mirror_php/winter
1
0
Fork 0
mirror of https://github.com/wintercms/winter.git synced 2024-06-28 05:33:29 +02:00
Code Issues Projects Releases Wiki Activity

Service Workers Invalid security token and Clear Site Data HTTP Header (#4088)

Browse Source 
If a website has a Service Worker installed it would load and register before a User tries to login to the backend causing a "Invalid security token" message. This PR unregisters any installed Service Worker when a User opens the backend Signin webpage.

I have also added the NEW Security Headers to add Protection to October's Cache and Cookies. This includes two new Middleware that first clears any bad cached data before a User tries to login and the second Middleware will clear all the sensitive User Data when a User signs out of the Backend.

For more info on the new Security Header 'Clear Site Data' you can see the spec found here: https://www.w3.org/TR/clear-site-data/

Fixes #4076, fixes #3707.
This commit is contained in:
Ayumi Hamasaki 2019-03-01 22:22:18 +00:00 committed by Luke Towers
parent 57f358b638
commit dd53206a82
2 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
modules/backend/assets/js/auth/uninstall-sw.js Normal file
View File

@ -0,0 +1,10 @@
// Only run on HTTPS connections
if (location.protocol === 'https:') {
// Unregister all service workers before signing in to prevent cache issues
navigator.serviceWorker.getRegistrations().then(
function(registrations) {
for (let registration of registrations) {
registration.unregister();
}
});
}

20
modules/backend/controllers/Auth.php
View File

@ -32,6 +32,26 @@ class Auth extends Controller
public function __construct()
{
parent::__construct();
$this->middleware(function ($request, $next) {
$response = $next($request);
// Clear Cache and any previous data to fix Invalid security token issue, see github: #3707
$response->headers->set('Cache-Control', 'no-cache, no-store, must-revalidate');
return $response;
})->only('signin');
// Only run on HTTPS connections
if (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] === "on") {
$this->middleware(function ($request, $next) {
$response = $next($request);
// Add HTTP Header 'Clear Site Data' to remove all Sensitive Data when signout, see github issue: #3707
$response->headers->set('Clear-Site-Data', 'cache, cookies, storage, executionContexts');
return $response;
})->only('signout');
}
// Add JS File to un-install SW to avoid Cookie Cache Issues when Signin, see github issue: #3707
$this->addJs(url("/modules/backend/assets/js/auth/uninstall-sw.js"));
$this->layout = 'auth';
}