Mercurial > p > roundup > code
changeset 8247:6747051fef79
feat: issue2551372 - REST-API CSRF protection should document mandatory Origin header
Logging is more useful I hope.
Logs the name of the user making the request.
Logs the value of the origin header if the value is not authorized
to use the rest interface.
Added a comment about difficulty include originating IP address
in log.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 31 Dec 2024 17:11:17 -0500 |
| parents | 3812c0fb1137 |
| children | f6923d2ba9a5 |
| files | roundup/cgi/client.py |
| diffstat | 1 files changed, 14 insertions(+), 3 deletions(-) [+] |
line wrap: on
line diff
--- a/roundup/cgi/client.py Mon Dec 30 22:51:46 2024 -0500 +++ b/roundup/cgi/client.py Tue Dec 31 17:11:17 2024 -0500 @@ -726,10 +726,10 @@ if not self.is_origin_header_ok(api=True): if 'HTTP_ORIGIN' not in self.env: msg = self._("Required Header Missing") - err = 'Origin header missing' + err = "REST request missing 'Origin' header by user %(user)s." else: msg = self._("Client is not allowed to use Rest Interface.") - err = 'Unauthorized for REST request' + err = "REST request 'Origin' (%(origin)s) unauthorized by user %(user)s." # Use code 400. Codes 401 and 403 imply that authentication # is needed or authenticated person is not authorized. @@ -739,7 +739,18 @@ self.reject_request(output, message_type="application/json", status=400) - logger.error(err) + # Would be nice to log the original source address here to + # allow firewalling in case of abuse/attack. Especially if + # anonymous is allowed REST access. However, + # self.request.connection.getpeername() + # only gets us 127.0.0.1 when a proxy is used. I think the + # same is true of wsgi mode (but it might be a UNIX domain + # socket address). The upstream server needs to supply the + # real IP as it sees it and we need to consume it. There + # is no method for this that handles all the ways roundup + # can be run AFAIK. So no IP address, just user. + logger.error(err, {"user": self.user, + "origin": self.env.get('HTTP_ORIGIN', None)}) return # Handle CORS preflight request. We know rest is enabled