maskantech/docqube_backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

csrf issue

Browse Source
This commit is contained in:
momorew
2026-09-08 18:32:55 +05:30
parent 1f4ec43974
commit acc8c0658d
4 changed files with 102 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.test
+1
View File
@@ -47,6 +47,7 @@ MAX_CONTEXT_CHARS=4000
MIN_SIMILARITY_SCORE=0.18 MIN_SIMILARITY_SCORE=0.18
LOG_LEVEL=INFO LOG_LEVEL=INFO
CORS_ORIGINS=https://saas-test.maskantech.in,https://docqubeapp-test.maskantech.in,https://docqube-test.maskantech.in,http://localhost:5173,http://localhost:3000 CORS_ORIGINS=https://saas-test.maskantech.in,https://docqubeapp-test.maskantech.in,https://docqube-test.maskantech.in,http://localhost:5173,http://localhost:3000
COOKIE_DOMAIN=.maskantech.in
SMTP_HOST=smtp.gmail.com SMTP_HOST=smtp.gmail.com
SMTP_PORT=465 SMTP_PORT=465
SMTP_USER=info.maskantech@gmail.com SMTP_USER=info.maskantech@gmail.com
app/middleware/csrf.py
+9 -7
View File
@@ -34,25 +34,27 @@ class CSRFMiddleware(BaseHTTPMiddleware):
content={"detail": "CSRF verification failed"} content={"detail": "CSRF verification failed"}
) )
if not csrf_cookie: if not csrf_cookie:
self._set_csrf_cookie(response) self._set_csrf_cookie(response, request)
return response return response
response = await call_next(request) response = await call_next(request)
if not csrf_cookie: if not csrf_cookie:
self._set_csrf_cookie(response) self._set_csrf_cookie(response, request)
return response return response
def _set_csrf_cookie(self, response): def _set_csrf_cookie(self, response, request: Request = None):
"""Helper to set the CSRF cookie with appropriate security flags.""" """Helper to set the CSRF cookie with appropriate security flags."""
is_prod = settings.APP_ENV == "production" is_secure = settings.APP_ENV in ["production", "test", "testing"] or (request and request.url.scheme == "https")
samesite_mode = "none" if is_secure else "lax"
cookie_domain = getattr(settings, "COOKIE_DOMAIN", None) or None
response.set_cookie( response.set_cookie(
key="csrf_token", key="csrf_token",
value=str(uuid.uuid4()), value=str(uuid.uuid4()),
httponly=False, httponly=False,
samesite="none" if is_prod else "lax", samesite=samesite_mode,
secure=is_prod, secure=is_secure,
domain=settings.COOKIE_DOMAIN if is_prod else None, domain=cookie_domain,
path="/" path="/"
) )
app/modules/auth/routes/auth_routes.py
+81 -39
View File
@@ -45,13 +45,17 @@ def login(
): ):
token_data = AuthController.login_user(form_data, db, request) token_data = AuthController.login_user(form_data, db, request)
is_secure = settings.APP_ENV in ["production", "test", "testing"] or request.url.scheme == "https"
samesite_mode = "none" if is_secure else "lax"
cookie_domain = getattr(settings, "COOKIE_DOMAIN", None) or None
response.set_cookie( response.set_cookie(
key="docqube_access_token", key="docqube_access_token",
value=token_data["access_token"], value=token_data["access_token"],
httponly=True, httponly=True,
secure=settings.APP_ENV == "production", secure=is_secure,
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
max_age=3600, max_age=3600,
path="/", path="/",
) )
@@ -60,9 +64,9 @@ def login(
key="docqube_refresh_token", key="docqube_refresh_token",
value=token_data["refresh_token"], value=token_data["refresh_token"],
httponly=True, httponly=True,
secure=settings.APP_ENV == "production", secure=is_secure,
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
max_age=7 * 24 * 3600, max_age=7 * 24 * 3600,
path="/api/auth/refresh", path="/api/auth/refresh",
) )
@@ -71,21 +75,31 @@ def login(
key="docqube_has_session", key="docqube_has_session",
value="true", value="true",
httponly=False, httponly=False,
secure=settings.APP_ENV == "production", secure=is_secure,
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
max_age=7 * 24 * 3600, max_age=7 * 24 * 3600,
path="/", path="/",
) )
response.set_cookie(
key="csrf_token",
value=str(uuid.uuid4()),
httponly=False,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
path="/"
)
if hasattr(request.state, "new_device_id"): if hasattr(request.state, "new_device_id"):
response.set_cookie( response.set_cookie(
key="docqube_device_id", key="docqube_device_id",
value=request.state.new_device_id, value=request.state.new_device_id,
httponly=True, httponly=True,
secure=settings.APP_ENV == "production", secure=is_secure,
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
max_age=365 * 24 * 3600, max_age=365 * 24 * 3600,
path="/", path="/",
) )
@@ -97,14 +111,17 @@ def google_login(
request: Request, response: Response, payload: GoogleLoginIn, db: Session = Depends(get_db) request: Request, response: Response, payload: GoogleLoginIn, db: Session = Depends(get_db)
): ):
token_data = AuthController.google_login(payload, db, request) token_data = AuthController.google_login(payload, db, request)
is_secure = settings.APP_ENV in ["production", "test", "testing"] or request.url.scheme == "https"
samesite_mode = "none" if is_secure else "lax"
cookie_domain = getattr(settings, "COOKIE_DOMAIN", None) or None
