diff --git a/staticshield.py b/staticshield.py index 4d9d759..8693eec 100644 --- a/staticshield.py +++ b/staticshield.py @@ -56,6 +56,7 @@ def all_routes(path): app.logger.info('Requested %s', path) if path.startswith('sessionstart/'): # We got redirected back from the mothership, lets see if the secret we got is really known + # The path we should have gotten back is of the format: # /sessionstart/SEKRIT_TOKEN/ secret_and_redirect = path.split('sessionstart/')[1] @@ -64,6 +65,7 @@ def all_routes(path): redirect_path = '/' if len(secret_redirect_split) > 1: redirect_path = '/'.join(secret_redirect_split[1:]) + # Ask the mothership if the secret is known to them, to prevent someone from just making up a URL # Mothership will invalidate this secret token upon handling this request to prevent replay try: @@ -98,9 +100,8 @@ def all_routes(path): # Our current URL, to which mothership will redirect back including a sessionstart original_url = f'{request.host_url}{path}' callback_url = f'{request.host_url}sessionstart/' - app.logger.info('Redirecting to mothership with %s', original_url) # No session yet, redirect to mothership - app.logger.debug('%s/%s', MOTHERSHIP, original_url) + app.logger.info('Redirecting to mothership with %s', original_url) return redirect(f'{MOTHERSHIP}/login?redirect={original_url}&callback={callback_url}') file_path = os.path.join(SERVE_DIR, path) @@ -111,10 +112,6 @@ def all_routes(path): else: app.logger.error('File not found: %s', str(file_path)) return 'Sorry, 404' - # if text.startswith('favicon'): - # print('hoi') - # else: - # return redirect(url_for('404_error')) @app.route('/')