diff --git a/lib/create-app.js b/lib/create-app.js index 5cff5d5a9..0d7a365a2 100644 --- a/lib/create-app.js +++ b/lib/create-app.js @@ -296,6 +296,7 @@ function initAuthentication (app, argv) { */ function sessionSettings (secureCookies, host) { let sessionSettings = { + name: 'nssidp.sid', secret: uuid.v1(), saveUninitialized: false, resave: false, diff --git a/lib/requests/sharing-request.js b/lib/requests/sharing-request.js index f534f3110..01052eeba 100644 --- a/lib/requests/sharing-request.js +++ b/lib/requests/sharing-request.js @@ -82,6 +82,8 @@ class SharingRequest extends AuthRequest { } else { request.renderForm(null, req, appOrigin) } + } else { + request.redirectPostSharing() } } @@ -119,6 +121,8 @@ class SharingRequest extends AuthRequest { // Redirect once that's all done request.redirectPostSharing() + } else { + request.redirectPostSharing() } } @@ -144,12 +148,7 @@ class SharingRequest extends AuthRequest { isUserLoggedIn () { // Ensure the user arrived here by logging in - if (!this.session.subject || !this.session.subject._id) { - this.response.status(401) - this.response.send('User not logged in 2') - return false - } - return true + return !!(this.session.subject && this.session.subject._id) } getAppUrl () { diff --git a/test/integration/authentication-oidc-test.js b/test/integration/authentication-oidc-test.js index 76422fc0f..77a74abb0 100644 --- a/test/integration/authentication-oidc-test.js +++ b/test/integration/authentication-oidc-test.js @@ -137,7 +137,7 @@ describe('Authentication API (OIDC)', () => { }) it('should set the cookie', () => { - expect(cookie).to.match(/connect.sid=\S{65,100}/) + expect(cookie).to.match(/nssidp.sid=\S{65,100}/) }) it('should set the cookie with HttpOnly', () => { @@ -247,7 +247,7 @@ describe('Authentication API (OIDC)', () => { describe('with malicious cookie but without origin', () => { let response before(done => { - var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') alice.get('/private-for-alice.txt') .set('Cookie', malcookie) .end((err, res) => { @@ -353,7 +353,7 @@ describe('Authentication API (OIDC)', () => { describe('with malicious cookie but with globally configured origin', () => { let response before(done => { - var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') alice.get('/private-for-alice.txt') .set('Cookie', malcookie) .set('Origin', 'https://apps.solid.invalid') @@ -407,7 +407,7 @@ describe('Authentication API (OIDC)', () => { describe('with malicious cookie and our origin', () => { let response before(done => { - var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') alice.get('/private-for-alice.txt') .set('Cookie', malcookie) .set('Origin', aliceServerUri) @@ -425,7 +425,7 @@ describe('Authentication API (OIDC)', () => { describe('with malicious cookie and a non-matching origin', () => { let response before(done => { - var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') alice.get('/private-for-owner.txt') .set('Cookie', malcookie) .set('Origin', bobServerUri) @@ -455,7 +455,7 @@ describe('Authentication API (OIDC)', () => { describe('with trusted app and malicious cookie', () => { before(done => { - var malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + var malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') alice.get('/private-for-alice.txt') .set('Cookie', malcookie) .set('Origin', trustedAppUri) diff --git a/test/integration/authentication-oidc-with-strict-origins-turned-off-test.js b/test/integration/authentication-oidc-with-strict-origins-turned-off-test.js index 104e103b9..e2a5cf489 100644 --- a/test/integration/authentication-oidc-with-strict-origins-turned-off-test.js +++ b/test/integration/authentication-oidc-with-strict-origins-turned-off-test.js @@ -134,7 +134,7 @@ describe('Authentication API (OIDC) - With strict origins turned off', () => { }) it('should set the cookie', () => { - expect(cookie).to.match(/connect.sid=\S{65,100}/) + expect(cookie).to.match(/nssidp.sid=\S{65,100}/) }) it('should set the cookie with HttpOnly', () => { @@ -286,7 +286,7 @@ describe('Authentication API (OIDC) - With strict origins turned off', () => { let malcookie before(() => { // How Mallory might set their cookie: - malcookie = cookie.replace(/connect\.sid=(\S+)/, 'connect.sid=l33th4x0rzp0wn4g3;') + malcookie = cookie.replace(/nssidp\.sid=(\S+)/, 'nssidp.sid=l33th4x0rzp0wn4g3;') }) describe('and no origin set', () => { before(done => {