This commit is contained in:
2025-03-18 16:50:08 +01:00
parent 4eaf88e2f1
commit 0c536445a1

View File

@@ -56,6 +56,7 @@ def all_routes(path):
app.logger.info('Requested %s', path)
if path.startswith('sessionstart/'):
# We got redirected back from the mothership, lets see if the secret we got is really known
# The path we should have gotten back is of the format:
# /sessionstart/SEKRIT_TOKEN/<the_url_to_redirect_on_here_afterwards>
secret_and_redirect = path.split('sessionstart/')[1]
@@ -64,6 +65,7 @@ def all_routes(path):
redirect_path = '/'
if len(secret_redirect_split) > 1:
redirect_path = '/'.join(secret_redirect_split[1:])
# Ask the mothership if the secret is known to them, to prevent someone from just making up a URL
# Mothership will invalidate this secret token upon handling this request to prevent replay
try:
@@ -98,9 +100,8 @@ def all_routes(path):
# Our current URL, to which mothership will redirect back including a sessionstart
original_url = f'{request.host_url}{path}'
callback_url = f'{request.host_url}sessionstart/'
app.logger.info('Redirecting to mothership with %s', original_url)
# No session yet, redirect to mothership
app.logger.debug('%s/%s', MOTHERSHIP, original_url)
app.logger.info('Redirecting to mothership with %s', original_url)
return redirect(f'{MOTHERSHIP}/login?redirect={original_url}&callback={callback_url}')
file_path = os.path.join(SERVE_DIR, path)
@@ -111,10 +112,6 @@ def all_routes(path):
else:
app.logger.error('File not found: %s', str(file_path))
return 'Sorry, 404'
# if text.startswith('favicon'):
# print('hoi')
# else:
# return redirect(url_for('404_error'))
@app.route('/')