proxmox-backup/www/Application.js
Shannon Sterz dd490f30d1 ui: opt into the new HttpOnly ticket authentication flow
this should add additional protections for cookie stealing and xss
attacks. it also makes it harder to overwrite the cookie from
malicious subdomains.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
Tested-by: Mira Limbeck <m.limbeck@proxmox.com>
Tested-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
Link: https://lore.proxmox.com/20250723151356.264229-9-s.sterz@proxmox.com
2025-07-23 20:21:06 +02:00

72 lines
1.8 KiB
JavaScript

Ext.define('PBS.Application', {
extend: 'Ext.app.Application',
name: 'PBS',
appProperty: 'app',
stores: ['NavigationStore'],
layout: 'fit',
realignWindows: function () {
var modalwindows = Ext.ComponentQuery.query('window[modal]');
Ext.Array.forEach(modalwindows, function (item) {
item.center();
});
},
logout: function () {
var me = this;
Proxmox.Utils.authClear();
Proxmox.Utils.API2Request({
url: '/api2/extjs/access/ticket',
method: 'DELETE',
success: function () {
me.changeView('loginview', true);
},
failure: function ({ response }) {
// logout failed
console.error('could not log out', response);
},
});
},
changeView: function (view, skipCheck) {
var me = this;
PBS.view = view;
me.view = view;
if (me.currentView !== undefined) {
me.currentView.destroy();
}
me.currentView = Ext.create({
xtype: view,
});
if (skipCheck !== true) {
Proxmox.Utils.checked_command(Ext.emptyFn);
}
},
view: 'loginview',
launch: function () {
var me = this;
Ext.on('resize', me.realignWindows);
var provider = new Ext.state.LocalStorageProvider({ prefix: 'ext-pbs-' });
Ext.state.Manager.setProvider(provider);
let isOpenIDLogin = Proxmox.Utils.getOpenIDRedirectionAuthorization() !== undefined;
let alreadyLoggedIn = Proxmox.Utils.authOK();
if (isOpenIDLogin || !alreadyLoggedIn) {
me.changeView('loginview', true); // show login window if not loggedin
} else {
me.changeView('mainview', true);
}
},
});
Ext.application('PBS.Application');