From d2156f3d6756a5542d02c40923c6a41d5c93ae6d Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Wed, 30 Nov 2016 10:15:44 -0500 Subject: [PATCH] Move the anti-referrer login to only logout This has no functional difference, just a cosmetic difference that does not give the erroneous impression a logout actually occurred. This does mean that if a browser disables cookies and uses the api explorer, there would be an opportunity for a CSRF. --- confluent_server/confluent/httpapi.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/confluent_server/confluent/httpapi.py b/confluent_server/confluent/httpapi.py index 07a34aa9..e4ccdd22 100644 --- a/confluent_server/confluent/httpapi.py +++ b/confluent_server/confluent/httpapi.py @@ -283,11 +283,13 @@ def _authorize_request(env, operation): name, element=None, skipuserobj=httpsessions[sessionid]['skipuserobject']) if (not authdata) and 'HTTP_AUTHORIZATION' in env: - # We do not allow a link into the api browser to come in with just - # username and password - if 'HTTP_REFERER' in env: - return {'code': 401} if env['PATH_INFO'] == '/sessions/current/logout': + if 'HTTP_REFERER' in env: + # note that this doesn't actually do harm + # otherwise, but this way do not give appearance + # of something having a side effect if it has the smell + # of a CSRF + return {'code': 401} return ('logout',) name, passphrase = base64.b64decode( env['HTTP_AUTHORIZATION'].replace('Basic ', '')).split(':', 1)