Commit Graph

16 Commits

Author SHA1 Message Date
Eric Chiang
72a431dd4b {web,server}: use html/template and reduce use of auth request ID
Switch from using "text/template" to "html/template", which provides
basic XSS preventions. We haven't identified any particular place
where unsanitized user data is rendered to the frontend. This is
just a preventative step.

At the same time, make more templates take pure URL instead of
forming an URL themselves using an "authReqID" argument. This will
help us stop using the auth req ID in certain places, preventing
garbage collection from killing login flows that wait too long at
the login screen.

Also increase the login session window (time between initial
redirect and the user logging in) from 30 minutes to 24 hours,
and display a more helpful error message when the session expires.

How to test:

1. Spin up dex and example with examples/config-dev.yaml.
2. Login through both the password prompt and the direct redirect.
3. Edit examples/config-dev.yaml removing the "connectors" section.
4. Ensure you can still login with a password.

(email/password is "admin@example.com" and "password")
2017-02-02 11:11:00 -08:00
rithu john
75aa1c67ce server: add error HTML templates with error description. 2016-12-16 10:42:54 -08:00
Amruta Chitnis
b7439d1a75 Address PR comments 2016-12-01 14:06:08 -08:00
Amruta Chitnis
577d1af029 web: Updates classes in templates 2016-12-01 13:41:56 -08:00
Amruta Chitnis
2bc690591e web: Updates css 2016-12-01 13:41:50 -08:00
Amruta Chitnis
ea75973547 web: Adds tectonic specific files 2016-12-01 13:41:45 -08:00
Amruta Chitnis
0dc7870f39 web: Adds svg files for icons 2016-12-01 13:41:33 -08:00
Eric Chiang
5e61d5fe83 Revert "Merge pull request #714 from amrutac/refactor-css"
This reverts commit 4d88eabb50, reversing
changes made to b38d355202.
2016-12-01 13:18:32 -08:00
Amruta Chitnis
170727454d web: Updates classes in templates 2016-12-01 12:18:12 -08:00
Amruta Chitnis
fabdae8e71 web: Updates css 2016-12-01 12:17:48 -08:00
Amruta Chitnis
da872ecd35 web: Adds tectonic specific files 2016-12-01 12:16:18 -08:00
Amruta Chitnis
513525c0ab web: Adds svg files for icons 2016-12-01 12:15:47 -08:00
Eric Chiang
391dc51c13 *: add theme based frontend configuration
This PR reworks the web layout so static files can be provided and
a "themes" directory to allow a certain degree of control over logos,
styles, etc.

This PR does NOT add general support for frontend customization,
only enough to allow us to start exploring theming internally.
The dex binary also must now be run from the root directory since
templates are no longer "compiled into" the binary.

The docker image has been updated with frontend assets.
2016-11-30 17:20:21 -08:00
Eric Chiang
7c2289e0de *: rename internally used "state" form value to "req"
"state" means something specific to OAuth2 and SAML so we don't
want to confuse developers who are working on this.

Also don't use "session" which could easily be confused with HTTP
cookies.
2016-10-27 10:26:01 -07:00
Eric Chiang
7084a801d7 *: port oob template 2016-10-19 12:45:17 -07:00
Eric Chiang
91ff8a16cd web/templates: port templates from v1 2016-09-05 17:25:12 -07:00