Skip to content

Commit

Permalink
Add cookie to http requests to system
Browse files Browse the repository at this point in the history
https://eaflood.atlassian.net/browse/WATER-4085

When we [enabled authentication by default](DEFRA/water-abstraction-system#466) in **water-abstraction-system** we just had in mind requests proxied through or redirected from **water-abstraction-ui**.

We overlooked requests the UI was generating itself using `ServiceClient` from [water-abstraction-helpers](https://github.com/DEFRA/water-abstraction-helpers).

Doh! 🤦

So, we've inadvertently broken SROC supplementary billing and changing a billing account address because the requests we're sending to **water-abstraction-system** are being redirected to the `/signin` page.

The 'quick' fix would have been to remove auth off those routes but that would expose a vulnerability if we didn't then try to block them in `src/internal/modules/system-proxy`.

What **water0abstraction-system** needs is the cookie the UI has set once someone has been authenticated. It gets passed automatically when requests are proxied or redirected.

So, this change grabs that cookie of the [Hapi request](https://hapi.dev/api/?v=21.3.2#request) and passes it through to the HTTP request generated by **water-abstraction-helpers**. SROC supplementary billing and changing a billing account address work again!
  • Loading branch information
Cruikshanks committed Nov 1, 2023
1 parent 2e8071d commit cee877b
Showing 0 changed files with 0 additions and 0 deletions.

0 comments on commit cee877b

Please sign in to comment.