TASK22017: phase 8 hardening for sensitive hash-guarded APIs

pages/api/endpoint/getportallogin_api.js

@@ -18,7 +18,6 @@
 
 import axios from "axios";
 import CryptoJS from "crypto-js";
-import _ from "lodash";
 import { azureHeadersPaged } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
@@ -40,44 +39,38 @@ const hashAPIPath = (queryPath) => {
 
 export default async function ApiProxy(req, res) {
     var emailAddress = req.query.emailAddress;
-    var token = await getToken();
     var checkHash = req.query.hash;
+
+    if (typeof emailAddress == "undefined" || emailAddress.length === 0) {
+        return res.status(400).json();
+    }
+
     var checkquerypath =
         "/api/endpoint/getportallogin_api?emailAddress=" + emailAddress;
 
-    // console.log("-----", casefolderID);
-    // console.log("-----", req.query);
-    // console.log("-----", checkquerypath);
-    // console.log("-----", hashAPIPath(checkquerypath));
-    // console.log("-----", checkHash);
-    // console.log(hashAPIPath(checkquerypath) == "&hash=" + checkHash);
+    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+        return res.status(400).json();
+    }
+
+    var token = await getToken();
 
     var queryUrl =
         "contacts?$filter=emailaddress1 eq '" +
         emailAddress +
         "' and statuscode eq 1&$count=true&$select=emailaddress1,contactid,yomifullname,firstname,lastname";
 
-    if (hashAPIPath(checkquerypath) == "&hash=" + checkHash) {
-        var apiResponse = _.isEmpty(req.query)
-            ? res.status(400).json()
-            : typeof emailAddress != "undefined" && emailAddress.length > 0
-            ? axios
-                  .get(
-                      WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-                      azureHeadersPaged(token.access_token)
-                  )
-                  .then(({ data }) => {
-                      //console.log(data);
-                      res.status(200).json(data);
-                  })
-                  .catch((error) => {
-                      consoleLogger(error);
-                      res.status(400).json(error);
-                  })
-            : res.status(400).json();
-    } else {
-        return res.status(400).json();
-    }
+    var apiResponse = axios
+        .get(
+            WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+            azureHeadersPaged(token.access_token)
+        )
+        .then(({ data }) => {
+            res.status(200).json(data);
+        })
+        .catch((error) => {
+            consoleLogger(error);
+            res.status(400).json(error);
+        });
 
     return apiResponse;
 }