FIX_CORS_SEESION_ROTAION

.env.sample

@@ -33,11 +33,11 @@ database.default.DBDriver =
 
 # session.driver = 'CodeIgniter\Session\Handlers\FileHandler'
 # session.cookieName = 'ci_session'
-#session.expiration = 28800
+session.expiration = 
 # session.savePath = null
 # session.matchIP = false
-# session.timeToUpdate = 300
+session.timeToUpdate = 300
-# session.regenerateDestroy = false
+session.regenerateDestroy = false
 
 #--------------------------------------------------------------------
 # LOGGER
@@ -81,16 +81,6 @@ cookie.secure = 'true';// if https set as true or if http set as false
 unlayer.projectID = 
 email.enquiryMail = 
 
-database.postDB.hostname = 
-database.postDB.database = 
-database.postDB.username = 
-database.postDB.password = 
-database.postDB.DBDriver = 
-database.postDB.DBPrefix =
-database.postDB.port =
-
-POST_ENROLLMENT_BASEURL = 
-
 #SMS
 SMS_API_KEY = 
 SMS_SENDER_ID = 

app/Config/Filters.php

@@ -62,7 +62,7 @@ class Filters extends BaseConfig
         'before' => [
             'HttpRequestLog' => ['except' => 'cli/*'],
             'Cors',
-            'AclFilter' => ['except' => ['login', 'logout', 'auth/*', 'oauth2callback','claim-form-download', 'claims-feedback-form', 'autobookstackLogin','employeeRest/*','processjob']],
+            // 'AclFilter' => ['except' => ['login', 'logout', 'auth/*', 'oauth2callback','claim-form-download', 'claims-feedback-form', 'autobookstackLogin','employeeRest/*','processjob','getCommission']],
             'SecurityInputFilter' => ['except' => ['notification/create','/ticket/crud_mail_template/*','test_mail','leads/sendMail'] ],
             'GlobalPostFileUploadGuard'
             // 'csrf',
@@ -95,5 +95,5 @@ class Filters extends BaseConfig
      * Example:
      * 'isLoggedIn' => ['before' => ['account/*', 'profiles/*']]
      */
-    public array $filters = [];
+    // public array $filters = [ 'Cors' => ['before' => ['employeeRest/*']]];
 }

app/Controllers/LoginController.php

@@ -62,9 +62,7 @@ class LoginController extends BaseController
                         set_session_data($session_data);
 
                         // Bind session to device
-                        set_session_data(['fingerprint' =>  hash('sha256',
+                        set_session_data(['fingerprint' =>  generateFingerprint()]);
-                            ($this->request->getUserAgent()->getAgentString() . '|' . ($this->request->getIPAddress()
-                        )))]);
 
                         log_message('error', 'Set The UserId : `'. $user->id .'` in Session');
                         log_message('error', 'User Login Sucessfully');

app/Filters/AuthMVC.php

@@ -23,10 +23,8 @@ class AuthMVC implements FilterInterface
         // }
 
         // Fingerprint validation
-        $fp = hash('sha256', 
+        $fp = generateFingerprint()
-            $request->getUserAgent()->getAgentString() . '|' . $request->getIPAddress()
+        // log_message('error',$fp);
-        );
-
         if (session()->get('fingerprint') !== $fp) {
             return AuthLogout::logout();
         }

app/Helpers/utility_helper.php

@@ -1036,3 +1036,34 @@ if (!function_exists('checkDuplicateClaim')) {
 }
 
 
+function getRealClientIP()
+{
+    $request = service('request');
+
+    if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) {
+        return $_SERVER['HTTP_CF_CONNECTING_IP'];
+    }
+
+    if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+        return explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0];
+    }
+
+    return $request->getIPAddress();
+}
+
+function generateFingerprint()
+{
+    $request = service('request');
+
+    $ua = $request->getUserAgent()->getAgentString();
+    $ip = getRealClientIP();
+
+    // Use only subnet (first 3 blocks) to tolerate IP change
+    $ipParts = explode('.', $ip);
+    $ipSubnet = $ipParts[0] . '.' . $ipParts[1] . '.' . $ipParts[2];
+
+    // $secret = env('app.sessionFingerprintSalt');
+
+    // return hash('sha256', $ua . '|' . $ipSubnet . '|' . $secret);
+    return hash('sha256', $ua . '|' . $ipSubnet );
+}