Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate admisible protocol version when validating HTTP headers #437

Closed
janherza opened this issue Dec 7, 2022 · 1 comment
Closed

Comments

@janherza
Copy link

janherza commented Dec 7, 2022

If i send invalid "version" in auth header (1.0, 151, ...), api returns code 200.

request:

url: api/inbox/count

headers: {
    'Content-type': 'application/json', 
    'X-PowerAuth-Token': 'PowerAuth token_id="2f880887-6676-411a-bf31-049e6bfefe06",
        token_digest="UNthz0sRyWYU7rklq+RfaX3FGjrHv3BtIXJbbpDHCMI=", nonce="6DCzzP2Z+NmMpVD9jGvKCQ==", 
        timestamp="1670421107576", version="1.0"'
}
data: {'requestObject': {}}

response (status code: 200):

headers: {
    'Content-Type': 'application/json',
    'Date': 'Wed, 07 Dec 2022 13:51:49 GMT',
    'Server': 'nginx',
    'Cache-Control': 'no-cache, no-store, max-age=0, must-revalidate',
    'Expires': '0', 
    'Pragma': 'no-cache',
    ... 
}
data: {
    "status":"OK",
    "responseObject":{"countUnread":0}
}

@janherza janherza changed the title Api enrollment-serer/inbox/count does not validate auth header attribute 'version' Api /inbox/count does not validate auth header attribute 'version' Dec 7, 2022
@petrdvorak
Copy link
Member

This issue belongs to a different repository - I will transfer it...

@petrdvorak petrdvorak transferred this issue from wultra/enrollment-server-wultra Dec 7, 2022
@petrdvorak petrdvorak changed the title Api /inbox/count does not validate auth header attribute 'version' Validate admisible protocol version when validating HTTP headers Dec 7, 2022
@petrdvorak petrdvorak transferred this issue from wultra/powerauth-restful-integration Dec 7, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants