updates

chtrembl · Feb 7, 2024 · 6b5346e · 6b5346e
1 parent 2740f78
commit 6b5346e
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/...tore/petstoreapp/src/main/java/com/chtrembl/petstoreapp/controller/RestAPIController.java b/...tore/petstoreapp/src/main/java/com/chtrembl/petstoreapp/controller/RestAPIController.java
@@ -97,6 +97,11 @@ public String viewcart(Model model, @RequestParam Map<String, String> params, Ht
 		logger.info("csrf: " + this.sessionUser.getCsrfToken());
 		logger.info("incoming arrAffinity: " + params.get("arrAffinity"));
 
+		if(params.get("csrf") == null || !params.get("csrf").equals(this.sessionUser.getCsrfToken()))
+		{
+			return "Invalid CSRF token";
+		}
+
 		this.sessionUser.getTelemetryClient().trackEvent(
 				String.format("PetStoreApp user %s requesting view cart", this.sessionUser.getName()),
 				this.sessionUser.getCustomEventProperties(), null);

diff --git a/...petstoreassistant/src/main/java/com/chtrembl/petstoreassistant/service/AzurePetStore.java b/...petstoreassistant/src/main/java/com/chtrembl/petstoreassistant/service/AzurePetStore.java
@@ -72,9 +72,9 @@ public DPResponse viewCart(AzurePetStoreSessionInfo azurePetStoreSessionInfo) {
                 Response response = null;
                 try {
                         Request request = new Request.Builder()
-                                        .url(this.VIEW_CART_URL)
+                                        .url(this.VIEW_CART_URL + "?csrf=" + azurePetStoreSessionInfo.getCsrfToken())
                                         .method("GET", null)
-                                        .addHeader("Cookie", "JSESSIONID=" + azurePetStoreSessionInfo.getSessionID())
+                                        .addHeader("Cookie", "JSESSIONID=" + azurePetStoreSessionInfo.getSessionID()+"; ARRAffinity="+azurePetStoreSessionInfo.getArrAffinity())
                                         .addHeader("Content-Type", "text/html")
                                         .build();