Uploaded image for project: 'Okapi'
  1. Okapi
  2. OKAPI-847

Conditionally defer CORS handling to module when invoked via passthrough API

    XMLWordPrintable

Details

    • CP: sprint 89, CP: sprint 90
    • 3
    • Core: Platform

    Description

      Overview

      The /_/invoke/tenant/<tenantId>/<path> is essentially a passthrough proxy to the target module. In order to allow mod-login-saml to set cookies - as part of CSRF prevention, we would like that module to perform it's own CORS handling. It's currently invoked via the aforementioned passthrough proxy API.

      See https://wiki.folio.org/display/DD/SAML+CSRF+Prevention for details.

      Acceptance Criteria

      • The module descriptor allows you to optionally specify whether or not to delegate CORS handling to the target module when invoked via /_/invoke/tenant/<tenantId>/<path>
      • CORS handling is conditionally handled in OKAPI based on the target module's descriptor (only when invoked via /_/invoke/tenant/<tenantId>/<path>)
      • OKAPI guide is updated with details

      TestRail: Results

        Attachments

          Issue Links

            blocks

            Bug - A problem which impairs or prevents the functions of the product. MODLOGSAML-58 Arbitrary URL Redirection in SAML Response

            • P2 - normal priority level, must be included in the current development cycle
            • Closed

            Bug - A problem which impairs or prevents the functions of the product. MODLOGSAML-59 Umbrella: Cross-Site Request Forgery (CSRF) in SSO Flow

            • P2 - normal priority level, must be included in the current development cycle
            • Closed
            relates to

            Story - Created by Jira Software - do not edit or delete. Issue type for a user story. MODLOGSAML-63 Implement CSRF Prevention

            • P2 - normal priority level, must be included in the current development cycle
            • Closed

            Story - Created by Jira Software - do not edit or delete. Issue type for a user story. STCOR-544 Set credentials: include on fetch to /saml/login

            • P2 - normal priority level, must be included in the current development cycle
            • Closed

            Activity

              People

                hji Hongwei Ji
                cmcnally Craig McNally
                Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:

                  TestRail: Runs

                    TestRail: Cases