Penpot/penpot
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2025-02-15 03:28:25 -05:00
Code Issues Activity

🐛 Fix incorrect request flow handling on session middleware

Browse source 
an issue introduced in previous commits
This commit is contained in:
Andrey Antukh 2022-12-16 16:58:22 +01:00
parent 498ec29e47
commit c13730dca7
2 changed files with 15 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
backend/src/app/http/middleware.clj
View file

@ -78,13 +78,12 @@
(raise cause)))] (raise cause)))]
(fn [request respond raise] (fn [request respond raise]
(when-let [request (try (let [request (ex/try! (process-request request))]
(process-request request) (if (ex/exception? request)
(catch RuntimeException cause (if (instance? RuntimeException request)
(handle-error raise (or (.getCause cause) cause))) (handle-error raise (or (ex/cause request) request))
(catch Throwable cause (handle-error raise request))
(handle-error raise cause)))] (handler request respond raise))))))
(handler request respond raise)))))
(def parse-request (def parse-request
{:name ::parse-request {:name ::parse-request

11
backend/src/app/http/session.clj
View file

@ -178,10 +178,15 @@
(clear-authenticated-cookie)))))) (clear-authenticated-cookie))))))
(def middleware-1 (def middleware-1
(letfn [(wrap-handler [manager handler request respond raise] (letfn [(decode-cookie [manager cookie]
(when-let [cookie (some->> (cf/get :auth-token-cookie-name default-auth-token-cookie-name) (if-let [value (:value cookie)]
(decode manager value)
(p/resolved nil)))
(wrap-handler [manager handler request respond raise]
(let [cookie (some->> (cf/get :auth-token-cookie-name default-auth-token-cookie-name)
(yrq/get-cookie request))] (yrq/get-cookie request))]
(->> (decode manager (:value cookie)) (->> (decode-cookie manager cookie)
(p/fnly (fn [claims _] (p/fnly (fn [claims _]
(cond-> request (cond-> request
(some? claims) (assoc :session-token-claims claims) (some? claims) (assoc :session-token-claims claims)