Skip to content

Commit 49c178b

Browse files
mckaragozmckaragoz
authored
Fix Credential Reset Code Can be Accessible On Client With HTTP Result (#64)
1 parent 875b30d commit 49c178b

20 files changed

Lines changed: 293 additions & 192 deletions

File tree

‎samples/blazor-server/CodeBeam.UltimateAuth.Sample.BlazorServer.EFCore/Components/Dialogs/ResetDialog.razor‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,7 @@
2525
<MudButton Color="Color.Primary" Variant="Variant.Filled" OnClick="RequestResetAsync">Request Reset</MudButton>
2626
@if (_resetRequested)
2727
{
28-
<MudText Align="Align.Center">Your reset code is: (Copy it before next step)</MudText>
29-
<MudText Align="Align.Center" Typo="Typo.h6"><b>@_resetCode</b></MudText>
28+
<MudText Align="Align.Center">Your reset code is on the server console.</MudText>
3029
<MudText Align="Align.Center"><MudLink Class="cursor-pointer" Href="@($"/reset?identifier={_identifier}")">Use Reset Code</MudLink></MudText>
3130
}
3231
</MudStack>

‎samples/blazor-server/CodeBeam.UltimateAuth.Sample.BlazorServer.EFCore/Components/Dialogs/ResetDialog.razor.cs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ namespace CodeBeam.UltimateAuth.Sample.BlazorServer.EFCore.Components.Dialogs;
99
public partial class ResetDialog
1010
{
1111
private bool _resetRequested = false;
12-
private string? _resetCode;
1312
private string? _identifier;
1413

1514
[CascadingParameter]
@@ -34,7 +33,6 @@ private async Task RequestResetAsync()
3433
return;
3534
}
3635

37-
_resetCode = result.Value.Token;
3836
_resetRequested = true;
3937
}
4038

‎samples/blazor-server/CodeBeam.UltimateAuth.Sample.BlazorServer/Components/Dialogs/ProfileDialog.razor‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,4 @@
1-
@using CodeBeam.UltimateAuth.Core.Contracts
2-
@using CodeBeam.UltimateAuth.Users.Contracts
3-
@inject IUAuthClient UAuthClient
1+
@inject IUAuthClient UAuthClient
42
@inject ISnackbar Snackbar
53
@inject IDialogService DialogService
64

‎samples/blazor-server/CodeBeam.UltimateAuth.Sample.BlazorServer/Components/Dialogs/ResetDialog.razor‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,4 @@
1-
@using CodeBeam.UltimateAuth.Core.Contracts
2-
@using CodeBeam.UltimateAuth.Credentials.Contracts
3-
@using CodeBeam.UltimateAuth.Users.Contracts
4-
@inject IUAuthClient UAuthClient
1+
@inject IUAuthClient UAuthClient
52
@inject ISnackbar Snackbar
63
@inject IDialogService DialogService
74
@inject IUAuthStateManager StateManager
@@ -15,8 +12,8 @@
1512
<DialogContent>
1613
<MudStack Class="mud-width-full">
1714
<MudAlert Severity="Severity.Info">
18-
This is a demonstration of how to implement a credential reset flow.
19-
In a production application, you should use reset token or code in email, SMS etc. verification steps.
15+
In this development sample, reset codes are written to the server console by a custom ICredentialResetNotifier.
16+
Production applications should send them through a trusted email or SMS channel.
2017
</MudAlert>
2118
<MudAlert Severity="Severity.Warning">
2219
Reset request always returns ok even with not found users due to security reasons.
@@ -25,9 +22,8 @@
2522
<MudButton Color="Color.Primary" Variant="Variant.Filled" OnClick="RequestResetAsync">Request Reset</MudButton>
2623
@if (_resetRequested)
2724
{
28-
<MudText Align="Align.Center">Your reset code is: (Copy it before next step)</MudText>
29-
<MudText Align="Align.Center" Typo="Typo.h6"><b>@_resetCode</b></MudText>
30-
<MudText Align="Align.Center"><MudLink Class="cursor-pointer" Href="@($"/reset?identifier={_identifier}")">Use Reset Code</MudLink></MudText>
25+
<MudText Align="Align.Center">Your reset code is on the server console.</MudText>
26+
<MudText Align="Align.Center"><MudLink Class="cursor-pointer" Href="@($"/reset?uauth_identifier={_identifier}")">Use Reset Code</MudLink></MudText>
3127
}
3228
</MudStack>
3329
</DialogContent>

‎samples/blazor-server/CodeBeam.UltimateAuth.Sample.BlazorServer/Components/Dialogs/ResetDialog.razor.cs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ namespace CodeBeam.UltimateAuth.Sample.BlazorServer.Components.Dialogs;
99
public partial class ResetDialog
1010
{
1111
private bool _resetRequested = false;
12-
private string? _resetCode;
1312
private string? _identifier;
1413

