AppStd/EnvelopeGenerator
8
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Autorisierungsprüfung zu Envelope und Document Controllern hinzufügen

Browse Source 
Implementiere eine Signaturverifizierung in den EnvelopeController.Update (api/envelope/{envelopeKey}) und DocumentController.Open (api/document/{envelopeKey}) Methoden, die beide mit dem HTTPPost-Attribut gekennzeichnet sind. Diese Prüfung stellt sicher, dass nur der authentifizierte Empfänger mit einer übereinstimmenden Signatur Zugriff auf die spezifizierten Ressourcen hat oder diese ändern kann. Dies erhöht die Sicherheit, indem unautorisierten Zugriff verhindert wird.
This commit is contained in:
Developer 02 2024-04-16 13:52:09 +02:00
parent 23609d2bd7
commit 74cb595128
3 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
EnvelopeGenerator.Web/Controllers/ControllerBaseExtensions.cs
View File

@ -16,5 +16,27 @@ namespace EnvelopeGenerator.Web.Controllers
}
return null;
}
public static string? GetAuthenticatedEnvelopeUuid(this ControllerBase controller)
{
if (controller?.User?.Identity?.IsAuthenticated ?? false)
{
var envelopeUuid = controller.User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
if (!string.IsNullOrEmpty(envelopeUuid))
return envelopeUuid;
}
return null;
}
public static string? GetAuthenticatedReceiverSignature(this ControllerBase controller)
{
if (controller?.User?.Identity?.IsAuthenticated ?? false)
{
var receiverSignature = controller.User.FindFirst(ClaimTypes.Hash)?.Value;
if (!string.IsNullOrEmpty(receiverSignature))
return receiverSignature;
}
return null;
}
}
}

6
EnvelopeGenerator.Web/Controllers/DocumentController.cs
View File

@ -3,6 +3,7 @@ using EnvelopeGenerator.Common;
using EnvelopeGenerator.Web.Services;
using EnvelopeGenerator.Application.Contracts;
using Microsoft.AspNetCore.Authorization;
using EnvelopeGenerator.Application.Services;
namespace EnvelopeGenerator.Web.Controllers
{
@ -52,6 +53,11 @@ namespace EnvelopeGenerator.Web.Controllers
{
try
{
var authSignature = this.GetAuthenticatedReceiverSignature();
if (authSignature != envelopeKey.GetReceiverSignature())
return Forbid();
// Validate Envelope Key and load envelope
envelopeService.EnsureValidEnvelopeKey(envelopeKey);
EnvelopeResponse response = await envelopeService.LoadEnvelope(envelopeKey);

6
EnvelopeGenerator.Web/Controllers/EnvelopeController.cs
View File

@ -1,5 +1,6 @@

using EnvelopeGenerator.Application.Contracts;
using EnvelopeGenerator.Application.Services;
using EnvelopeGenerator.Common;
using EnvelopeGenerator.Web.Services;
using Microsoft.AspNetCore.Authorization;
@ -51,6 +52,11 @@ namespace EnvelopeGenerator.Web.Controllers
{
try
{
var authSignature = this.GetAuthenticatedReceiverSignature();
if (authSignature != envelopeKey.GetReceiverSignature())
return Forbid();
// Validate Envelope Key and load envelope
envelopeService.EnsureValidEnvelopeKey(envelopeKey);
EnvelopeResponse response = await envelopeService.LoadEnvelope(envelopeKey);