You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
GraphQL subscriptions currently requires a valid JWT.
However, when subscribing to a topic, there are no checks for auth/validity of the dialogID.
This is a possible attack surface
Implementation
Require a DialogToken when subscribing to a topic.
Check the i claim against the subscription dialogId
The content you are editing has changed. Please copy your edits and refresh the page.
<!--- Provide a general summary of your changes in the Title above -->
## Description
DialogEvents subscription now requires a valid DialogToken
<!--- Describe your changes in detail -->
## Related Issue(s)
- #1104
## Verification
- [x] **Your** code builds clean without any errors or warnings
- [ ] Manual testing done (required)
- [ ] Relevant automated test added (if you find this hard, leave it and
we'll help out)
## Documentation
- [ ] Documentation is updated (either in `docs`-directory, Altinnpedia
or a separate linked PR in
[altinn-studio-docs.](https://github.com/Altinn/altinn-studio-docs), if
applicable)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
- **New Features**
- Enhanced security for `dialogEvents` subscription with new
authorization requirements.
- Introduced `DialogTokenMiddleware` for handling JWT in requests.
- Added methods to extract dialog ID from subscription operations.
- New constant for dialog token issuer version introduced.
- **Bug Fixes**
- Improved authorization policies with added null checks and
validations.
- **Documentation**
- Updated configuration settings for local development to enable
authentication and adjust JWT generation settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Magnus Sandgren <[email protected]>
Co-authored-by: Knut Haug <[email protected]>
Introduction
GraphQL subscriptions currently requires a valid JWT.
However, when subscribing to a topic, there are no checks for auth/validity of the dialogID.
This is a possible attack surface
Implementation
Require a DialogToken when subscribing to a topic.
Check the
i
claim against the subscription dialogIdTasks
Threat modelling
The text was updated successfully, but these errors were encountered: