{% extends "introduction/base.html" %}
{% load static %}
{% block content %}
{% block title %}
Security Misconfiguration
{% endblock %}
{% if admin %}
loggedin as Admin
{% else %}
User Not allowed. [ Admin Only ]
{% endif %}
from pygoat.settings import SECRET_COOKIE_KEY
def sec_misconfig_lab3(request):
if not request.user.is_authenticated:
return redirect('login')
try:
cookie = request.COOKIES["auth_cookie"]
payload = jwt.decode(cookie, SECRET_COOKIE_KEY, algorithms=['HS256'])
if payload['user'] == 'admin':
return render(request,"Lab/sec_mis/sec_mis_lab3.html", {"admin":True} )
except:
payload = {
'user':'not_admin',
'exp': datetime.datetime.utcnow() + datetime.timedelta(minutes=60),
'iat': datetime.datetime.utcnow(),
}
cookie = jwt.encode(payload, SECRET_COOKIE_KEY, algorithm='HS256')
response = render(request,"Lab/sec_mis/sec_mis_lab3.html", {"admin":False} )
response.set_cookie(key = "auth_cookie", value = cookie)
return response
{% endblock content %}