Mirroristas/CommunitySolidServer
2
0
Fork 0
mirror of https://github.com/CommunitySolidServer/CommunitySolidServer.git synced 2024-10-03 14:55:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: Clarify DPoPWebIdExtractor needs the original URL.

Browse Source 
https://github.com/solid/community-server/issues/492
This commit is contained in:
Ruben Verborgh 2021-01-13 22:17:55 +01:00 committed by Joachim Van Herwegen
parent 3a4ec48720
commit a46cd2bb3e
2 changed files with 17 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config/presets/ldp/credentials-extractor.json
View File

@ -7,8 +7,8 @@
"WaterfallHandler:_handlers": [ "WaterfallHandler:_handlers": [
{ {
"@type": "DPoPWebIdExtractor", "@type": "DPoPWebIdExtractor",
"DPoPWebIdExtractor:_targetExtractor": { "DPoPWebIdExtractor:_originalUrlExtractor": {
"@id": "urn:solid-server:default:TargetExtractor" "@type": "OriginalUrlExtractor"
} }
}, },
{ {

23
src/authentication/DPoPWebIdExtractor.ts
View File

@ -1,4 +1,4 @@
import type { SolidTokenVerifierFunction, RequestMethod } from '@solid/identity-token-verifier'; import type { RequestMethod } from '@solid/identity-token-verifier';
import { createSolidTokenVerifier } from '@solid/identity-token-verifier'; import { createSolidTokenVerifier } from '@solid/identity-token-verifier';
import type { TargetExtractor } from '../ldp/http/TargetExtractor'; import type { TargetExtractor } from '../ldp/http/TargetExtractor';
import { getLoggerFor } from '../logging/LogUtil'; import { getLoggerFor } from '../logging/LogUtil';
@ -12,14 +12,16 @@ import { CredentialsExtractor } from './CredentialsExtractor';
* Credentials extractor that extracts a WebID from a DPoP-bound access token. * Credentials extractor that extracts a WebID from a DPoP-bound access token.
*/ */
export class DPoPWebIdExtractor extends CredentialsExtractor { export class DPoPWebIdExtractor extends CredentialsExtractor {
private readonly originalUrlExtractor: TargetExtractor;
private readonly verify = createSolidTokenVerifier();
protected readonly logger = getLoggerFor(this); protected readonly logger = getLoggerFor(this);
private readonly targetExtractor: TargetExtractor;
private readonly verify: SolidTokenVerifierFunction;
public constructor(targetExtractor: TargetExtractor) { /**
* @param originalUrlExtractor - Reconstructs the original URL as requested by the client
*/
public constructor(originalUrlExtractor: TargetExtractor) {
super(); super();
this.targetExtractor = targetExtractor; this.originalUrlExtractor = originalUrlExtractor;
this.verify = createSolidTokenVerifier();
} }
public async canHandle({ headers }: HttpRequest): Promise<void> { public async canHandle({ headers }: HttpRequest): Promise<void> {
@ -34,15 +36,20 @@ export class DPoPWebIdExtractor extends CredentialsExtractor {
if (!dpop) { if (!dpop) {
throw new BadRequestHttpError('No DPoP header specified.'); throw new BadRequestHttpError('No DPoP header specified.');
} }
const resource = await this.targetExtractor.handleSafe({ request });
// Reconstruct the original URL as requested by the client,
// since this is the one it used to authorize the request
const originalUrl = await this.originalUrlExtractor.handleSafe({ request });
// Validate the Authorization and DPoP header headers
// and extract the WebID provided by the client
try { try {
const { webid: webId } = await this.verify( const { webid: webId } = await this.verify(
authorization as string, authorization as string,
{ {
header: dpop as string, header: dpop as string,
method: method as RequestMethod, method: method as RequestMethod,
url: resource.path, url: originalUrl.path,
}, },
); );
this.logger.info(`Verified WebID via DPoP-bound access token: ${webId}`); this.logger.info(`Verified WebID via DPoP-bound access token: ${webId}`);