response.set_cookie( response.set_cookie(
key="docqube_access_token", key="docqube_access_token",
value=token_data["access_token"], value=token_data["access_token"],
httponly=True, httponly=True,
secure=settings.APP_ENV == "production", secure=is_secure,
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
max_age=3600, max_age=3600,
path="/", path="/",
) )
@@ -113,9 +130,9 @@ def google_login(
key="docqube_refresh_token", key="docqube_refresh_token",
value=token_data["refresh_token"], value=token_data["refresh_token"],
httponly=True, httponly=True,
secure=settings.APP_ENV == "production", secure=is_secure,
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
max_age=7 * 24 * 3600, max_age=7 * 24 * 3600,
path="/api/auth/refresh", path="/api/auth/refresh",
) )
@@ -124,21 +141,31 @@ def google_login(
key="docqube_has_session", key="docqube_has_session",
value="true", value="true",
httponly=False, httponly=False,
secure=settings.APP_ENV == "production", secure=is_secure,
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
max_age=7 * 24 * 3600, max_age=7 * 24 * 3600,
path="/", path="/",
) )
response.set_cookie(
key="csrf_token",
value=str(uuid.uuid4()),
httponly=False,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
path="/"
)
if hasattr(request.state, "new_device_id"): if hasattr(request.state, "new_device_id"):
response.set_cookie( response.set_cookie(
key="docqube_device_id", key="docqube_device_id",
value=request.state.new_device_id, value=request.state.new_device_id,
httponly=True, httponly=True,
secure=settings.APP_ENV == "production", secure=is_secure,
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
max_age=365 * 24 * 3600, max_age=365 * 24 * 3600,
path="/", path="/",
) )
@@ -225,13 +252,17 @@ def refresh_token(request: Request, response: Response, db: Session = Depends(ge
new_access_token = create_access_token(payload_access) new_access_token = create_access_token(payload_access)
is_secure = settings.APP_ENV in ["production", "test", "testing"] or (request and request.url.scheme == "https")
samesite_mode = "none" if is_secure else "lax"
cookie_domain = getattr(settings, "COOKIE_DOMAIN", None) or None
response.set_cookie( response.set_cookie(
key="docqube_access_token", key="docqube_access_token",
value=new_access_token, value=new_access_token,
httponly=True, httponly=True,
secure=settings.APP_ENV == "production", secure=is_secure,
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
max_age=3600, max_age=3600,
path="/", path="/",
) )
@@ -240,9 +271,9 @@ def refresh_token(request: Request, response: Response, db: Session = Depends(ge
key="docqube_has_session", key="docqube_has_session",
value="true", value="true",
httponly=False, httponly=False,
secure=settings.APP_ENV == "production", secure=is_secure,
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
max_age=7 * 24 * 3600, max_age=7 * 24 * 3600,
path="/", path="/",
) )
@@ -304,26 +335,37 @@ def logout(
except Exception: except Exception:
pass pass
is_secure = settings.APP_ENV in ["production", "test", "testing"] or (request and request.url.scheme == "https")
samesite_mode = "none" if is_secure else "lax"
cookie_domain = getattr(settings, "COOKIE_DOMAIN", None) or None
response.delete_cookie( response.delete_cookie(
"docqube_access_token", "docqube_access_token",
path="/", path="/",
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
secure=settings.APP_ENV == "production", secure=is_secure,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
) )
response.delete_cookie( response.delete_cookie(
"docqube_refresh_token", "docqube_refresh_token",
path="/api/auth/refresh", path="/api/auth/refresh",
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
secure=settings.APP_ENV == "production", secure=is_secure,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
) )
response.delete_cookie( response.delete_cookie(
"docqube_has_session", "docqube_has_session",
path="/", path="/",
samesite="none" if settings.APP_ENV == "production" else "lax", samesite=samesite_mode,
secure=settings.APP_ENV == "production", secure=is_secure,
domain=settings.COOKIE_DOMAIN if settings.APP_ENV == "production" else None, domain=cookie_domain,
)
response.delete_cookie(
"csrf_token",
path="/",
samesite=samesite_mode,
secure=is_secure,
domain=cookie_domain,
) )
return {"status": "success", "message": "Logged out"} return {"status": "success", "message": "Logged out"}
app/modules/auth/sso_router.py
+11
View File
@@ -4,6 +4,7 @@ import time
import logging import logging
import hmac import hmac
import hashlib import hashlib
import uuid
from app.db.database import get_db from app.db.database import get_db
from app.core.settings import settings from app.core.settings import settings
@@ -133,6 +134,16 @@ async def sso_login(
max_age=7 * 24 * 3600 max_age=7 * 24 * 3600
) )
response.set_cookie(
key="csrf_token",
value=str(uuid.uuid4()),
httponly=False,
secure=is_secure,
samesite=samesite_mode,
domain=cookie_domain,
path="/"
)
return { return {
"status": "success", "status": "success",
"message": "SSO Login successful", "message": "SSO Login successful",