Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Solve the Application Login Issue After Domain Mapping #4

Merged
merged 31 commits into from
Jan 26, 2025
+59 −8
Merged

Solve the Application Login Issue After Domain Mapping #4

Show file tree
Hide file tree
Changes from 29 commits
Commits
Show all changes
31 commits
Select commit Hold shift + click to select a range
5be40b9
Update bankapp-deployment.yml
sneh-create Jan 21, 2025
ccb98fb
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
66076d1
Create ingress-headers-configmap.yaml
sneh-create Jan 21, 2025
3ade89e
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
51f0f22
Update application.properties
sneh-create Jan 21, 2025
5f34c14
Update bankapp-deployment.yml
sneh-create Jan 21, 2025
e29c0c5
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
486cd10
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
9024244
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
6b59ec5
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
b249b31
Create webconfig.java
sneh-create Jan 21, 2025
3360753
Create WebConfig.java
sneh-create Jan 21, 2025
ee8f5f7
Update bankapp-deployment.yml
sneh-create Jan 21, 2025
58b2bea
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
f8cd447
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
22b2e0f
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
b6e5099
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
bfb9280
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
3915c89
Update bankapp-ingress.yml
sneh-create Jan 21, 2025
eebe154
Update bankapp-ingress.yml
sneh-create Jan 22, 2025
e4aafa9
Update bankapp-ingress.yml
sneh-create Jan 22, 2025
3d1fc59
Update bankapp-ingress.yml
sneh-create Jan 22, 2025
62b8b7c
Update bankapp-ingress.yml
sneh-create Jan 22, 2025
d554819
Update bankapp-ingress.yml
sneh-create Jan 22, 2025
b86d02e
Update bankapp-ingress.yml
sneh-create Jan 22, 2025
3321358
Update bankapp-ingress.yml
sneh-create Jan 22, 2025
4a3c9d1
Update bankapp-ingress.yml
sneh-create Jan 22, 2025
06affe0
Update bankapp-ingress.yml
sneh-create Jan 22, 2025
cfdfba4
Update README.md
sneh-create Jan 22, 2025
c74c513
Update README.md
sneh-create Jan 22, 2025
92a0c75
Merge branch 'project' into project
Amitabh-DevOps Jan 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -783,6 +783,9 @@ We are looking for contributions in the following areas:

After mapping the domain to the application, there may be issues with user login. If you have experience in troubleshooting or resolving login issues post-domain mapping, we encourage you to contribute a solution. Possible areas for improvement include authentication, DNS configurations, or session management.

### Resolved:

https://github.com/user-attachments/assets/4baf7031-5744-40c5-8035-10e4d1cc4457
---

### 2\. **Add the Security (Sec) Part of DevSecOps to the Project**
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/bankapp-deployment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ spec:
spec:
containers:
- name: bankapp
image: amitabhdevops/mega-project:v1
image: snehcreate/bankappv3
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Use explicit versioning for container images.

The current image tag bankappv3 is not immutable and could lead to inconsistency across replicas or during rollbacks.

  1. Use a specific version tag or SHA digest
  2. Add an explicit pull policy
-        image: snehcreate/bankappv3
+        image: snehcreate/bankapp:v3.0.0
+        imagePullPolicy: IfNotPresent
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
image: snehcreate/bankappv3
image: snehcreate/bankapp:v3.0.0
imagePullPolicy: IfNotPresent

ports:
- containerPort: 8080
resources:
Expand Down
10 changes: 7 additions & 3 deletions kubernetes/bankapp-ingress.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,18 +4,22 @@ metadata:
name: bankapp-ingress
namespace: bankapp-namespace
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
nginx.ingress.kubernetes.io/proxy-body-size: "50m"
nginx.ingress.kubernetes.io/ssl-redirect: "true" # Force HTTPS
cert-manager.io/cluster-issuer: letsencrypt-prod # Use Let's Encrypt
nginx.ingress.kubernetes.io/proxy-set-headers: "ingress-headers"
nginx.ingress.kubernetes.io/rewrite-target: /
nginx.ingress.kubernetes.io/affinity: cookie
nginx.ingress.kubernetes.io/session-cookie-name: bankapp_session
nginx.ingress.kubernetes.io/session-cookie-hash: sha1
Comment on lines +12 to +14
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Enhance cookie security settings.

