gustavosantos/GTI_GERENCIADOR_FISCAL
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: bind the GTI Fiscal SSO assertion to the browser (state/nonce)

Browse Source 
/sso/fiscal now requires the state that GTI Fiscal creates when the flow
starts and signs it as the "nonce" claim; GTI Fiscal checks it against
its own one-time cookie. Without a valid state the panel sends the
browser to GTI Fiscal's /login, so the flow always starts there. This
prevents someone from pushing an assertion for their own account into
another person's browser (login CSRF).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Gustavo
2026-09-23 12:21:27 -03:00
co-authored by Claude Opus 5.5
parent 9139a1f6f3
commit 161da90e02
3 changed files with 50 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_sso.py
+23 -12
View File
@@ -14,6 +14,7 @@ from app.db import log as db_log
from app.main import app
CALLBACK = "https://gtifiscal.gtigrupo.com.br/auth/sso/callback"
STATE = "estadoDoNavegador_0123456789"
ATIVO = {"ID": 7, "NOME": "Maria Teste", "LOGIN": "maria", "SENHA_HASH": "x", "PERFIL": "PADRAO", "ATIVO": 1}
@@ -42,10 +43,11 @@ def _assercao(resposta):
def test_funcionario_ativo_recebe_formulario_com_assercao_valida(chave, monkeypatch):
resposta = _cliente(monkeypatch=monkeypatch).get("/sso/fiscal?next=/agents")
resposta = _cliente(monkeypatch=monkeypatch).get("/sso/fiscal", params={"next": "/agents", "state": STATE})
assert resposta.status_code == 200
assert f'action="{CALLBACK}"' in resposta.text and 'name="next" value="/agents"' in resposta.text
claims = jwt.decode(_assercao(resposta), chave, algorithms=["EdDSA"], audience="gti-fiscal", issuer="gti-gerenciador", options={"require": ["exp", "iat", "nbf", "iss", "aud", "sub", "jti"]})
claims = jwt.decode(_assercao(resposta), chave, algorithms=["EdDSA"], audience="gti-fiscal", issuer="gti-gerenciador", options={"require": ["exp", "iat", "nbf", "iss", "aud", "sub", "jti", "nonce"]})
assert claims["nonce"] == STATE
assert claims["sub"] == "funcionario:7" and claims["login"] == "maria" and claims["perfil"] == "PADRAO"
assert claims["exp"] - claims["iat"] == 60
assert "password" not in claims and "SENHA_HASH" not in str(claims)
@@ -58,55 +60,64 @@ def test_funcionario_ativo_recebe_formulario_com_assercao_valida(chave, monkeypa
def test_cada_emissao_tem_jti_diferente(chave, monkeypatch):
cliente = _cliente(monkeypatch=monkeypatch)
a, b = (jwt.decode(_assercao(cliente.get("/sso/fiscal")), chave, algorithms=["EdDSA"], audience="gti-fiscal") for _ in range(2))
a, b = (jwt.decode(_assercao(cliente.get("/sso/fiscal", params={"state": STATE})), chave, algorithms=["EdDSA"], audience="gti-fiscal") for _ in range(2))
assert a["jti"] != b["jti"]
def test_sem_sessao_vai_para_login_e_volta_ao_sso(chave, monkeypatch):
resposta = _cliente(logado=False, monkeypatch=monkeypatch).get("/sso/fiscal?next=/jobs", follow_redirects=False)
resposta = _cliente(logado=False, monkeypatch=monkeypatch).get("/sso/fiscal", params={"next": "/jobs", "state": STATE}, follow_redirects=False)
assert resposta.status_code == 303
destino = urlsplit(resposta.headers["location"])
assert destino.path == "/login"
assert parse_qs(destino.query)["next"] == ["/sso/fiscal?next=%2Fjobs"]
assert parse_qs(destino.query)["next"] == [f"/sso/fiscal?state={STATE}&next=%2Fjobs"]
