YunoHost-Apps/django_example_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/django_example_ynh.git synced 2024-09-03 18:26:21 +02:00
Code Issues Activity Actions 2

Bugfix #7 CSRF verification failed on POST requests

Browse source 
We must persist user in the session, after update.
This commit is contained in:
JensDiemer 2021-01-08 10:34:00 +01:00
parent bc6b7ab9a6
commit 43004e3ffa
1 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
django_ynh/sso_auth/auth_middleware.py
View file

@ -3,6 +3,8 @@ import logging
from axes.exceptions import AxesBackendPermissionDenied from axes.exceptions import AxesBackendPermissionDenied
from django.conf import settings from django.conf import settings
from django.contrib import auth
from django.contrib.auth import get_user_model
from django.contrib.auth.middleware import RemoteUserMiddleware from django.contrib.auth.middleware import RemoteUserMiddleware
from django_ynh.sso_auth.user_profile import call_setup_user, update_user_profile from django_ynh.sso_auth.user_profile import call_setup_user, update_user_profile
@ -11,6 +13,9 @@ from django_ynh.sso_auth.user_profile import call_setup_user, update_user_profil
logger = logging.getLogger(__name__) logger = logging.getLogger(__name__)
UserModel = get_user_model()
class SSOwatRemoteUserMiddleware(RemoteUserMiddleware): class SSOwatRemoteUserMiddleware(RemoteUserMiddleware):
""" """
Middleware to login a user via HTTP_REMOTE_USER header. Middleware to login a user via HTTP_REMOTE_USER header.
@ -63,12 +68,12 @@ class SSOwatRemoteUserMiddleware(RemoteUserMiddleware):
# Also check 'HTTP_AUTHORIZATION', but only the username ;) # Also check 'HTTP_AUTHORIZATION', but only the username ;)
try: try:
auth = request.META['HTTP_AUTHORIZATION'] authorization = request.META['HTTP_AUTHORIZATION']
except KeyError: except KeyError:
logger.error('HTTP_AUTHORIZATION missing!') logger.error('HTTP_AUTHORIZATION missing!')
raise AxesBackendPermissionDenied('No HTTP_AUTHORIZATION') raise AxesBackendPermissionDenied('No HTTP_AUTHORIZATION')
scheme, creds = auth.split(' ', 1) scheme, creds = authorization.split(' ', 1)
if scheme.lower() != 'basic': if scheme.lower() != 'basic':
logger.error('HTTP_AUTHORIZATION with %r not supported', scheme) logger.error('HTTP_AUTHORIZATION with %r not supported', scheme)
raise AxesBackendPermissionDenied('HTTP_AUTHORIZATION scheme not supported') raise AxesBackendPermissionDenied('HTTP_AUTHORIZATION scheme not supported')
@ -84,3 +89,8 @@ class SSOwatRemoteUserMiddleware(RemoteUserMiddleware):
user = update_user_profile(request, user) user = update_user_profile(request, user)
user = call_setup_user(user=user) user = call_setup_user(user=user)
assert isinstance(user, UserModel)
# persist user in the session
request.user = user
auth.login(request, user)