1514
[CascadingParameter]
@@ -34,7 +33,6 @@ private async Task RequestResetAsync()
3433
return;
3534
}
3635

37-
_resetCode = result.Value.Token;
3836
_resetRequested = true;
3937
}
4038

‎samples/blazor-server/CodeBeam.UltimateAuth.Sample.BlazorServer/Infrastructure/DevelopmentCredentialResetNotifier.cs‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
using CodeBeam.UltimateAuth.Credentials;
2+
3+
namespace CodeBeam.UltimateAuth.Sample.BlazorServer.Infrastructure;
4+
5+
internal sealed class DevelopmentCredentialResetNotifier(ILogger<DevelopmentCredentialResetNotifier> logger) : ICredentialResetNotifier
6+
{
7+
public Task NotifyAsync(CredentialResetNotification notification, CancellationToken ct = default)
8+
{
9+
ct.ThrowIfCancellationRequested();
10+
11+
logger.LogWarning(
12+
"DEVELOPMENT ONLY — Credential reset for tenant {Tenant}, " +
13+
"user {UserKey}. Code: {Code}. Expires at: {ExpiresAt}",
14+
notification.Tenant,
15+
notification.UserKey,
16+
notification.Token,
17+
notification.ExpiresAt);
18+
19+
return Task.CompletedTask;
20+
}
21+
}

‎samples/blazor-server/CodeBeam.UltimateAuth.Sample.BlazorServer/Program.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
using CodeBeam.UltimateAuth.Core.Abstractions;
44
using CodeBeam.UltimateAuth.Core.Domain;
55
using CodeBeam.UltimateAuth.Core.Infrastructure;
6+
using CodeBeam.UltimateAuth.Credentials;
67
using CodeBeam.UltimateAuth.InMemory;
78
using CodeBeam.UltimateAuth.Sample.BlazorServer.Components;
89
using CodeBeam.UltimateAuth.Sample.BlazorServer.Infrastructure;
@@ -63,6 +64,11 @@
6364

6465
builder.Services.AddUltimateAuthSampleSeed();
6566

67+
if (builder.Environment.IsDevelopment())
68+
{
69+
builder.Services.AddScoped<ICredentialResetNotifier, DevelopmentCredentialResetNotifier>();
70+
}
71+
6672
builder.Services.Configure<ForwardedHeadersOptions>(options =>
6773
{
6874
options.ForwardedHeaders =

‎samples/blazor-standalone-wasm/CodeBeam.UltimateAuth.Sample.BlazorStandaloneWasm/Components/Dialogs/ResetDialog.razor‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,7 @@
2525
<MudButton Color="Color.Primary" Variant="Variant.Filled" OnClick="RequestResetAsync">Request Reset</MudButton>
2626
@if (_resetRequested)
2727
{
28-
<MudText Align="Align.Center">Your reset code is: (Copy it before next step)</MudText>
29-
<MudText Align="Align.Center" Typo="Typo.h6"><b>@_resetCode</b></MudText>
28+
<MudText Align="Align.Center">Your reset code is on the server console.</MudText>
3029
<MudText Align="Align.Center"><MudLink Class="cursor-pointer" Href="@($"/reset?identifier={_identifier}")">Use Reset Code</MudLink></MudText>
3130
}
3231
</MudStack>

‎samples/blazor-standalone-wasm/CodeBeam.UltimateAuth.Sample.BlazorStandaloneWasm/Components/Dialogs/ResetDialog.razor.cs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ namespace CodeBeam.UltimateAuth.Sample.BlazorStandaloneWasm.Components.Dialogs;
99
public partial class ResetDialog
1010
{
1111
private bool _resetRequested = false;
12-
private string? _resetCode;
1312
private string? _identifier;
1413

1514
[CascadingParameter]
@@ -34,7 +33,6 @@ private async Task RequestResetAsync()
3433
return;
3534
}
3635

37-
_resetCode = result.Value.Token;
3836
_resetRequested = true;
3937
}
4038

‎samples/int-wasm/CodeBeam.UAuth.Sample.IntWasm/CodeBeam.UAuth.Sample.IntWasm.Client/Components/Dialogs/ResetDialog.razor‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,7 @@
2525
<MudButton Color="Color.Primary" Variant="Variant.Filled" OnClick="RequestResetAsync">Request Reset</MudButton>
2626
@if (_resetRequested)
2727
{
28-
<MudText Align="Align.Center">Your reset code is: (Copy it before next step)</MudText>
29-
<MudText Align="Align.Center" Typo="Typo.h6"><b>@_resetCode</b></MudText>
28+
<MudText Align="Align.Center">Your reset code is on the server console.</MudText>
3029
<MudText Align="Align.Center"><MudLink Class="cursor-pointer" Href="@($"/reset?identifier={_identifier}")">Use Reset Code</MudLink></MudText>
3130
}
3231
</MudStack>

0 commit comments

Comments
 (0)