WIP (#57)

FrostyApeOne · FrostyApeOne · web-flow · commit 2f51e1871d7f · 2025-10-10T13:51:29.000+01:00
Co-authored-by: FrostyApeOne &lt;Farshad.DASHTI@EDUCATION.GOV.UK&gt;
diff --git a/src/DfE.ExternalApplications.Api/appsettings.Development.json b/src/DfE.ExternalApplications.Api/appsettings.Development.json
@@ -36,12 +36,16 @@
     "DiscoveryEndpoint": "https://test-oidc.signin.education.gov.uk/.well-known/openid-configuration"
   },
   "TestAuthentication": {
-    "Enabled": true,
+    "Enabled": false,
     "JwtSigningKey": "secret",
     "JwtIssuer": "test-external-applications",
     "JwtAudience": "external-applications-api"
   },
   "Frontend": {
     "Origin": "https://dev.apply-transfer-academy.education.gov.uk"
+  },
+  "CypressAuthentication": {
+    "AllowToggle": true,
+    "Secret": ""
   }
 }
diff --git a/src/DfE.ExternalApplications.Api/appsettings.Production.json b/src/DfE.ExternalApplications.Api/appsettings.Production.json
@@ -22,5 +22,9 @@
   },
   "Features": {
     "PerformanceLoggingEnabled": false
+  },
+  "CypressAuthentication": {
+    "AllowToggle": false,
+    "Secret": ""
   }
 }
diff --git a/src/DfE.ExternalApplications.Api/appsettings.Test.json b/src/DfE.ExternalApplications.Api/appsettings.Test.json
@@ -36,13 +36,17 @@
     "DiscoveryEndpoint": "https://pp-oidc.signin.education.gov.uk/.well-known/openid-configuration"
   },
   "TestAuthentication": {
-    "Enabled": true,
+    "Enabled": false,
     "JwtSigningKey": "secret",
     "JwtIssuer": "test-external-applications",
     "JwtAudience": "external-applications-api"
   },
   "Frontend": {
     "Origin": "https://test.apply-transfer-academy.education.gov.uk"
+  },
+  "CypressAuthentication": {
+    "AllowToggle": true,
+    "Secret": ""
   }
 }
 
diff --git a/src/DfE.ExternalApplications.Application/ApplicationServiceCollectionExtensions.cs b/src/DfE.ExternalApplications.Application/ApplicationServiceCollectionExtensions.cs
@@ -12,6 +12,7 @@
 using GovUK.Dfe.CoreLibs.Utilities.RateLimiting;
 using Microsoft.AspNetCore.Http;
 using GovUK.Dfe.CoreLibs.Email;
+using GovUK.Dfe.CoreLibs.Security.Interfaces;
 
 namespace Microsoft.Extensions.DependencyInjection
 {
@@ -40,6 +41,7 @@ public static IServiceCollection AddApplicationDependencyGroup(
                 }
             });
             services.AddScoped<IPermissionCheckerService, ClaimBasedPermissionCheckerService>();
+            services.AddScoped<ICustomRequestChecker, CypressRequestChecker>();
             services.AddTransient<IApplicationFactory, ApplicationFactory>();
             services.AddTransient<IUserFactory, UserFactory>();
             services.AddTransient<ITemplateFactory, TemplateFactory>();
diff --git a/src/DfE.ExternalApplications.Application/DfE.ExternalApplications.Application.csproj b/src/DfE.ExternalApplications.Application/DfE.ExternalApplications.Application.csproj
@@ -21,7 +21,7 @@
 		<PackageReference Include="GovUK.Dfe.CoreLibs.Email" Version="0.1.0-prerelease-146" />
 		<PackageReference Include="GovUK.Dfe.CoreLibs.FileStorage" Version="0.1.3" />
 		<PackageReference Include="GovUK.Dfe.CoreLibs.Notifications" Version="0.1.5" />
-		<PackageReference Include="GovUK.Dfe.CoreLibs.Security" Version="1.1.17" />
+		<PackageReference Include="GovUK.Dfe.CoreLibs.Security" Version="1.1.19-prerelease-7" />
 		<PackageReference Include="GovUK.Dfe.CoreLibs.Utilities" Version="1.0.16" />
 		<PackageReference Include="FluentValidation" Version="12.0.0" />
 		<PackageReference Include="FluentValidation.AspNetCore" Version="11.3.0" />
diff --git a/src/DfE.ExternalApplications.Application/Services/CypressRequestChecker.cs b/src/DfE.ExternalApplications.Application/Services/CypressRequestChecker.cs
@@ -0,0 +1,86 @@
+﻿using GovUK.Dfe.CoreLibs.Security.Interfaces;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+
+namespace DfE.ExternalApplications.Application.Services
+{
+    public class CypressRequestChecker(
+        IHostEnvironment env,
+        IConfiguration config,
+        ILogger<CypressRequestChecker> logger)
+        : ICustomRequestChecker
+    {
+        private const string CypressHeaderKey = "X-Cypress-Test";
+        private const string CypressSecretHeaderKey = "X-Cypress-Secret";
+        private const string ExpectedCypressValue = "true";
+
+        /// <summary>
+        /// Validates if the current HTTP request is a valid Cypress test request
+        /// </summary>
+        /// <param name="httpContext">The HTTP context to validate</param>
+        /// <returns>True if this is a valid Cypress request with correct headers and secret</returns>
+        public bool IsValidRequest(HttpContext httpContext)
+        {
+            // Check for Cypress header
+            var cypressHeader = httpContext.Request.Headers[CypressHeaderKey].ToString();
+            if (!string.Equals(cypressHeader, ExpectedCypressValue, StringComparison.OrdinalIgnoreCase))
+            {
+                return false;
+            }
+
+            // Only allow in Development, Staging or Test environments (NOT Production)
+            if (!(env.IsDevelopment() || env.IsStaging() || env.IsEnvironment("Test")))
+            {
+                logger.LogWarning(
+                    "Cypress authentication attempted in {Environment} environment from {IP} - rejected",
+                    env.EnvironmentName,
+                    httpContext.Connection.RemoteIpAddress);
+                return false;
+            }
+
+            // Check if Cypress toggle is allowed in configuration
+            var allowCypressToggle = config.GetValue<bool>("CypressAuthentication:AllowToggle");
+            if (!allowCypressToggle)
+            {
+                logger.LogWarning(
+                    "Cypress authentication attempted but AllowToggle is disabled from {IP}",
+                    httpContext.Connection.RemoteIpAddress);
+                return false;
+            }
+
+            // Validate secret
+            var expectedSecret = config["CypressAuthentication:Secret"];
+            var providedSecret = httpContext.Request.Headers[CypressSecretHeaderKey].ToString();
+
+            if (string.IsNullOrWhiteSpace(expectedSecret) || string.IsNullOrWhiteSpace(providedSecret))
+            {
+                logger.LogWarning(
+                    "Cypress authentication attempted with missing secret from {IP}",
+                    httpContext.Connection.RemoteIpAddress);
+                return false;
+            }
+
+            var isValid = string.Equals(providedSecret, expectedSecret, StringComparison.Ordinal);
+
+            if (isValid)
+            {
+                logger.LogInformation(
+                    "Valid Cypress test request detected from {IP} for path {Path}",
+                    httpContext.Connection.RemoteIpAddress,
+                    httpContext.Request.Path);
+            }
+            else
+            {
+                logger.LogWarning(
+                    "Invalid Cypress secret provided from {IP} for path {Path}",
+                    httpContext.Connection.RemoteIpAddress,
+                    httpContext.Request.Path);
+            }
+
+            return isValid;
+        }
+    }
+
+}
diff --git a/src/DfE.ExternalApplications.Application/Users/Commands/RegisterUserCommandHandler.cs b/src/DfE.ExternalApplications.Application/Users/Commands/RegisterUserCommandHandler.cs
@@ -37,7 +37,7 @@ public async Task<Result<UserDto>> Handle(
         {
             // Validate external token and extract claims
             var externalUser = await externalValidator
-                .ValidateIdTokenAsync(request.SubjectToken, cancellationToken);
+                .ValidateIdTokenAsync(request.SubjectToken, false, cancellationToken);
 
