

Introduction

GraphQL subscriptions currently requires a valid JWT.
However, when subscribing to a topic, there are no checks for auth/validity of the dialogID.
This is a possible attack surface

Implementation

Require a DialogToken when subscribing to a topic.
Check the i claim against the subscription dialogId

Tasks

Threat modelling

oskogstad added a commit that referenced this issue Sep 30, 2024
<!--- Provide a general summary of your changes in the Title above -->

## Description

DialogEvents subscription now requires a valid DialogToken

<!--- Describe your changes in detail -->

## Related Issue(s)

- #1104 

## Verification

- [x] **Your** code builds clean without any errors or warnings
- [ ] Manual testing done (required)
- [ ] Relevant automated test added (if you find this hard, leave it and
we'll help out)

## Documentation

- [ ] Documentation is updated (either in `docs`-directory, Altinnpedia
or a separate linked PR in
[altinn-studio-docs.](https://github.com/Altinn/altinn-studio-docs), if
applicable)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

- **New Features**
- Enhanced security for `dialogEvents` subscription with new
authorization requirements.
	- Introduced `DialogTokenMiddleware` for handling JWT in requests.
	- Added methods to extract dialog ID from subscription operations.
	- New constant for dialog token issuer version introduced.

- **Bug Fixes**
- Improved authorization policies with added null checks and
validations.

- **Documentation**
- Updated configuration settings for local development to enable
authentication and adjust JWT generation settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Magnus Sandgren <[email protected]>
Co-authored-by: Knut Haug <[email protected]>
@elsand elsand closed this as completed Oct 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Archived in project
Development

No branches or pull requests

3 participants