GustavoandClaude Opus 5.5
9139a1f6f3
The sidebar "Fiscal" entry now goes to /sso/fiscal. For a logged-in, active employee the panel issues a JWT signed with Ed25519 (the private key exists only here; GTI Fiscal only holds the public key): iss/aud fixed, sub = funcionario:<ID> (LOGIN is editable), 60 s lifetime, unique jti that GTI Fiscal records to reject replays. No password, hash or panel cookie leaves the panel. The assertion is delivered in an auto-submitted POST, never in the URL, so it stays out of proxy logs, browser history and Referer. That page carries its own CSP allowing form-action only to the configured callback origin; the security-headers middleware now keeps a route-defined CSP. Without a session the employee goes through the normal login and comes back; plain HTTP is redirected to the public HTTPS address; `next` only accepts a relative path; the .env bootstrap account (no stable ID) is refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
25 lines
1.1 KiB
HTML
25 lines
1.1 KiB
HTML
<!-- app/templates/sso_fiscal.html — entrega a asserção ao Fiscal por POST (nunca na URL) -->
|
|
<!DOCTYPE html>
|
|
<html lang="pt-BR">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<meta name="referrer" content="no-referrer">
|
|
<title>Abrindo o GTI Fiscal…</title>
|
|
<style>
|
|
body { font-family: system-ui, -apple-system, "Segoe UI", sans-serif; margin: 0; min-height: 100vh; display: grid; place-items: center; background: #121214; color: #f4f4f5; }
|
|
p { color: #9a9aa2; }
|
|
button { padding: 10px 16px; border-radius: 8px; border: 0; background: #F5821F; color: #17171a; font-weight: 700; cursor: pointer; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<form method="post" action="{{ acao }}" id="sso-fiscal">
|
|
<input type="hidden" name="assertion" value="{{ assercao }}">
|
|
<input type="hidden" name="next" value="{{ proximo }}">
|
|
<p>Abrindo o GTI Fiscal…</p>
|
|
<noscript><button type="submit">Continuar</button></noscript>
|
|
</form>
|
|
<script>document.getElementById("sso-fiscal").submit();</script>
|
|
</body>
|
|
</html>
|