diff --git a/device-bound-session-credentials/login.py b/device-bound-session-credentials/login.py index aa0dc32d608214..9600879af03620 100644 --- a/device-bound-session-credentials/login.py +++ b/device-bound-session-credentials/login.py @@ -21,7 +21,9 @@ def main(request, response): test_session_manager = session_manager.find_for_request(request) - header_items = ["(RS256)",'challenge="login_challenge_value"',f'path="{registration_url}"'] + header_items = ["(RS256)",f'path="{registration_url}"'] + if test_session_manager.get_allows_challenges(): + header_items.append('challenge="login_challenge_value"') authorization_value = test_session_manager.get_authorization_value() if authorization_value is not None: header_items.append(f'authorization="{authorization_value}"') diff --git a/device-bound-session-credentials/refresh_session.py b/device-bound-session-credentials/refresh_session.py index 176dccb65d995f..d88867a3d9e444 100644 --- a/device-bound-session-credentials/refresh_session.py +++ b/device-bound-session-credentials/refresh_session.py @@ -27,15 +27,15 @@ def main(request, response): if test_session_manager.get_has_custom_query_param() and 'refreshQueryParam' not in parse_qs(request.url_parts.query): return (400, response.headers, "") - session_key = test_session_manager.get_session_key(session_id) - if session_key == None: - return (400, response.headers, "") - - if test_session_manager.get_refresh_sends_challenge(): + if test_session_manager.get_allows_challenges() and test_session_manager.get_refresh_sends_challenge(): challenge = "refresh_challenge_value" if request.headers.get("Secure-Session-Response") == None: return (403, [('Secure-Session-Challenge', f'"{challenge}";id="{session_id}"')], "") + session_key = test_session_manager.get_session_key(session_id) + if session_key == None: + return (400, response.headers, "") + jwt_header, jwt_payload, verified = jwt_helper.decode_jwt(request.headers.get("Secure-Session-Response").decode('utf-8'), session_key) early_challenge = test_session_manager.get_early_challenge(session_id) diff --git a/device-bound-session-credentials/registration-no-challenge.https.html b/device-bound-session-credentials/registration-no-challenge.https.html new file mode 100644 index 00000000000000..d7ff2c09ef3b34 --- /dev/null +++ b/device-bound-session-credentials/registration-no-challenge.https.html @@ -0,0 +1,33 @@ + + + + + + + diff --git a/device-bound-session-credentials/request_early_challenge.py b/device-bound-session-credentials/request_early_challenge.py index 8b4c0f04a30e2a..80955a15e2977f 100644 --- a/device-bound-session-credentials/request_early_challenge.py +++ b/device-bound-session-credentials/request_early_challenge.py @@ -22,7 +22,7 @@ def main(request, response): challenges = [] for session_id in session_manager.find_for_request(request).get_session_ids(): early_challenge = test_session_manager.get_early_challenge(session_id) - if early_challenge is not None: + if test_session_manager.get_allows_challenges() and early_challenge is not None: challenges.append(("Secure-Session-Challenge", f'"{early_challenge}";id="{session_id}"')) if use_single_header: diff --git a/device-bound-session-credentials/session_manager.py b/device-bound-session-credentials/session_manager.py index 4374368b7db99f..c024ec361c8ce7 100644 --- a/device-bound-session-credentials/session_manager.py +++ b/device-bound-session-credentials/session_manager.py @@ -54,6 +54,7 @@ def __init__(self): self.use_empty_response = False self.registration_extra_cookies = [] self.has_custom_query_param = False + self.allows_challenges = True def next_session_id(self): return len(self.session_to_key_map) @@ -169,6 +170,10 @@ def configure_state_for_test(self, configuration): if has_custom_query_param is not None: self.has_custom_query_param = has_custom_query_param + allows_challenges = configuration.get("allowsChallenges") + if allows_challenges is not None: + self.allows_challenges = allows_challenges + def get_should_refresh_end_session(self): return self.should_refresh_end_session @@ -276,3 +281,6 @@ def get_provider_url(self): def get_provider_key(self): return self.provider_key + + def get_allows_challenges(self): + return self.allows_challenges diff --git a/device-bound-session-credentials/start_session.py b/device-bound-session-credentials/start_session.py index 5cb642ceae4110..94c813d0450c72 100644 --- a/device-bound-session-credentials/start_session.py +++ b/device-bound-session-credentials/start_session.py @@ -6,29 +6,30 @@ def main(request, response): test_session_manager = session_manager.find_for_request(request) extra_cookie_headers = test_session_manager.get_set_cookie_headers(test_session_manager.registration_extra_cookies, request) - if test_session_manager.get_registration_sends_challenge_before_instructions(): + if test_session_manager.get_allows_challenges() and test_session_manager.get_registration_sends_challenge_before_instructions(): # Only send back a challenge on the first call. test_session_manager.reset_registration_sends_challenge_before_instructions() return (403, [('Secure-Session-Challenge', '"login_challenge_value"')] + extra_cookie_headers, "") - jwt_header, jwt_payload, verified = jwt_helper.decode_jwt(request.headers.get("Secure-Session-Response").decode('utf-8')) session_id = test_session_manager.create_new_session() - test_session_manager.set_session_key(session_id, jwt_header.get('jwk')) + if test_session_manager.get_allows_challenges(): + jwt_header, jwt_payload, verified = jwt_helper.decode_jwt(request.headers.get("Secure-Session-Response").decode('utf-8')) + test_session_manager.set_session_key(session_id, jwt_header.get('jwk')) - if not verified or jwt_payload.get("jti") != "login_challenge_value": - return (400, list(response.headers) + extra_cookie_headers, "") + if not verified or jwt_payload.get("jti") != "login_challenge_value": + return (400, list(response.headers) + extra_cookie_headers, "") - if jwt_payload.get("authorization") != test_session_manager.get_authorization_value(): - return (400, list(response.headers) + extra_cookie_headers, "") + if jwt_payload.get("authorization") != test_session_manager.get_authorization_value(): + return (400, list(response.headers) + extra_cookie_headers, "") - if jwt_payload.get("sub") is not None: - return (400, list(response.headers) + extra_cookie_headers, "") + if jwt_payload.get("sub") is not None: + return (400, list(response.headers) + extra_cookie_headers, "") if test_session_manager.get_has_custom_query_param() and 'registrationQueryParam' not in parse_qs(request.url_parts.query): return (400, list(response.headers) + extra_cookie_headers, "") (code, headers, body) = test_session_manager.get_session_instructions_response(session_id, request) headers += extra_cookie_headers - if test_session_manager.get_registration_sends_challenge_with_instructions(): + if test_session_manager.get_allows_challenges() and test_session_manager.get_registration_sends_challenge_with_instructions(): headers.append(('Secure-Session-Challenge', f'"login_challenge_value";id="{session_id}"')) return (code, headers, body)