UAA Auth Route Service uaa-proxy-session cookies may be replayed indefinitely

[commit-dkp]

UAA Auth Route Service uaa-proxy-session cookies may be replayed indefinitely

[ArthurHlt]

Hello there,
Yes i found this issue, i didn't PR what I've done about it cause I will need your approval and discuss about the work I've made.

First, I decrypt information in the token which is jwt and you get user information inside this token. The token is actually base64 encoded information and user information are available in the third part of jwt (see code to get info). Inside you can found when the token will expire (by default uaa delivered a token which expired in 30min).

I store this information inside the cf-uaa-guard's cookie (see code) and I check if the session expired from the time I stored in the rootHandler (see code) if expired I redirect to the logout handler I've added.

This handler will simply clean data inside the token, put logged to false and remove user information and finally redirect to the auth handler (see code).

Finally, it will go back to the current chain and if token can be renewed it will be and if no go back to the login page.

Hope it helps.

[commit-dkp]

@ArthurHlt AFAIK, 18F/cloud.gov doesn't use this service anymore, so you shouldn't need their approval to send a PR. FWIW, if what you've done can pass a unit test where the example they described in the second-to-last paragraph cannot be realized, then I would consider the issue closed.

[mogul]

Sorry, I've only just seen this since I missed notification of @ArthurHlt 's comment back when he made it. As the person ostensibly in charge around here: Yes, PRs with a test welcome!