Skip to content

Verifiable presentation CSRF protection Proof of Concept #91

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
patatoid wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Verifiable presentation CSRF protection Proof of Concept #91

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6fec092
[ssi] verifiable presentation CSRF protection
patatoid Apr 12, 2025
4cb4af2
[ssi] enable prompt redirection on post authorization
patatoid Apr 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions apps/boruta_admin/assets/src/views/Home.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,16 @@
</div>
<div class="ui segment">
<h3>Verifiable credential presentation</h3>
<a class="ui fluid blue button" target="_blank" :href="presentationUrl">Trigger example presentation with associated boruta wallet (issue example credential first)</a>
<form :action="presentationUrl" method="POST">
<input type="hidden" name="_csrf_token" :value="csrf_token" />
<input type="hidden" name="client_id" value="00000000-0000-0000-0000-000000000001" />
<input type="hidden" name="redirect_uri" :value="presentationRedirectUri" />
<input type="hidden" name="scope" value="BorutaCredentialJwtVc" />
<input type="hidden" name="response_type" value="vp_token" />
<input type="hidden" name="client_metadata" value="{}" />
<input type="hidden" name="prompt" value="login" />
<button class="ui fluid blue button" type="submit">Trigger example presentation with associated boruta wallet (issue example credential first)</button>
</form>
</div>
</div>
</div>
Expand All @@ -81,13 +90,19 @@
export default {
name: 'home',
computed: {
csrf_token () {
return window.env.CSRF_TOKEN
},
walletUrl () {
return window.env.BORUTA_OAUTH_BASE_URL +
'/accounts/wallet'
},
presentationUrl () {
return window.env.BORUTA_OAUTH_BASE_URL +
`/oauth/authorize?client_id=00000000-0000-0000-0000-000000000001&redirect_uri=${window.env.BORUTA_OAUTH_BASE_URL}/accounts/wallet/verifiable-presentation&scope=BorutaCredentialJwtVc&response_type=vp_token&client_metadata={}&state=qrm0c4xm&prompt=login`
`/oauth/authorize`
},
presentationRedirectUri () {
return `${window.env.BORUTA_OAUTH_BASE_URL}/accounts/wallet/verifiable-presentation`
},
preauthorizeUrl () {
return window.env.BORUTA_OAUTH_BASE_URL +
Expand Down
6 changes: 6 additions & 0 deletions apps/boruta_admin/lib/boruta_admin_web/templates/page/admin.html.eex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,17 @@
BORUTA_ADMIN_OAUTH_BASE_URL: '<%= System.get_env("BORUTA_ADMIN_OAUTH_BASE_URL", "http://localhost:4000") %>',
BORUTA_ADMIN_BASE_URL: '<%= System.get_env("BORUTA_ADMIN_BASE_URL", "http://localhost:4001") %>',
BORUTA_OAUTH_BASE_URL: '<%= System.get_env("BORUTA_OAUTH_BASE_URL", "http://localhost:4000") %>',
CSRF_TOKEN: '<%= Phoenix.Controller.get_csrf_token() %>'
}
</script>
<link rel="stylesheet" type="text/css" href="<%= Routes.static_path(@conn, "/assets/boruta-admin.css") %>" media="all"/>
</head>
<body>
<%= if get_flash(@conn, :error) do %>
<div class="ui error message" style="position: absolute; top: 100px; right: 1em; left: 214px; text-align: center; z-index: 1000">
<%= get_flash(@conn, :error) %>
</div>
<% end %>
<noscript>
<strong>We're sorry but boruta-admin doesn't work properly without JavaScript enabled. Please enable it to continue.</strong>
</noscript>
Expand Down
19 changes: 8 additions & 11 deletions apps/boruta_identity/lib/boruta_identity_web/router.ex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,17 +86,14 @@ defmodule BorutaIdentityWeb.Router do

@impl Plug.ErrorHandler
def handle_errors(conn, %{reason: %Plug.CSRFProtection.InvalidCSRFTokenError{message: message}}) do
with [referer] <- Plug.Conn.get_req_header(conn, "referer"),
%URI{path: path, query: query} <- URI.parse(referer) do
uri = %URI{path: path, query: query}

conn
|> Plug.Conn.fetch_session()
|> Phoenix.Controller.fetch_flash()
|> Phoenix.Controller.put_flash(:error, message)
|> Plug.Conn.put_status(:found)
|> Phoenix.Controller.redirect(to: URI.to_string(uri))
else
case Plug.Conn.get_req_header(conn, "referer") do
[referer] ->
conn
|> Plug.Conn.fetch_session()
|> Phoenix.Controller.fetch_flash()
|> Phoenix.Controller.put_flash(:error, message)
|> Plug.Conn.put_status(:found)
|> Phoenix.Controller.redirect(external: referer)
_ ->
render_error(conn, message)
end
Expand Down
30 changes: 28 additions & 2 deletions apps/boruta_web/lib/boruta_web/controllers/oauth/authorize_controller.ex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,12 +31,13 @@ defmodule BorutaWeb.Oauth.AuthorizeController do
alias BorutaIdentityWeb.Router.Helpers, as: IdentityRoutes
alias BorutaIdentityWeb.TemplateView

def authorize(%Plug.Conn{} = conn, _params) do
def authorize(%Plug.Conn{} = conn, params) do
current_user = conn.assigns[:current_user]

conn = put_unsigned_request(conn)

with {:unchanged, conn} <- prompt_redirection(conn, current_user),
with {:unchanged, conn} <- check_method(conn, params),
{:unchanged, conn} <- prompt_redirection(conn, current_user),
{:unchanged, conn} <- public_client?(conn),
{:unchanged, conn} <- verifiable_presentation?(conn),
{:unchanged, conn} <- max_age_redirection(conn, current_user),
Expand All @@ -59,11 +60,36 @@ defmodule BorutaWeb.Oauth.AuthorizeController do
{:authorize, conn} ->
conn

{:error, conn} ->
conn

{:redirected, conn} ->
conn
end
end

def check_method(%Plug.Conn{method: "POST"} = conn, %{"response_type" => "vp_token"}) do
{:unchanged, %{conn | query_params: Map.merge(conn.query_params, conn.body_params)}}
end

def check_method(%Plug.Conn{method: "GET"} = conn, %{"response_type" => "vp_token"}) do
{:error, authorize_error(conn, %Error{
status: :bad_request,
error: :invalid_request,
error_description: "Presentation requests requires POST method"
})}
end

def check_method(%Plug.Conn{method: "GET"} = conn, _params), do: {:unchanged, conn}

def check_method(%Plug.Conn{method: "POST"} = conn, %{"response_type" => response_type}) do
{:error, authorize_error(conn, %Error{
status: :bad_request,
error: :invalid_request,
error_description: "#{response_type} requests require GET method"
})}
end

def public_client?(conn) do
case conn.query_params["client_id"] do
"did:" <> _key ->
Expand Down
1 change: 1 addition & 0 deletions apps/boruta_web/lib/boruta_web/router.ex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ defmodule BorutaWeb.Router do
pipe_through([:browser, :fetch_current_user])

get("/authorize", AuthorizeController, :authorize)
post("/authorize", AuthorizeController, :authorize)
end

scope "/did", BorutaWeb do
Expand Down
2 changes: 1 addition & 1 deletion apps/boruta_web/test/boruta_web/controllers/oauth/openid_connect_test.exs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ defmodule BorutaWeb.Integration.OpenidConnectTest do
redirect_uri: redirect_uri
} do
conn =
get(
post(
conn,
Routes.authorize_path(conn, :authorize, %{
response_type: "vp_token",
Expand Down