fix: relax auth checks to defer to auth svc

snyk · Feb 3, 2025 · 53b1431 · 53b1431
1 parent 576005a
commit 53b1431
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 9 deletions.
diff --git a/lib/client/auth/brokerServerConnection.ts b/lib/client/auth/brokerServerConnection.ts
@@ -42,6 +42,7 @@ export const renewBrokerServerConnection = async (
     headers: {
       authorization: brokerServerConnectionParams.authorization,
       'user-agent': `Snyk Broker Client ${version}`,
+      'Content-type': 'application/vnd.api+json',
     },
     method: 'POST',
     body: JSON.stringify(body),

diff --git a/lib/server/routesHandlers/authHandlers.ts b/lib/server/routesHandlers/authHandlers.ts
@@ -1,7 +1,6 @@
 import { Request, Response } from 'express';
 import { validateBrokerClientCredentials } from '../auth/authHelpers';
 import { log as logger } from '../../logs/logger';
-import { validate } from 'uuid';
 import { getSocketConnectionByIdentifier } from '../socket';
 import { maskToken } from '../../common/utils/token';
 interface BrokerConnectionAuthRequest {
@@ -19,21 +18,15 @@ export const authRefreshHandler = async (req: Request, res: Response) => {
   const role = req.query['connection_role'];
   const credentials = `${credentialsFromHeader}`;
   const brokerAppClientId =
-    req.headers[`${process.env.SNYK_INTERNAL_AUTH_CLIENT_ID_HEADER}`];
+    req.headers[`${process.env.SNYK_INTERNAL_AUTH_CLIENT_ID_HEADER}`] ??
+    'not available';
   const identifier = req.params.identifier;
   logger.debug(
     { maskedToken: maskToken(identifier), brokerAppClientId, role },
     `Auth Refresh`,
   );
   const body = JSON.parse(req.body.toString()) as BrokerConnectionAuthRequest;
   const brokerClientId = body.data.attributes.broker_client_id;
-  if (!validate(brokerClientId) || !validate(brokerAppClientId)) {
-    logger.warn(
-      { identifier, brokerClientId, brokerAppClientId },
-      'Invalid credentials',
-    );
-    return res.status(401).send('Invalid parameters or credentials.');
-  }
 
   const connection = getSocketConnectionByIdentifier(identifier);
   const currentClient = connection