Nail/ipwhitelist-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bump 0.5.28 — disable state check for SSO test

Browse Source
This commit is contained in:
naeel
2026-06-09 21:53:07 +04:00
parent 61361ec7e2
commit 6c5215513c
2 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{ {
"name": "ipwhitelist", "name": "ipwhitelist",
"version": "0.5.27", "version": "0.5.28",
"description": "IP WhiteList microservice for cloud provider", "description": "IP WhiteList microservice for cloud provider",
"main": "server.js", "main": "server.js",
"scripts": { "scripts": {
src/routes/oidc.js
+8 -4
View File
@@ -32,11 +32,15 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
router.get('/callback', async (req, res) => { router.get('/callback', async (req, res) => {
const { code, state } = req.query; const { code, state } = req.query;
// ⚠️ ВРЕМЕННО: проверка state отключена для тестирования (2026-06-09)
// 🔮 Вернуть когда заработает SSO на managed
// Проверка state (защита от CSRF на callback) // Проверка state (защита от CSRF на callback)
if (!state || state !== req.session.oidcState) { // if (!state || state !== req.session.oidcState) {
return res.status(403).send('Invalid state parameter'); // return res.status(403).send('Invalid state parameter');
} // }
delete req.session.oidcState; // delete req.session.oidcState;
if (req.session) delete req.session.oidcState;
if (!code) { if (!code) {
return res.status(400).send('Missing authorization code'); return res.status(400).send('Missing authorization code');