Skip to content

Commit 8873d55

Browse files
jioojioo
committed
Updated Security
-- WEB API -- -Added Csrf validation on unauthorized endpoints -Added XsrfTokenController -- WEB CLIENT -- -Added Xsrf service -Updated all @click with .prevent extension -Updated logout redirect url -Set up xsrf service in api-service
1 parent 2834ec2 commit 8873d55

21 files changed

+108
-53
lines changed

‎WebApi/Controllers/AccountsController.cs‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
namespace WebApi.Controllers
1717
{
1818
[Authorize(Roles = "Admin")]
19-
[Route("api/[controller]")]
19+
[Route("api/[controller]"), ApiController]
2020
public class AccountsController : ControllerBase
2121
{
2222
private readonly UserManager<User> _manager;
@@ -35,7 +35,7 @@ public AccountsController(
3535

3636
// POST: api/accounts/register
3737
[HttpPost("register")]
38-
public async Task<IActionResult> Register([FromBody]RegisterViewModel model)
38+
public async Task<IActionResult> Register(RegisterViewModel model)
3939
{
4040
var isCardExist = await _service.isCardExist(Guid.Empty, model.CardNo);
4141
if (isCardExist)
@@ -64,7 +64,8 @@ public async Task<IActionResult> Register([FromBody]RegisterViewModel model)
6464
Identity = user,
6565
FullName = model.FullName,
6666
CardNo = model.CardNo,
67-
Position = model.Position
67+
Position = model.Position,
68+
Status = Status.Active
6869
});
6970
return new OkObjectResult(syncResult);
7071
}

‎WebApi/Controllers/AuthController.cs‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
namespace WebApi.Controllers
1414
{
15-
[Route("api/[controller]")]
15+
[Route("api/[controller]"), ApiController]
1616
public class AuthController : ControllerBase
1717
{
1818
private readonly UserManager<User> _userManager;
@@ -37,7 +37,8 @@ public AuthController(
3737

3838
// POST api/auth/login
3939
[HttpPost("login")]
40-
public async Task<IActionResult> Login([FromBody]LoginViewModel model)
40+
[ValidateAntiForgeryToken]
41+
public async Task<IActionResult> Login(LoginViewModel model)
4142
{
4243
// Check if password is correct
4344
var user = await _userManager.FindByNameAsync(model.UserName);
@@ -59,24 +60,24 @@ public async Task<IActionResult> Login([FromBody]LoginViewModel model)
5960
}
6061

6162
// POST api/auth/check
62-
[HttpGet("check")]
6363
[Authorize]
64+
[HttpGet("check")]
6465
public IActionResult Check()
6566
{
6667
return Ok();
6768
}
6869

6970
// POST api/auth/is-admin
70-
[HttpGet("is-admin")]
7171
[Authorize(Roles = "Admin")]
72+
[HttpGet("is-admin")]
7273
public IActionResult IsAdmin()
7374
{
7475
return Ok();
7576
}
7677

7778
// POST api/auth/is-employee
78-
[HttpGet("is-employee")]
7979
[Authorize(Roles = "Employee")]
80+
[HttpGet("is-employee")]
8081
public IActionResult IsEmployee()
8182
{
8283
return Ok();

‎WebApi/Controllers/ConfigController.cs‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,7 @@
1616
namespace WebApi.Controllers
1717
{
1818
[Authorize(Roles = "Admin")]
19-
[Route("api/[controller]")]
20-
[ApiController]
19+
[Route("api/[controller]"), ApiController]
2120
public class ConfigController : ControllerBase
2221
{
2322
private readonly IConfigService _service;

‎WebApi/Controllers/EmployeeController.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,7 @@
1616
namespace WebApi.Controllers
1717
{
1818
[Authorize(Roles = "Admin")]
19-
[Route("api/[controller]")]
20-
[ApiController]
19+
[Route("api/[controller]"), ApiController]
2120
public class EmployeeController : ControllerBase
2221
{
2322
private readonly IEmployeeService _service;
@@ -46,6 +45,7 @@ public async Task<IActionResult> Find(Guid id)
4645

4746
// PUT api/employee
4847
[HttpPut]
48+
[AllowAnonymous]
4949
public async Task<IActionResult> Update(EmployeeViewModel model)
5050
{
5151
// Check if Card No already exist

‎WebApi/Controllers/LogController.cs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,7 @@
1818
namespace WebApi.Controllers
1919
{
2020
[Authorize]
21-
[Route("api/[controller]")]
22-
[ApiController]
21+
[Route("api/[controller]"), ApiController]
2322
public class LogController : ControllerBase
2423
{
2524
private JsonSerializerSettings settings = new JsonSerializerSettings { Formatting = Formatting.Indented, ReferenceLoopHandling = ReferenceLoopHandling.Ignore };
@@ -40,9 +39,10 @@ public async Task<IActionResult> Index()
4039
}
4140

4241
// POST api/log
43-
[HttpPost]
4442
[AllowAnonymous]
45-
public async Task<IActionResult> Log([FromBody] LogInOutViewModel model)
43+
[ValidateAntiForgeryToken]
44+
[HttpPost]
45+
public async Task<IActionResult> Log(LogInOutViewModel model)
4646
{
4747
// Validate card no. & password
4848
var user = await _service.ValidateTimeInOutCredentials(model);
@@ -54,9 +54,9 @@ public async Task<IActionResult> Log([FromBody] LogInOutViewModel model)
5454
}
5555

5656
// PUT api/log
57-
[HttpPut]
5857
[Authorize(Roles = "Admin")]
59-
public async Task<IActionResult> Update([FromBody]LogEditViewModel model)
58+
[HttpPut]
59+
public async Task<IActionResult> Update(LogEditViewModel model)
6060
{
6161
return new OkObjectResult(await _service.UpdateAsync(model));
6262
}

