CDPT-887 auth with nginx cache #612

EarthlingDavey · 2024-07-26T16:35:31Z

This PR:

IPs

Moves the allowed IP matching from app level to nginx.
Utilises the nginx_geo module for assigning a value to a matching IP ranange. i.e. 1 for allow and 2 for deprecated.
Uses an nginx- init script to populate a config file from the IPS_FORMATTED env var.
A header HTTP_X_IP_GROUP is available to our application incase we want to show a deprecation warning. If we want to do this, we may need to add $geo to the fastcgi_cache_key - or fetch the deprecation warning via an un-cached url like ajax.php

Oauth

Creates an /auth/verify endpoint that returns a 200 / 401 status, depending on a valid JWT. This endpoint doesn't load WordPress.
Creates a dynamic 401 page that will redirect to login, on 5 failed attempts the 401 page is shown.

Caching

Care has been taken to only serve cached results if the user is allowed.
Previously cached hits were served to non-auth'd users, this has been fixed.

public/app/mu-plugins/moj-auth/moj-auth.php

deploy/config/local/nginx/server.conf

public/app/mu-plugins/moj-auth/401.php

public/app/mu-plugins/moj-auth/traits/jwt.php

public/app/mu-plugins/moj-auth/templates/401-redirect.php

deploy/config/local/nginx/server.conf

EarthlingDavey · 2024-07-29T10:38:01Z

public/app/themes/clarity/src/globals/js/auth-heartbeat.js

+export default (function ($) {
+    // Sent a request to the heartbeat endpoint, this will refresh the oauth token.
+    setInterval(function(){
+        $.get( "/auth/heartbeat" )


If 401, modal - your session has ended, please login again for security purposes. Blur bg. Redirect in 5s.

The js can just reload the current page.

Change to 10s

deploy/config/local/nginx/server.conf

* Updates from the review of #612 * Update auth-heartbeat.js * Update moj-auth.php * Update info.php * Fix comments and log messages

EarthlingDavey added 9 commits July 24, 2024 11:03

WIP

d772a70

non-authd users are not served cache

3d7962f

auth subrequest working and auth endpoints always allowed

5ef58f9

Geo IP working with hardcoded IP ranges

ff3c680

Move traits to folder, add dynamic 401 page

4d24576

Add heartbeat request

586231b

Cleanup custom JWT properties. Add heartbeat endpoint.

ede507b

Add IPS_FORMATTED to develop

9848cae

Remove previous IP_RANGES, use nginx init script to populate conf file.

a37f3a6

github-advanced-security bot found potential problems Jul 26, 2024

View reviewed changes

public/app/mu-plugins/moj-auth/moj-auth.php Dismissed Show dismissed Hide dismissed