From 25da71cb68a813b2c79dd1762e469de6f01ad351 Mon Sep 17 00:00:00 2001 From: Alisha Zaman Date: Sun, 8 Feb 2026 15:02:12 -0500 Subject: [PATCH] 740: Fixed diff host email verif success 740: Updated valid origin type --- .../codebloom/api/auth/AuthController.java | 8 +++++ .../api/auth/AuthControllerTest.java | 29 +++++++++++++++++++ 2 files changed, 37 insertions(+) diff --git a/src/main/java/org/patinanetwork/codebloom/api/auth/AuthController.java b/src/main/java/org/patinanetwork/codebloom/api/auth/AuthController.java index f3073b942..e1947d2c7 100644 --- a/src/main/java/org/patinanetwork/codebloom/api/auth/AuthController.java +++ b/src/main/java/org/patinanetwork/codebloom/api/auth/AuthController.java @@ -258,6 +258,14 @@ public ResponseEntity> enrollSchool( }) @GetMapping("/school/verify") public RedirectView verifySchoolEmail(final HttpServletRequest request) { + String referer = request.getHeader("Referer"); + String allowedDomain = serverUrlUtils.getUrl(); + boolean validOrigin = (referer == null || referer.startsWith(allowedDomain)); + + if (!validOrigin) { + return new RedirectView("/settings?success=false&message=Invalid request origin"); + } + AuthenticationObject authenticationObject; Session session; User user; diff --git a/src/test/java/org/patinanetwork/codebloom/api/auth/AuthControllerTest.java b/src/test/java/org/patinanetwork/codebloom/api/auth/AuthControllerTest.java index 34efcb7e2..0d88b57fa 100644 --- a/src/test/java/org/patinanetwork/codebloom/api/auth/AuthControllerTest.java +++ b/src/test/java/org/patinanetwork/codebloom/api/auth/AuthControllerTest.java @@ -332,6 +332,8 @@ void enrollSchoolHappyPath() throws Exception { void verifySchoolEmailNotAuthenticated() { HttpServletRequest request = mock(HttpServletRequest.class); + when(request.getHeader("Referer")).thenReturn("http://localhost:8080/settings"); + when(serverUrlUtils.getUrl()).thenReturn("http://localhost:8080"); when(protector.validateSession(request)).thenThrow(new RuntimeException("Not authenticated")); RedirectView redirectView = authController.verifySchoolEmail(request); @@ -351,6 +353,8 @@ void verifySchoolEmailInvalidToken() throws Exception { HttpServletRequest request = mock(HttpServletRequest.class); + when(request.getHeader("Referer")).thenReturn("http://localhost:8080/settings"); + when(serverUrlUtils.getUrl()).thenReturn("http://localhost:8080"); when(protector.validateSession(request)).thenReturn(authObj); when(request.getParameter("state")).thenReturn("invalid-token"); when(jwtClient.decode("invalid-token", MagicLink.class)).thenThrow(new RuntimeException("Invalid token")); @@ -374,6 +378,8 @@ void verifySchoolEmailUserIdMismatch() throws Exception { HttpServletRequest request = mock(HttpServletRequest.class); MagicLink magicLink = new MagicLink("test@myhunter.cuny.edu", "different-user-id"); + when(request.getHeader("Referer")).thenReturn("http://localhost:8080/settings"); + when(serverUrlUtils.getUrl()).thenReturn("http://localhost:8080"); when(protector.validateSession(request)).thenReturn(authObj); when(request.getParameter("state")).thenReturn("valid-token"); when(jwtClient.decode("valid-token", MagicLink.class)).thenReturn(magicLink); @@ -399,6 +405,8 @@ void verifySchoolEmailHappyPath() throws Exception { when(protector.validateSession(request)).thenReturn(authObj); when(request.getParameter("state")).thenReturn("valid-token"); + when(request.getHeader("Referer")).thenReturn("http://localhost:8080/settings"); + when(serverUrlUtils.getUrl()).thenReturn("http://localhost:8080"); when(jwtClient.decode("valid-token", MagicLink.class)).thenReturn(magicLink); when(userRepository.updateUser(any(User.class))).thenReturn(true); @@ -412,4 +420,25 @@ void verifySchoolEmailHappyPath() throws Exception { verify(userRepository, times(1)).updateUser(any(User.class)); verify(userTagRepository, times(1)).createTag(any()); } + + @Test + @DisplayName("Verify school email - invalid origin") + void verifySchoolEmailInvalidOrigin() { + User user = createRandomUser(); + Session session = createRandomSession(user.getId()); + AuthenticationObject authObj = createAuthenticationObject(user, session); + + HttpServletRequest request = mock(HttpServletRequest.class); + + when(protector.validateSession(request)).thenReturn(authObj); + when(request.getHeader("Referer")).thenReturn("http://wrong-host.com/settings"); + when(serverUrlUtils.getUrl()).thenReturn("http://localhost:8080"); + + RedirectView redirectView = authController.verifySchoolEmail(request); + + assertNotNull(redirectView); + assertEquals("/settings?success=false&message=Invalid request origin", redirectView.getUrl()); + + verify(protector, times(0)).validateSession(request); + } }