             var email = externalUser.FindFirst(ClaimTypes.Email)?.Value
                         ?? throw new SecurityTokenException("RegisterUserCommandHandler > Missing email");
diff --git a/src/DfE.ExternalApplications.Application/Users/Queries/ExchangeTokenQueryHandler.cs b/src/DfE.ExternalApplications.Application/Users/Queries/ExchangeTokenQueryHandler.cs
@@ -18,13 +18,16 @@ public class ExchangeTokenQueryHandler(
         IExternalIdentityValidator externalValidator,
         IEaRepository<User> userRepo,
         IUserTokenService tokenSvc,
-        IHttpContextAccessor httpCtxAcc)
+        IHttpContextAccessor httpCtxAcc, 
+        ICustomRequestChecker cypressRequestChecker)
         : IRequestHandler<ExchangeTokenQuery, ExchangeTokenDto>
     {
         public async Task<ExchangeTokenDto> Handle(ExchangeTokenQuery req, CancellationToken ct)
         {
+            var validCypressReq = cypressRequestChecker.IsValidRequest(httpCtxAcc.HttpContext!);
+
             var externalUser = await externalValidator
-                .ValidateIdTokenAsync(req.SubjectToken, ct);
+                .ValidateIdTokenAsync(req.SubjectToken, validCypressReq, ct);
 
             var email = externalUser.FindFirst(ClaimTypes.Email)?.Value
                         ?? throw new SecurityTokenException("ExchangeTokenQueryHandler > Missing email");
diff --git a/src/DfE.ExternalApplications.Infrastructure/DfE.ExternalApplications.Infrastructure.csproj b/src/DfE.ExternalApplications.Infrastructure/DfE.ExternalApplications.Infrastructure.csproj
@@ -5,7 +5,7 @@
   </PropertyGroup>
 
 	<ItemGroup>
-		<PackageReference Include="GovUK.Dfe.CoreLibs.Security" Version="1.1.17" />
+		<PackageReference Include="GovUK.Dfe.CoreLibs.Security" Version="1.1.19-prerelease-7" />
 		<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.18" />
 		<PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.18" />
 		<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.18">
diff --git a/src/GovUK.Dfe.ExternalApplications.Api.Client/Extensions/ServiceCollectionExtensions.cs b/src/GovUK.Dfe.ExternalApplications.Api.Client/Extensions/ServiceCollectionExtensions.cs
@@ -32,6 +32,7 @@ public static IServiceCollection AddExternalApplicationsApiClient<TClientInterfa
             services.AddHttpContextAccessor();
             
             // Register handlers
+            services.AddTransient<HeaderForwardingHandler>();
             services.AddTransient<AzureBearerTokenHandler>();
             
             if (apiSettings.RequestTokenExchange)
@@ -95,6 +96,10 @@ public static IServiceCollection AddExternalApplicationsApiClient<TClientInterfa
                         serviceProvider, httpClient, apiSettings.BaseUrl!);
                 });
 
