Skip to content

Commit

Permalink
remove guard and put whole authString in S3
Browse files Browse the repository at this point in the history
  • Loading branch information
andrewHEguardian committed Aug 20, 2024
1 parent 6c347a4 commit 07460bb
Showing 1 changed file with 9 additions and 17 deletions.
26 changes: 9 additions & 17 deletions server/routes/newspaperArchive.ts
Original file line number Diff line number Diff line change
Expand Up @@ -16,38 +16,30 @@ type NewspapersResponseBody = {
};

type NewspaperArchiveConfig = {
authKey: string;
authString: string;
};

function base64(input: string) {
return Buffer.from(input).toString('base64');
}

export const newspaperArchiveConfigPromise: Promise<
const newspaperArchiveConfigPromise: Promise<
NewspaperArchiveConfig | undefined
> = s3ConfigPromise<NewspaperArchiveConfig>('authKey')('newspaper-archive');

let authKey: string;
> = s3ConfigPromise<NewspaperArchiveConfig>('authString')('newspaper-archive');

const router = Router();

router.use(withIdentity(401));

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.

router.get('/auth', async (_req: Request, res: Response) => {
const subdomain = 'theguardian';

if (authKey === undefined) {
const config = await newspaperArchiveConfigPromise;

if (config?.authKey !== undefined) {
authKey = config?.authKey;
} else {
log.error(`Missing newspaper archive auth key`);
res.status(500).send();
}
const config = await newspaperArchiveConfigPromise;
const authString = config?.authString;
if (authString === undefined) {
log.error(`Missing newspaper archive auth key`);
res.status(500).send();
}

const authHeader = base64(`${subdomain}:${authKey}`);
const authHeader = base64(`${authString}`);
const requestBody: NewspapersRequestBody = {};

const response = await fetch(
Expand Down

0 comments on commit 07460bb

Please sign in to comment.