fix the security flaw that allowed registration without token even if token at startup was assigned
@@ -1125,7 +1125,10 @@ class Server:
if not isinstance(service_management_port, int):
raise web.HTTPBadRequest(reason='Service management port can be a positive integer only')
- # If token then check single use token verification; if bad then return 4XX
+ if token is None and ServiceRegistry.getStartupToken(service_name) is not None:
+ raise web.HTTPBadRequest(body=json.dumps({"message": 'Required registration token is missing.'}))
+
+ # If token, then check single use token verification; if bad then return 4XX
if token is not None:
if not isinstance(token, str):
msg = 'Token can be a string only'
@@ -1796,6 +1799,12 @@ class Server:
msg = "Authorization header is missing"
raise web.HTTPBadRequest(reason=msg, body=json.dumps({"error": msg}))
+ if not "Bearer " in auth_header:
+ msg = "Invalid Authorization token"
+ # FIXME: raise UNAUTHORISED here and among other places
+ # and JSON body to have message key
+ raise web.HTTPBadRequest(reason=msg, body=json.dumps({"error": msg}))
+
parts = auth_header.split("Bearer ")
if len(parts) != 2:
msg = "bearer token is missing"