+                // Add header forwarding handler FIRST in the chain
+                // This ensures headers like X-Cypress-Test are available for all subsequent handlers
+                builder.AddHttpMessageHandler<HeaderForwardingHandler>();
+
                 if (apiSettings.RequestTokenExchange)
                 {
                     // Frontend clients: Use exchange flow
diff --git a/src/GovUK.Dfe.ExternalApplications.Api.Client/Security/HeaderForwardingHandler.cs b/src/GovUK.Dfe.ExternalApplications.Api.Client/Security/HeaderForwardingHandler.cs
@@ -0,0 +1,104 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Linq;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+using GovUK.Dfe.ExternalApplications.Api.Client.Settings;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+
+namespace GovUK.Dfe.ExternalApplications.Api.Client.Security
+{
+    /// <summary>
+    /// HTTP message handler that forwards specific headers from incoming requests to outgoing API calls.
+    /// This is used to forward authentication-related headers (like Cypress test headers) from the web app to the API.
+    /// </summary>
+    [ExcludeFromCodeCoverage]
+    public class HeaderForwardingHandler : DelegatingHandler
+    {
+        private readonly IHttpContextAccessor _httpContextAccessor;
+        private readonly ILogger<HeaderForwardingHandler> _logger;
+        private readonly string[] _headersToForward;
+
+        /// <summary>
+        /// Default headers that should be forwarded from incoming requests to API calls if not configured
+        /// </summary>
+        private static readonly string[] DefaultHeadersToForward = new[]
+        {
+            "X-Cypress-Test",
+            "X-Cypress-Secret"
+        };
+
+        /// <summary>
+        /// Initializes a new instance of the HeaderForwardingHandler
+        /// </summary>
+        /// <param name="httpContextAccessor">Accessor to get the current HTTP context</param>
+        /// <param name="apiSettings">API client settings containing configuration for headers to forward</param>
+        /// <param name="logger">Logger for diagnostic information</param>
+        public HeaderForwardingHandler(
+            IHttpContextAccessor httpContextAccessor,
+            ApiClientSettings apiSettings,
+            ILogger<HeaderForwardingHandler> logger)
+        {
+            _httpContextAccessor = httpContextAccessor;
+            _logger = logger;
+            
+            // Use configured headers if provided, otherwise use defaults
+            _headersToForward = apiSettings.HeadersToForward?.Any() == true
+                ? apiSettings.HeadersToForward
+                : DefaultHeadersToForward;
+        }
+
+        /// <summary>
+        /// Sends an HTTP request, forwarding configured headers from the incoming request
+        /// </summary>
+        protected override async Task<HttpResponseMessage> SendAsync(
+            HttpRequestMessage request,
+            CancellationToken cancellationToken)
+        {
+            var httpContext = _httpContextAccessor.HttpContext;
+
+            if (httpContext != null)
+            {
+                var headersForwarded = 0;
+
+                // Forward each configured header if present in the incoming request
+                foreach (var headerName in _headersToForward)
+                {
+                    if (httpContext.Request.Headers.TryGetValue(headerName, out var headerValue))
+                    {
+                        var value = headerValue.ToString();
+                        if (!string.IsNullOrEmpty(value))
+                        {
+                            // Remove existing header if present (avoid duplicates)
+                            if (request.Headers.Contains(headerName))
+                            {
+                                request.Headers.Remove(headerName);
+                            }
+
+                            // Add the forwarded header
+                            request.Headers.Add(headerName, value);
+                            headersForwarded++;
+
+                            _logger.LogDebug(
+                                "Forwarded header {HeaderName} to API request: {RequestUri}",
+                                headerName,
+                                request.RequestUri);
+                        }
+                    }
+                }
+
+                if (headersForwarded > 0)
+                {
+                    _logger.LogInformation(
+                        "Forwarded {Count} header(s) to API request: {RequestUri}",
+                        headersForwarded,
+                        request.RequestUri);
+                }
+            }
+
+            return await base.SendAsync(request, cancellationToken);
+        }
+    }
+}
+
diff --git a/src/GovUK.Dfe.ExternalApplications.Api.Client/Security/TokenExchangeHandler.cs b/src/GovUK.Dfe.ExternalApplications.Api.Client/Security/TokenExchangeHandler.cs
@@ -3,10 +3,14 @@
 using GovUK.Dfe.ExternalApplications.Api.Client.Contracts;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Logging;
+using System;
 using System.Diagnostics.CodeAnalysis;
 using System.Net;
+using System.Net.Http;
 using System.Text;
 using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
 
 namespace GovUK.Dfe.ExternalApplications.Api.Client.Security;
 
