search

demisto / demisto-py

Demisto Client for Python
Apache License 2.0
70 stars 41 forks source link

Naïve Cookie assumption #68

Closed BGarber42 closed 1 year ago

BGarber42 commented 3 years ago

Describe the bug Code assumes the CSRF token is the first cookie returned by the server, this breaks if there's any sort of LB or caching in front of Demisto

To Reproduce Steps to reproduce the behavior:

  1. Proxy Demisto through anything that sets a cookie
  2. See error

Expected behavior Script can log in successfully

Error HTTP response body: {"id":"forbidden","status":403,"title":"Forbidden","detail":"Issue with CSRF code","error":"http: named cookie not present","encrypted":false,"multires":null}

BGarber42 commented 3 years ago

To expand, if you use an AWS ALB, it sets it's own cookies for sessions. The code will just look at the first Set-Cookie header and try to use string manipulation to extract out the value rather than use builtins

jochman commented 3 years ago

Hey @BGarber42, I'm taking care of the issue. Anyway, I suggest you to move to API-Key authentication instead of basic auth.

BGarber42 commented 3 years ago

If I remember correctly, some of the endpoints we were hitting with generic_request_func throw errors if trying to use an API key rather than credentials. I can see if I can find the actual error.

jochman commented 3 years ago

I'll be happy to hear about it! On which endpoints and the error message.