def test_funcionario_inativo_nao_recebe_assercao(chave, monkeypatch):
resposta = _cliente(funcionario={**ATIVO, "ATIVO": 0}, monkeypatch=monkeypatch).get("/sso/fiscal", follow_redirects=False)
resposta = _cliente(funcionario={**ATIVO, "ATIVO": 0}, monkeypatch=monkeypatch).get("/sso/fiscal", params={"state": STATE}, follow_redirects=False)
assert resposta.status_code == 303 and resposta.headers["location"].startswith("/login")
assert "assertion" not in resposta.text
def test_conta_de_bootstrap_nao_usa_sso(chave, monkeypatch):
monkeypatch.setenv("ADMIN_USER", "admin")
resposta = _cliente(funcionario=None, monkeypatch=monkeypatch).get("/sso/fiscal", follow_redirects=False)
resposta = _cliente(funcionario=None, monkeypatch=monkeypatch).get("/sso/fiscal", params={"state": STATE}, follow_redirects=False)
assert resposta.status_code == 403 and "assertion" not in resposta.text
def test_http_redireciona_para_endereco_https_publico(chave, monkeypatch):
resposta = _cliente(https=False, monkeypatch=monkeypatch).get("/sso/fiscal?next=/blockers", follow_redirects=False)
resposta = _cliente(https=False, monkeypatch=monkeypatch).get("/sso/fiscal", params={"next": "/blockers", "state": STATE}, follow_redirects=False)
assert resposta.status_code == 303
assert resposta.headers["location"] == "https://gtigerenciador.gtigrupo.com.br/sso/fiscal?next=%2Fblockers"
assert resposta.headers["location"] == f"https://gtigerenciador.gtigrupo.com.br/sso/fiscal?state={STATE}&next=%2Fblockers"
@pytest.mark.parametrize("malicioso", ["//evil.com/x", "https://evil.com", "javascript:alert(1)", "/\\evil.com", "data:text/html,x", "agents", "/a\nb"])
def test_next_malicioso_vira_raiz(chave, monkeypatch, malicioso):
resposta = _cliente(monkeypatch=monkeypatch).get("/sso/fiscal", params={"next": malicioso})
resposta = _cliente(monkeypatch=monkeypatch).get("/sso/fiscal", params={"next": malicioso, "state": STATE})
assert 'name="next" value="/"' in resposta.text
def test_callback_so_https_configurado(chave, monkeypatch):
monkeypatch.setenv("SSO_FISCAL_CALLBACK_URL", "http://gtifiscal.gtigrupo.com.br/auth/sso/callback")
with pytest.raises(RuntimeError):
_cliente(monkeypatch=monkeypatch).get("/sso/fiscal")
_cliente(monkeypatch=monkeypatch).get("/sso/fiscal", params={"state": STATE})
def test_sem_configuracao_nao_emite(monkeypatch):
monkeypatch.delenv("SSO_FISCAL_CHAVE_PRIVADA", raising=False)
monkeypatch.setattr(db_log, "registrar", lambda *a, **k: None)
resposta = _cliente(monkeypatch=monkeypatch).get("/sso/fiscal")
resposta = _cliente(monkeypatch=monkeypatch).get("/sso/fiscal", params={"state": STATE})
assert resposta.status_code == 503
def test_outras_paginas_mantem_csp_padrao(chave, monkeypatch):
resposta = _cliente(monkeypatch=monkeypatch).get("/login")
assert "form-action 'self'" in resposta.headers["content-security-policy"]
@pytest.mark.parametrize("estado", [None, "curto", "com espaço e símbolos!!!!!!", "x" * 200])
def test_sem_state_valido_manda_para_o_login_do_fiscal(chave, monkeypatch, estado):
params = {"next": "/agents"} | ({"state": estado} if estado is not None else {})
resposta = _cliente(monkeypatch=monkeypatch).get("/sso/fiscal", params=params, follow_redirects=False)
assert resposta.status_code == 303
assert resposta.headers["location"] == "https://gtifiscal.gtigrupo.com.br/login?next=%2Fagents"
assert "assertion" not in resposta.text