diff --git a/src/GovUK.Dfe.ExternalApplications.Api.Client/Settings/ApiClientSettings.cs b/src/GovUK.Dfe.ExternalApplications.Api.Client/Settings/ApiClientSettings.cs
@@ -23,5 +23,12 @@ public class ApiClientSettings
         /// Required when AutoRegisterUsers is true.
         /// </summary>
         public Guid? DefaultTemplateId { get; set; }
+        
+        /// <summary>
+        /// List of HTTP headers to forward from incoming requests to API calls.
+        /// Useful for forwarding authentication-related headers (e.g., X-Cypress-Test, X-Cypress-Secret).
+        /// If null or empty, a default set of common headers will be forwarded.
+        /// </summary>
+        public string[]? HeadersToForward { get; set; }
     }
 }
diff --git a/src/Tests/DfE.ExternalApplications.Application.Tests/CommandHandlers/Users/RegisterUserCommandHandlerTests.cs b/src/Tests/DfE.ExternalApplications.Application.Tests/CommandHandlers/Users/RegisterUserCommandHandlerTests.cs
diff --git a/src/Tests/DfE.ExternalApplications.Application.Tests/QueryHandlers/Users/ExchangeTokenQueryHandlerTests.cs b/src/Tests/DfE.ExternalApplications.Application.Tests/QueryHandlers/Users/ExchangeTokenQueryHandlerTests.cs
diff --git a/src/Tests/DfE.ExternalApplications.Tests.Common/Helpers/TestExternalIdentityValidator.cs b/src/Tests/DfE.ExternalApplications.Tests.Common/Helpers/TestExternalIdentityValidator.cs

Original file line number	Diff line number	Diff line change
`@@ -22,5 +22,9 @@`
`22`	`22`	`},`
`23`	`23`	`"Features": {`
`24`	`24`	`"PerformanceLoggingEnabled": false`
	`25`	`+ },`
	`26`	`+ "CypressAuthentication": {`
	`27`	`+ "AllowToggle": false,`
	`28`	`+ "Secret": ""`
`25`	`29`	`}`
`26`	`30`	`}`
Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,7 @@`
`12`	`12`	`using GovUK.Dfe.CoreLibs.Utilities.RateLimiting;`
`13`	`13`	`using Microsoft.AspNetCore.Http;`
`14`	`14`	`using GovUK.Dfe.CoreLibs.Email;`
	`15`	`+using GovUK.Dfe.CoreLibs.Security.Interfaces;`
`15`	`16`
`16`	`17`	`namespace Microsoft.Extensions.DependencyInjection`
`17`	`18`	`{`
`@@ -40,6 +41,7 @@ public static IServiceCollection AddApplicationDependencyGroup(`
`40`	`41`	`}`
`41`	`42`	`});`
`42`	`43`	`services.AddScoped<IPermissionCheckerService, ClaimBasedPermissionCheckerService>();`
	`44`	`+ services.AddScoped<ICustomRequestChecker, CypressRequestChecker>();`
`43`	`45`	`services.AddTransient<IApplicationFactory, ApplicationFactory>();`
`44`	`46`	`services.AddTransient<IUserFactory, UserFactory>();`
`45`	`47`	`services.AddTransient<ITemplateFactory, TemplateFactory>();`
Original file line number	Diff line number	Diff line change
`@@ -37,7 +37,7 @@ public async Task<Result<UserDto>> Handle(`
`37`	`37`	`{`
`38`	`38`	`// Validate external token and extract claims`
`39`	`39`	`var externalUser = await externalValidator`
`40`		`- .ValidateIdTokenAsync(request.SubjectToken, cancellationToken);`
	`40`	`+ .ValidateIdTokenAsync(request.SubjectToken, false, cancellationToken);`
`41`	`41`
`42`	`42`	`var email = externalUser.FindFirst(ClaimTypes.Email)?.Value`
`43`	`43`	`?? throw new SecurityTokenException("RegisterUserCommandHandler > Missing email");`