Expects client token/secret to be posted to views

Bug #674084 reported by Michael Nelson
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ratings and Reviews server
Fix Released
Low
Anthony Lenton

Bug Description

The two views: report_abuse and submit_review are handling authentication themselves by expecting the user's token/secret to be posted to the view. I don't remember why this is necessary, so wanted to document it here :)

It looks like it is only ever used to create an LP API service root using the auth details, and then call launchpad.me to get the username/displayname. If the authentication succeeds a separate Reviewer object is created using the username, otherwise HttpResponseForbidden is returned.

I *think* we should be able to use OAuth instead so that the client authenticates with the RNR app (similar to the setup that achuni added to SCA, ie. internally contacting SSO when necessary), and automatically create a new User object. Anthony?

If we can, then let's refactor those views to simply use login_required, and afaics, this would remove the need for any authenticated requests to the LP API at all?

Revision history for this message
Michael Vogt (mvo) wrote :

I added some comments on this to bug #674069. I think its fine (and a good idea) to change the server so that those two calls require a login and that the client does the login as a seperate step.

Revision history for this message
Michael Vogt (mvo) wrote :

The initial idea behind this was that the client would not send the full token but instead a sha1/nonce/timestamp pre-made http request. So that the rnr-server would actually have little or almost no powers with the token.

Revision history for this message
Michael Nelson (michael.nelson) wrote :

See bug 609025 for a solution to the same problem with SCA (authenticated API requests using an SSO token).

tags: added: proj-rnr-10.12
Changed in rnr-server:
assignee: nobody → Anthony Lenton (elachuni)
status: New → Fix Committed
Changed in rnr-server:
importance: Undecided → Low
tags: added: kb-defect
tags: added: qa-untestable
Changed in rnr-server:
status: Fix Committed → Fix Released
Changed in rnr-server:
milestone: none → 10.12
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.