While session affinity is correctly configured, consider adding these security-focused annotations for the session cookie:

    nginx.ingress.kubernetes.io/affinity: cookie
    nginx.ingress.kubernetes.io/session-cookie-name: bankapp_session
    nginx.ingress.kubernetes.io/session-cookie-hash: sha1
+   nginx.ingress.kubernetes.io/session-cookie-secure: "true"
+   nginx.ingress.kubernetes.io/session-cookie-samesite: "Strict"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
nginx.ingress.kubernetes.io/affinity: cookie
nginx.ingress.kubernetes.io/session-cookie-name: bankapp_session
nginx.ingress.kubernetes.io/session-cookie-hash: sha1
nginx.ingress.kubernetes.io/affinity: cookie
nginx.ingress.kubernetes.io/session-cookie-name: bankapp_session
nginx.ingress.kubernetes.io/session-cookie-hash: sha1
nginx.ingress.kubernetes.io/session-cookie-secure: "true"
nginx.ingress.kubernetes.io/session-cookie-samesite: "Strict"

spec:
tls:
- hosts:
- amitabh.letsdeployit.com
- bankapp.snehaws.com
secretName: bankapp-tls-secret
ingressClassName: nginx
rules:
- host: "amitabh.letsdeployit.com"
- host: bankapp.snehaws.com
http:
paths:
- path: /
Expand Down
9 changes: 9 additions & 0 deletions kubernetes/ingress-headers-configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: ingress-headers
namespace: bankapp-namespace
data:
X-Forwarded-Host: "$host"
X-Forwarded-Proto: "$scheme"
X-Forwarded-For: "$proxy_add_x_forwarded_for"
17 changes: 17 additions & 0 deletions src/main/java/com/example/bankapp/config/WebConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
package com.yourpackage.config;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Update the package declaration to match the project structure.

The package name should be com.example.bankapp.config to maintain consistency with the project structure.

-package com.yourpackage.config;
+package com.example.bankapp.config;
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
package com.yourpackage.config;
package com.example.bankapp.config;


import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfig implements WebMvcConfigurer {
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOrigins("https://bankapp.snehaws.com") // Your frontend domain
.allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
.allowCredentials(true);
}
}
17 changes: 17 additions & 0 deletions src/main/java/com/example/bankapp/config/webconfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
package com.yourpackage.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfig implements WebMvcConfigurer {
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOrigins("https://bankapp.snehaws.com") // Your frontend domain
.allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
.allowCredentials(true);
Comment on lines +12 to +15
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codebase verification

Fix duplicate CORS configuration files and externalize properties

The review comment's suggestion is valid, and additional issues were found:

  • Duplicate configuration files exist: webconfig.java and WebConfig.java with identical content
  • CORS origin is hardcoded without environment-specific configuration

Action items:

  1. Remove one of the duplicate files (prefer keeping WebConfig.java following Java naming conventions)
  2. Add CORS properties to application.properties:
app.cors.allowed-origin=https://bankapp.snehaws.com
  1. Update the configuration to use the property:
@Value("${app.cors.allowed-origin}")
private String allowedOrigin;

@Override
public void addCorsMappings(CorsRegistry registry) {
    registry.addMapping("/**")
            .allowedOrigins(allowedOrigin)
            .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
            .allowCredentials(true);
}
🔗 Analysis chain

Review security implications of CORS with credentials

While the CORS configuration is necessary, enabling allowCredentials with a specific origin requires careful consideration:

  1. Ensure the frontend domain is correctly specified
  2. Consider making the allowed origin configurable via environment variables
  3. Verify that sensitive endpoints are properly secured as CORS with credentials can expose them to CSRF attacks

Consider extracting the origin URL to a configuration property:

-                .allowedOrigins("https://bankapp.snehaws.com")
+                @Value("${app.cors.allowed-origin}")
+                private String allowedOrigin;
+                // ...
+                .allowedOrigins(allowedOrigin)
🏁 Scripts executed

The following scripts were executed for the analysis:

Error: No shell scripts found

Script:

#!/bin/bash
# Search for CORS configurations and related properties
echo "=== Searching for CORS configurations ==="
rg -l "addMapping|allowedOrigins|WebMvcConfigurer|CorsRegistry" --type java

echo -e "\n=== Searching for application properties/yaml files ==="
fd "application.*\.(properties|ya?ml)$"

echo -e "\n=== Checking for CORS-related properties ==="
rg -i "cors" --type properties --type yaml

echo -e "\n=== Looking for @Value annotations ==="
ast-grep --pattern '@Value("${$_}")' --lang java

Length of output: 820

Script:

#!/bin/bash
echo "=== Content of webconfig.java ==="
cat src/main/java/com/example/bankapp/config/webconfig.java

echo -e "\n=== Content of WebConfig.java ==="
cat src/main/java/com/example/bankapp/config/WebConfig.java

echo -e "\n=== Content of application.properties ==="
cat src/main/resources/application.properties

Length of output: 2328

}
}
3 changes: 3 additions & 0 deletions src/main/resources/application.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,6 @@ spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
spring.jpa.hibernate.ddl-auto=update
spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.MySQL8Dialect
spring.jpa.show-sql=true

server.forward-headers-strategy=native
server.use-forward-headers=true