search

CiscoSystems / curvature

A visual interactive cloud provisioning system
Other
34 stars 18 forks source link

Add token validation to curvature. #3

Open robertstarmer opened 10 years ago

robertstarmer commented 10 years ago

I know we've seen something like this before:

<!DOCTYPE html>

Action Controller: Exception caught

ActiveRecord::RecordNotFound in DeployedContainersController#index 

Couldn't find Storage without an ID

Rails.root: /opt/donabe

Application Trace | Framework Trace | Full Trace 
app/controllers/deployed_containers_controller.rb:33:in `rescue in index'
app/controllers/deployed_containers_controller.rb:23:in `index'

Request

Parameters: 

{"tenant_id"=>"3241cdb288924765be00e36c8a0840ee",
 "format"=>"json",
 "deployed_container"=>{}}

Show session dump

Show env dump

Response

Headers: 

None

johndavidge commented 10 years ago

What is happening when you see this error? It looks like Curvature is sending Donabe a request for a Deployed Container without supplying an ID. Try re-initializing the Curvature DB with:

rake db:drop rake db:create rake db:migrate

If that doesn't work try it for Donabe as well.

robertstarmer commented 10 years ago

Had to really wipe out cookies for the instance to get it to recover. (after resetting the db for both apps, and restarting both services).

R

On Oct 17, 2013, at 10:33 AM, johndavidge notifications@github.com<mailto:notifications@github.com> wrote:

rake db:drop rake db:create rake db:migrate

johndavidge commented 10 years ago

Further investigation lead me to discover that if Curvature sends Donabe a request for the list of Deployed Containers but didn't send a valid X-Auth-Token in the message header Donabe would attempt to fall back onto a deprecated cookie-based authentication system. This has now been removed and replaced with an HTTP 401 response. This does not however explain why Curvature is sending bad tokens in the first place.

robertstarmer commented 10 years ago

Bad tokens may be delivered from expired sessions, as from a browser that recovers after having been asleep for a period of time.

R

Sent from a device

On Oct 18, 2013, at 9:06 AM, "johndavidge" notifications@github.com<mailto:notifications@github.com> wrote:

Further investigation lead me to discovered that if Curvature sends Donabe a request for the list of Deployed Containers but didn't send a valid X-Auth-Token in the message header Donabe would attempt to fall back onto a deprecated cookie-based authentication system. This has now been removed and replaced with an HTTP 401 response. This does not however explain why Curvature is sending bad tokens in the first place.

— Reply to this email directly or view it on GitHubhttps://github.com/CiscoSystems/curvature/issues/3#issuecomment-26598122.