commit 9a69d5a5efde522fccac2fcbf50052a73aaab671
author Ed Tanous <edtanous@google.com> Mon Sep 13 10:23:51 2021 -0700
committer Ed Tanous <edtanous@google.com> Mon Sep 13 14:12:24 2021 -0700
tree c408a1c2c2b2fd07d86bba7a0f1d182952de6e67
parent 97a056ac02e0f246a24d1a4353a3d24b109ccf2e

Clear UserSession in between requests

The previous commit moved userSession to possibly be a per-request
structure.  Previously, it was only a per-connection structure, so there
wasn't explicit clearing of it in between requests.  This can lead to
problems where a user remains authorized despite explicitly logging
themselves out.

Tested:
redfishtool -S Always -A Session -u root -p 0penBmc -vvvvvvvvv -r 192.168.7.2 raw GET /redfish/v1/Managers/bmc
Succeeded

Then a subsequent:
curl -vvvv --insecure  "https://192.168.7.2/redfish/v1/Managers/bmc"

Failed with 401

Signed-off-by: Ed Tanous <edtanous@google.com>
Change-Id: I5844406bd6bed628e5851d8c2f29af875adbaaff

http/http_connection.hpp

diff --git a/http/http_connection.hpp b/http/http_connection.hpp
index afd823a..815bea5 100644
--- a/http/http_connection.hpp
+++ b/http/http_connection.hpp
@@ -262,6 +262,7 @@
             }
             sslUser.resize(lastChar);
             std::string unsupportedClientId = "";
+            sessionIsFromTransport = true;
             userSession = persistent_data::SessionStore::getInstance()
                               .generateUserSession(
                                   sslUser, req->ipAddress.to_string(),
@@ -563,6 +564,7 @@
                 {
                     BMCWEB_LOG_DEBUG << "Unable to get client IP";
                 }
+                sessionIsFromTransport = false;
                 userSession = crow::authorization::authenticate(
                     req->url, ip, res, method, parser->get().base(),
                     userSession);
@@ -696,6 +698,13 @@
                                                       // newly created parser
                 buffer.consume(buffer.size());
 
+                // If the session was built from the transport, we don't need to
+                // clear it.  All other sessions are generated per request.
+                if (!sessionIsFromTransport)
+                {
+                    userSession = nullptr;
+                }
+
                 req.emplace(parser->release());
                 doReadHeaders();
             });
@@ -781,6 +790,7 @@
     std::optional<crow::Request> req;
     crow::Response res;
 
+    bool sessionIsFromTransport = false;
     std::shared_ptr<persistent_data::UserSession> userSession;
 
     std::optional<size_t> timerCancelKey;