Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Few routes are accessible with URL hard-coding #38

Open
p1utoze opened this issue Dec 2, 2023 · 0 comments
Open

Few routes are accessible with URL hard-coding #38

p1utoze opened this issue Dec 2, 2023 · 0 comments
Assignees
Labels
bug Something isn't working

Comments

@p1utoze
Copy link
Owner

p1utoze commented Dec 2, 2023

Few endpoints are accessible and not protected by the user authorization walls used in the app. The JWT tokens verification rule hasn't been implemented yet.

  • Anyone can access this endpoint by adding the required query parameter. This has to be resolved by adding a dependency check for authorization.

    Hackme/app/main.py

    Lines 101 to 104 in bbd1c37

    @app.get(
    "/register", dependencies=[Depends(load_data)], response_class=HTMLResponse
    )
    async def register_participant(request: Request, uid: str):
  • One more endpoint which isn't secured.
    @router.get("/dashboard", tags=["Admin"])
    async def admin_dashboard(
    request: Request, templates: Jinja2Templates = Depends(get_templates)
    ):
@p1utoze p1utoze added the bug Something isn't working label Dec 2, 2023
@p1utoze p1utoze self-assigned this Dec 2, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant