From 15f2286cb6073a83312e1e079c1a18d61c557b6d Mon Sep 17 00:00:00 2001 From: Kazuhiro Oka Date: Sun, 21 Dec 2025 05:04:30 +0900 Subject: [PATCH] =?UTF-8?q?fix:=20nonce=E3=81=8C=E7=A9=BA=E7=99=BD?= =?UTF-8?q?=E3=81=AE=E6=99=82=E3=81=AB=E3=82=A8=E3=83=A9=E3=83=BC=E3=81=8C?= =?UTF-8?q?=E5=87=BA=E3=82=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lambda/redirect_request/app.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/lambda/redirect_request/app.py b/lambda/redirect_request/app.py index c92e896..5cfabb3 100644 --- a/lambda/redirect_request/app.py +++ b/lambda/redirect_request/app.py @@ -93,16 +93,19 @@ def lambda_handler(event: APIGatewayProxyEvent, context: LambdaContext): return error_response(HTTPStatus.INTERNAL_SERVER_ERROR) try: ## (nonceとchallengeがあったら、) まずnonceを取り出してDBと突合(存在確認・期限内・未使用・nonceの対象リクエストか) - nonce: str = parse_query(event.resolved_query_string_parameters, NONCE_QUERY_KEY, expected_single_value=True) - nonce_model = DelibirdNonceTableModel.get(nonce) - if not nonce_model.is_active(): - # nonceが使用済 or 期限切れ + nonce: str = parse_query(event.resolved_query_string_parameters, NONCE_QUERY_KEY, expected_single_value=True, allow_notfound=True) + if not nonce: return protected_response(domain, request_path, "認証に失敗しました。もう一度お試しください。") - if nonce_model.domain != domain or nonce_model.slug != request_path: + nonce_model = DelibirdNonceTableModel.get(nonce) + if (not nonce_model.is_active()) or (nonce_model.domain != domain) or (nonce_model.slug != request_path): + # nonceが無効 or 使用済 or 期限切れ or ドメインやslugが不一致 return protected_response(domain, request_path, "認証に失敗しました。もう一度お試しください。") ## 問題ないnonceの場合、challengeの確認 - challenge = parse_query(event.resolved_query_string_parameters, CHALLENGE_QUERY_KEY, expected_single_value=True) + challenge = parse_query(event.resolved_query_string_parameters, CHALLENGE_QUERY_KEY, expected_single_value=True, allow_notfound=True) + if not challenge: + # challengeが無効 + return protected_response(domain, request_path, "認証に失敗しました。もう一度お試しください。") if not link.validate_challenge(nonce, challenge): logger.info(f"Invalid challenge for domain: {domain}, slug: {request_path}") nonce_model.mark_used() # not successでもok