‎WebApi/Controllers/XsrfTokenController.cs‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
using Microsoft.AspNetCore.Antiforgery;
2+
using Microsoft.AspNetCore.Mvc;
3+
4+
namespace WebApi.Controllers
5+
{
6+
[Route("api/[controller]"), ApiController]
7+
public class XsrfTokenController : ControllerBase
8+
{
9+
private readonly IAntiforgery _antiforgery;
10+
11+
public XsrfTokenController(IAntiforgery antiforgery)
12+
{
13+
_antiforgery = antiforgery;
14+
}
15+
16+
[HttpGet]
17+
public IActionResult Get()
18+
{
19+
var tokens = _antiforgery.GetAndStoreTokens(HttpContext);
20+
21+
return new ObjectResult(new {
22+
token = tokens.RequestToken,
23+
tokenName = tokens.HeaderName
24+
});
25+
}
26+
}
27+
}

‎WebApi/Services/LogService.cs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ public async Task<IList<LogViewModel>> GetAllAsync()
4242
return await _repoLog.Context.Query()
4343
.Where(m => m.Deleted == null)
4444
.OrderByDescending(m => m.Created)
45-
.Include(m => m.Employee)
4645
.Select(m => new LogViewModel
4746
{
4847
Id = m.Id,
@@ -71,7 +70,6 @@ public async Task<LogViewModel> FindAsync(Guid id)
7170
{
7271
return await _repoLog.Context.Query()
7372
.Where(m => m.Id == id)
74-
.Include(m => m.Employee)
7573
.Select(m => new LogViewModel
7674
{
7775
Id = m.Id,

‎WebApi/Startup.cs‎

Lines changed: 24 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
using WebApi.Repositories;
3030
using WebApi.Helpers;
3131
using Hubs.BroadcastHub;
32+
using Microsoft.AspNetCore.Antiforgery;
3233

3334
namespace WebApi
3435
{
@@ -106,28 +107,29 @@ public void ConfigureServices(IServiceCollection services)
106107
});
107108

108109
// Add Identity
109-
var builder = services.AddIdentityCore<User>(o =>
110+
services.AddIdentityCore<User>(o =>
110111
{
111-
// configure identity options
112+
// Configure identity options
112113
o.Password.RequireDigit = false;
113114
o.Password.RequireLowercase = false;
114115
o.Password.RequireUppercase = false;
115116
o.Password.RequireNonAlphanumeric = false;
116117
o.Password.RequiredLength = 6;
117-
}).AddRoles<IdentityRole>();
118-
builder = new IdentityBuilder(builder.UserType, typeof(IdentityRole), builder.Services);
119-
builder.AddEntityFrameworkStores<ApplicationDbContext>().AddDefaultTokenProviders();
118+
})
119+
.AddRoles<IdentityRole>()
120+
.AddEntityFrameworkStores<ApplicationDbContext>()
121+
.AddDefaultTokenProviders();
120122

121123
services.AddAutoMapper();
122-
services.AddMvc(options =>
123-
{
124-
// Add automatic model validation
125-
options.Filters.Add(typeof(ValidateModelStateAttribute));
126-
// options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute());
127-
})
128-
.SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
124+
services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
129125

130-
// services.AddAntiforgery(options => options.HeaderName = "X-XSRF-TOKEN");
126+
// X-CSRF-Token
127+
services.AddAntiforgery(options=>
128+
{
129+
options.HeaderName = "X-XSRF-Token";
130+
options.SuppressXFrameOptionsHeader = false;
131+
});
132+
131133
services.AddCors();
132134
services.AddSignalR();
133135

@@ -192,6 +194,7 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env, IService
192194
});
193195
});
194196

197+
// Enable CORS
195198
app.UseCors(builder =>
196199
builder.AllowAnyOrigin()
197200
.AllowAnyHeader()
@@ -201,25 +204,32 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env, IService
201204

202205
app.UseAuthentication();
203206
app.UseMvc();
207+
204208
app.Use(async (context, next) =>
205209
{
206-
await next();
210+
await next();
211+
207212
if (context.Response.StatusCode == 404 && !Path.HasExtension(context.Request.Path.Value))
208213
{
209214
context.Request.Path = "/index.html";
210215
await next();
211216
}
212217
});
213218

219+
// Single Page Application set up
214220
app.UseDefaultFiles();
215221
app.UseStaticFiles();
216222

223+
// Set up SignalR Hubs
217224
app.UseSignalR(routes =>
218225
{
219226
routes.MapHub<BroadcastHub>("/broadcast");
220227
});
221228

229+
// Identity user seed
222230
CreateUsersAndRoles(services).Wait();
231+
232+
// Default Attendance Configuration
223233
AttendanceConfiguration(services).Wait();
224234
}
225235

‎WebClient/index.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<head>
44
<meta charset="utf-8">
55
<meta name="viewport" content="width=device-width,initial-scale=1.0">
6-
<title>BDF Attendance System</title>
6+
<title>Attendance System</title>
77
</head>
88
<body>
99
<div id="app"></div>

‎WebClient/src/components/change-password.vue‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
</v-card-text>
1515
<v-card-actions>
1616
<v-spacer></v-spacer>
17-
<v-btn color="orange" :loading="isLoading" @click="changePassword" >Update</v-btn>
17+
<v-btn color="orange" :loading="isLoading" @click.prevent="changePassword" >Update</v-btn>
1818
</v-card-actions>
1919
</v-card>
2020
</template>

0 commit comments

Comments
 (0)