Request hangs during redirect after authentication - php

Question

I'm developing a React/CakePHP app with a dockerized dev environment. For authentication, I'm using an OpenID Connect provider to establish the user identity, which I then encapsulate in a JWT as suggested in this article. Using the CakePHP/Authentication plugin, I redirect requests from 'https://mydomain.local/' to 'https://mydomain.local/login', which handles the OIDC logic. Once authenticated, the user is again redirected back to the site root, now with the JWT in two cookies.
My problem is that the request hangs on that final redirect. If I disable the redirect and manually navigate back to root after the cookies are set, the request works fine and my app sees the authenticated user correctly via the JWT.
For my dev environment, I'm using a Caddy container as a proxy to terminate https and a php-apache container to host the app itself. Neither server's logs show the final request occuring.
Here are the relevant portions of my code:
docker_compose.yml:
services:
caddy:
image: "abiosoft/caddy:latest"
volumes:
- ./caddy/certs:/root/certs
- ./caddy/Caddyfile:/etc/Caddyfile
- ./caddy/logs:/var/log
ports:
- "443:2015"
depends_on:
- web
web:
build:
context: .
links:
- db
volumes:
- "./src:/var/www/html/src:rw"
db:
image: mysql:latest
caddy/Caddyfile:
mydomain.local {
log /var/log/access.log
# Mkcert - https://github.com/FiloSottile/mkcert
tls /root/certs/mydomain.local.pem /root/certs/mydomain.local-key.pem
proxy / http://web:80 {
transparent
}
}
src/Application.php:
public function middleware($middlewareQueue)
{
$middlewareQueue
->add(new ErrorHandlerMiddleware(null, Configure::read('Error')))
->add(new AssetMiddleware([
'cacheTime' => Configure::read('Asset.cacheTime')
]))
->add(new RoutingMiddleware($this))
->prepend(new JwtMiddleware())
->add(new AuthenticationMiddleware($this));
return $middlewareQueue;
}
public function getAuthenticationService(ServerRequestInterface $request, ResponseInterface $response)
{
$service = new AuthenticationService([
'unauthenticatedRedirect' => Router::url(['controller' => 'Main', 'action' => 'login']),
'queryParam' => 'redirect',
]);
$service->loadIdentifier('Authentication.JwtSubject', [
'tokenField' => 'id',
'dataField' => 'sub',
'resolver' => 'Authentication.Orm',
]);
$service->loadAuthenticator('Authentication.Jwt', [
'header' => 'Authorization',
'queryParam' => 'token',
'tokenPrefix' => 'Bearer',
'algorithms' => ['HS256'],
'returnPayload' => 'false',
'secretKey' => Security::getSalt(),
]);
return $service;
}
src/Middleware/JwtMiddleware.php:
use Lcobucci\JWT\Parser;
use Lcobucci\JWT\ValidationData;
class JwtMiddleware
{
public function __invoke(RequestInterface $request, ResponseInterface $response, $next)
{
$jwt[0] = $request->getCookie('sa');
$jwt[1] = $request->getCookie('sb');
if (!empty($jwt[0]) && !empty($jwt[1])) {
$data = new ValidationData();
$data->setIssuer('mydomain');
$data->setAudience('mydomain.local');
$data->setId('mydomain');
$jwt = implode('.', $jwt);
$token = (new Parser())->parse((string) $jwt);
if ($token->validate($data)) {
$request = $request->withAddedHeader('Authorization', 'Bearer ' . $jwt);
$response = $response->withCookie((new Cookie('sa'))
->withValue($token->getPayload())
->withExpiry(new \DateTime('+30 minutes'))
->withPath('/')
->withHttpOnly(false)
);
}
}
return $next($request, $response);
}
}
src/Controller/MainController.php:
use Jumbojett\OpenIDConnectClient;
use Jumbojett\OpenIDConnectClientException;
use Lcobucci\JWT\Builder;
use Lcobucci\JWT\Signer\Hmac\Sha256;
use Lcobucci\JWT\Signer\Key;
/**
* Main Controller
*
* #property UsersTable $Users
*/
class MainController extends AppController
{
public function beforeFilter(Event $event)
{
$this->Authentication->allowUnauthenticated(['login']);
return parent::beforeFilter($event);
}
/**
* Index method
*
* #return Response|null
*/
public function index()
{
$filePath = WWW_ROOT . '/static.html';
$file = new File($filePath);
$index = $file->read();
$file->close();
return $this->response->withStringBody($index);
}
/**
* Login method
*
* #return Response|null
* #throws OpenIDConnectClientException
*/
public function login()
{
$oidc = new OpenIDConnectClient(
env('OIDC_URL'),
env('OIDC_CLIENT'),
env('OIDC_SECRET')
);
$oidc->addScope('openid');
$oidc->addScope('profile');
$oidc->authenticate();
$this->loadModel('Users');
$user = $this->Users->find()
->where(['auth_id' => $oidc->requestUserInfo('sub')])
->firstOrFail();
$signer = new Sha256();
$time = time();
$token = (new Builder())
->issuedBy('mydomain')
->permittedFor('mydomain.local')
->identifiedBy('mydomain')
->issuedAt($time)
->expiresAt($time + 3600)
->withClaim('sub', $user->id)
->getToken($signer, new Key(Security::getSalt()));
$signature = explode('.', $token->__toString())[2];
$sa = (new Cookie('sa'))
->withValue($token->getPayload())
->withExpiry(new \DateTime('+30 minutes'))
->withPath('/')
->withHttpOnly(false);
$sb = (new Cookie('sb'))
->withValue($signature)
->withPath('/')
->withHttpOnly(true);
$this->response = $this->response
->withCookieCollection(new CookieCollection([$sa, $sb]));
/**** HANG OCCURS ON THIS LINE ****/
return $this->redirect($this->Authentication->getLoginRedirect());
}
}
Any advice/suggestions greatly appreciated!!!

Answer 1

The issue was that the redirect was insecure because the app server was running HTTP (with SSL terminated at the proxy). Changing the last line of login() in MainController.php to
return $this->redirect(Router::url('/', true)); // generate full URL
and setting fullBaseUrl in config/app.php to 'https://mydomain.local' fixed the issue.