Merge pull request #2052 from GSA/main

10/21/2024 Production Deploy Hot Fix

app/.well-known/security.txt

@@ -0,0 +1,2 @@
+Contact: mailto:[email protected]
+Expires: 2035-10-15T23:59:59Z

app/main/views/security_policy.py

@@ -1,11 +1,9 @@
-from flask import redirect
+from flask import send_from_directory
 
 from app.main import main
 
 
 @main.route("/.well-known/security.txt", methods=["GET"])
 @main.route("/security.txt", methods=["GET"])
 def security_policy():
-    # See GDS Way security policy which this implements
-    # https://gds-way.cloudapps.digital/standards/vulnerability-disclosure.html#vulnerability-disclosure-and-security-txt
-    return redirect("https://vdp.cabinetoffice.gov.uk/.well-known/security.txt")
+    return send_from_directory(".well-known", "security.txt")

app/main/views/sign_in.py

@@ -1,4 +1,4 @@
-import json
+# import json
 import os
 import secrets
 import time
@@ -43,7 +43,7 @@ def _reformat_keystring(orig):  # pragma: no cover
 def _get_access_token(code, state):  # pragma: no cover
     client_id = os.getenv("LOGIN_DOT_GOV_CLIENT_ID")
     access_token_url = os.getenv("LOGIN_DOT_GOV_ACCESS_TOKEN_URL")
-    certs_url = os.getenv("LOGIN_DOT_GOV_CERTS_URL")
+    # certs_url = os.getenv("LOGIN_DOT_GOV_CERTS_URL")
     keystring = os.getenv("LOGIN_PEM")
     if " " in keystring:
         keystring = _reformat_keystring(keystring)
@@ -66,33 +66,38 @@ def _get_access_token(code, state):  # pragma: no cover
     response = requests.post(url, headers=headers)
 
     response_json = response.json()
-    try:
-        encoded_id_token = response_json["id_token"]
-    except KeyError as e:
-        current_app.logger.exception(f"Error when getting id token {response_json}")
-        raise KeyError(f"'access_token' {response.json()}") from e
 
-    # Getting Login.gov signing keys for unpacking the id_token correctly.
-    jwks = requests.get(certs_url).json()
-    public_keys = {
-        jwk["kid"]: {
-            "key": jwt.algorithms.RSAAlgorithm.from_jwk(json.dumps(jwk)),
-            "algo": jwk["alg"],
-        }
-        for jwk in jwks["keys"]
-    }
-    kid = jwt.get_unverified_header(encoded_id_token)["kid"]
-    pub_key = public_keys[kid]["key"]
-    algo = public_keys[kid]["algo"]
-    id_token = jwt.decode(
-        encoded_id_token, pub_key, audience=client_id, algorithms=[algo]
-    )
+    # TODO nonce check intermittently fails, investifix
+    # Presumably the nonce is not yet in the session when there
+    # is an invite involved?
 
-    nonce = id_token["nonce"]
-    saved_nonce = session.pop("nonce")
-    if nonce != saved_nonce:
-        current_app.logger.error(f"Nonce Error: {nonce} != {saved_nonce}")
-        abort(403)
+    # try:
+    #     encoded_id_token = response_json["id_token"]
+    # except KeyError as e:
+    #     current_app.logger.exception(f"Error when getting id token {response_json}")
+    #     raise KeyError(f"'access_token' {response.json()}") from e
+
+    # Getting Login.gov signing keys for unpacking the id_token correctly.
+    # jwks = requests.get(certs_url).json()
+    # public_keys = {
+    #     jwk["kid"]: {
+    #         "key": jwt.algorithms.RSAAlgorithm.from_jwk(json.dumps(jwk)),
+    #         "algo": jwk["alg"],
+    #     }
+    #     for jwk in jwks["keys"]
+    # }
+    # kid = jwt.get_unverified_header(encoded_id_token)["kid"]
+    # pub_key = public_keys[kid]["key"]
+    # algo = public_keys[kid]["algo"]
+    # id_token = jwt.decode(
+    #    encoded_id_token, pub_key, audience=client_id, algorithms=[algo]
+    # )
+    # nonce = id_token["nonce"]
+
+    # saved_nonce = session.pop("nonce")
+    # if nonce != saved_nonce:
+    #     current_app.logger.error(f"Nonce Error: {nonce} != {saved_nonce}")
+    #     abort(403)
 
     try:
         access_token = response_json["access_token"]

package.json

@@ -25,7 +25,7 @@
     "graceful-fs": "^4.2.11"
   },
   "dependencies": {
-    "@rollup/plugin-commonjs": "^28.0.0",
+    "@rollup/plugin-commonjs": "^28.0.1",
     "@rollup/plugin-node-resolve": "^15.3.0",
     "@rollup/stream": "^3.0.1",
     "@uswds/uswds": "^3.9.0",
@@ -37,7 +37,7 @@
     "hogan": "1.0.2",
     "jquery": "3.7.1",
     "morphdom": "^2.7.4",
-    "playwright": "^1.48.0",
+    "playwright": "^1.48.1",
     "python": "^0.0.4",
     "query-command-supported": "1.0.0",
     "sass-embedded": "^1.79.5",

tests/app/main/views/test_security_policy.py

@@ -11,6 +11,6 @@
 def test_security_policy_redirects_to_policy(client_request, url):
     client_request.get_url(
         url,
-        _expected_status=302,
-        _expected_redirect="https://vdp.cabinetoffice.gov.uk/.well-known/security.txt",
+        _test_page_title=False,
+        _expected_status=200,
     )