From 7ca61001804957e53e5a33dc4f42e91c7baa9905 Mon Sep 17 00:00:00 2001 From: Example man Date: Thu, 18 Nov 2021 17:46:47 +0530 Subject: [PATCH 1/4] Secrets changes, config.json --- config.json | 4 ++++ server.js | 10 ++++++++++ 2 files changed, 14 insertions(+) create mode 100644 config.json diff --git a/config.json b/config.json new file mode 100644 index 00000000..a0bbb240 --- /dev/null +++ b/config.json @@ -0,0 +1,4 @@ +{ + "enableSecretsFeature": false, + "secretHeaderValue": "secretvalue" +} \ No newline at end of file diff --git a/server.js b/server.js index 51384c98..6f22f4a2 100644 --- a/server.js +++ b/server.js @@ -6,6 +6,7 @@ var fs = require('fs'); var port = process.env.PORT || 8092; var dbOperations = require('./databaseOperations.js'); var utils = require('./utils.js'); +var config = JSON.parse(fs.readFileSync('config.json', 'utf8')); var lastTimestamp = 0; @@ -14,6 +15,15 @@ var server = http.createServer(function (req, res) { var method = req.method.toLowerCase(); if(!reqUrl || (!!reqUrl && (reqUrl == "" || reqUrl.toLowerCase() == "index.html"))){ + if(config.enableSecretsFeature) { + console.log(req.headers['x-secret']); + console.log(process.env.SECRET_VALUE); + if(req.headers['x-secret'] != process.env.SECRET_VALUE) { + res.writeHead(403, "Unauthorized"); + res.end(); + return; + } + } var data = fs.readFileSync('index.html'); dbOperations.queryCount(function (visitCount){ From ea7fe8152621aec6997c3ed1fd7cc0de60687965 Mon Sep 17 00:00:00 2001 From: Example man Date: Thu, 18 Nov 2021 17:50:03 +0530 Subject: [PATCH 2/4] Bugfix --- server.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server.js b/server.js index 6f22f4a2..b2bcfdf1 100644 --- a/server.js +++ b/server.js @@ -17,8 +17,8 @@ var server = http.createServer(function (req, res) { if(!reqUrl || (!!reqUrl && (reqUrl == "" || reqUrl.toLowerCase() == "index.html"))){ if(config.enableSecretsFeature) { console.log(req.headers['x-secret']); - console.log(process.env.SECRET_VALUE); - if(req.headers['x-secret'] != process.env.SECRET_VALUE) { + console.log(config.secretHeaderValue); + if(req.headers['x-secret'] != config.secretHeaderValue) { res.writeHead(403, "Unauthorized"); res.end(); return; From 565a2947ef6bb2dfcc0665d85d2e53412abaf688 Mon Sep 17 00:00:00 2001 From: Example man Date: Thu, 18 Nov 2021 18:05:29 +0530 Subject: [PATCH 3/4] Review comments --- config.json | 2 +- server.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config.json b/config.json index a0bbb240..ef7ec377 100644 --- a/config.json +++ b/config.json @@ -1,4 +1,4 @@ { "enableSecretsFeature": false, - "secretHeaderValue": "secretvalue" + "secretHeaderValue": "1797669089" } \ No newline at end of file diff --git a/server.js b/server.js index b2bcfdf1..1412653b 100644 --- a/server.js +++ b/server.js @@ -19,7 +19,7 @@ var server = http.createServer(function (req, res) { console.log(req.headers['x-secret']); console.log(config.secretHeaderValue); if(req.headers['x-secret'] != config.secretHeaderValue) { - res.writeHead(403, "Unauthorized"); + res.writeHead(401, "Unauthorized"); res.end(); return; } From 359112f93822b028d3c8d912c71402413af2e618 Mon Sep 17 00:00:00 2001 From: Example man Date: Thu, 18 Nov 2021 18:05:59 +0530 Subject: [PATCH 4/4] SampleApp secret --- SampleApp_Secrets.jmx | 176 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 176 insertions(+) create mode 100644 SampleApp_Secrets.jmx diff --git a/SampleApp_Secrets.jmx b/SampleApp_Secrets.jmx new file mode 100644 index 00000000..bfef649e --- /dev/null +++ b/SampleApp_Secrets.jmx @@ -0,0 +1,176 @@ + + + + + + false + true + false + + + + + + + + + + appToken + ${__GetSecret(appToken)} + Value for x-secret header + = + + + + + + + + 10 + 0 + 180 + 240 + 10 + + + + false + -1 + + continue + + + + + + x-secret + ${appToken} + + + + + + + + + isaacnitinwus2.azurewebsites.net + + https + + lasttimestamp + GET + true + false + true + false + + HttpClient4 + 60000 + 60000 + + + + + + + 10 + 0 + 180 + 240 + 10 + + + + false + -1 + + continue + + + + + + x-secret + ${appToken} + + + + + + true + + + + false + 2 + = + + + + isaacnitinwus2.azurewebsites.net + + https + + add + POST + true + false + true + false + + HttpClient4 + 60000 + 60000 + + + + + + + 10 + 0 + 180 + 240 + 10 + + + + false + -1 + + continue + + + + + + x-secret + ${appToken} + + + + + + + + + isaacnitinwus2.azurewebsites.net + + https + + get + GET + true + false + true + false + + HttpClient4 + 60000 + 60000 + + + + + +