{"action":"created","issue":{"url":"https://api.github.com/repos/liqd/adhocracy3/issues/2259","repository_url":"https://api.github.com/repos/liqd/adhocracy3","labels_url":"https://api.github.com/repos/liqd/adhocracy3/issues/2259/labels{/name}","comments_url":"https://api.github.com/repos/liqd/adhocracy3/issues/2259/comments","events_url":"https://api.github.com/repos/liqd/adhocracy3/issues/2259/events","html_url":"https://github.com/liqd/adhocracy3/pull/2259","id":150937298,"number":2259,"title":"add basic admin interface (sdi) with SingleSignOn (SSO) adhocracy frontend","user":{"login":"joka","id":353982,"avatar_url":"https://avatars.githubusercontent.com/u/353982?v=3","gravatar_id":"","url":"https://api.github.com/users/joka","html_url":"https://github.com/joka","followers_url":"https://api.github.com/users/joka/followers","following_url":"https://api.github.com/users/joka/following{/other_user}","gists_url":"https://api.github.com/users/joka/gists{/gist_id}","starred_url":"https://api.github.com/users/joka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joka/subscriptions","organizations_url":"https://api.github.com/users/joka/orgs","repos_url":"https://api.github.com/users/joka/repos","events_url":"https://api.github.com/users/joka/events{/privacy}","received_events_url":"https://api.github.com/users/joka/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/liqd/adhocracy3/labels/backend","name":"backend","color":"bfe5bf"},{"url":"https://api.github.com/repos/liqd/adhocracy3/labels/frontend","name":"frontend","color":"bfd4f2"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":17,"created_at":"2016-04-25T17:53:16Z","updated_at":"2016-05-04T12:15:52Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/liqd/adhocracy3/pulls/2259","html_url":"https://github.com/liqd/adhocracy3/pull/2259","diff_url":"https://github.com/liqd/adhocracy3/pull/2259.diff","patch_url":"https://github.com/liqd/adhocracy3/pull/2259.patch"},"body":"#Backend Extensions:\r\n--------------------------\r\n\r\n- /manage shows basic SDI (contents and services tab) when loged in as god\r\n\r\nBackend internal Changes:  \r\n----------------------------------\r\n\r\n- add request property 'user' ,  rm utils.get_user,\r\n\r\nBackend API Changes:   Token Header and Cookie based authententication \r\n-----------------------------------------------------------------------------------------------\r\n\r\nWe cannot use the existing Token header authentication for the sdi, because its based on  ServerSide Rendering. Possible solution are:\r\n\r\n1. addional server to run the sdi:\r\n\r\n      ++ easy\r\n      -- even more complicated deployment\r\n      -- no SSO frontend and sdi\r\n\r\n2. Cookie based authentication for frontend and sdi\r\n\r\n     ++ better security possible , see https://www.owasp.org/index.php/HTML5_Security_Cheat_Sheet#Local_Storage and http://www.stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/\r\nhttp://blog.ionic.io/angularjs-authentication/\r\n     ++ SSO frontend and sdi\r\n     -- difficult CORS setup\r\n     -- frontend changes needed\r\n\r\n3. Token Header and Cookie based authentication\r\n\r\n    ++ easy\r\n    ++ SSO frontend and sdi\r\n    -- less security (more ways to attack) \r\n\r\nI choosed 3. in this pull request.  \r\n\r\nIf the frontend logges in,  the authentication cookies for the SDI\r\nare also set (HttpOnly cookies).  To make this work the frontend does XHR request \"withCredentials\" now and the CORS header Accepted-Origin is dynamically set to the request origin header.\r\n\r\nIf the user goes to the sdi ( /manage) he is already logged in. If he clickes \"logout\" he is logout from sdi, but still logged in with the frontend.\r\nTo prevent CSRF attacks the cookie authentication is only used when the user goes to /manage and\r\nfor every post request to the sdi a csrf-token is checked. A possible addition would be to validate the origin and refere headers of requests to the sdi.\r\n\r\nTODO:\r\n\r\n* [ ] check if its safe to set authentication cookies and CORS header\r\n* [x] add secure flag to cookies if https is used\r\n* [ ] check frontend changes to store browser cookies when logging in\r\n* [x] add functional test\r\n* [x] authentication Cookie must not be shown in log files\r\n* [x] fix test coverage\r\n"},"comment":{"url":"https://api.github.com/repos/liqd/adhocracy3/issues/comments/216842476","html_url":"https://github.com/liqd/adhocracy3/pull/2259#issuecomment-216842476","issue_url":"https://api.github.com/repos/liqd/adhocracy3/issues/2259","id":216842476,"user":{"login":"joka","id":353982,"avatar_url":"https://avatars.githubusercontent.com/u/353982?v=3","gravatar_id":"","url":"https://api.github.com/users/joka","html_url":"https://github.com/joka","followers_url":"https://api.github.com/users/joka/followers","following_url":"https://api.github.com/users/joka/following{/other_user}","gists_url":"https://api.github.com/users/joka/gists{/gist_id}","starred_url":"https://api.github.com/users/joka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joka/subscriptions","organizations_url":"https://api.github.com/users/joka/orgs","repos_url":"https://api.github.com/users/joka/repos","events_url":"https://api.github.com/users/joka/events{/privacy}","received_events_url":"https://api.github.com/users/joka/received_events","type":"User","site_admin":false},"created_at":"2016-05-04T12:15:52Z","updated_at":"2016-05-04T12:15:52Z","body":"Sidenote: the cores header are also causing preflight request for all URLs used by the frontend, thats pretty anoying."}}