Skip to content

Commit 4367e47

Browse files
jehiahjehiah
committed
don't promote htpasswd auth; auth directly
1 parent c459806 commit 4367e47

File tree

2 files changed

+74
-20
lines changed

2 files changed

+74
-20
lines changed

‎oauthproxy.go

Lines changed: 56 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ func (p *OauthProxy) getUserInfo(token string) (string, error) {
150150

151151
func (p *OauthProxy) ClearCookie(rw http.ResponseWriter, req *http.Request) {
152152
domain := strings.Split(req.Host, ":")[0]
153-
if *cookieDomain != "" {
153+
if *cookieDomain != "" && strings.HasSuffix(domain, *cookieDomain) {
154154
domain = *cookieDomain
155155
}
156156
cookie := &http.Cookie{
@@ -165,9 +165,9 @@ func (p *OauthProxy) ClearCookie(rw http.ResponseWriter, req *http.Request) {
165165
}
166166

167167
func (p *OauthProxy) SetCookie(rw http.ResponseWriter, req *http.Request, val string) {
168-
168+
169169
domain := strings.Split(req.Host, ":")[0] // strip the port (if any)
170-
if *cookieDomain != "" {
170+
if *cookieDomain != "" && strings.HasSuffix(domain, *cookieDomain) {
171171
domain = *cookieDomain
172172
}
173173
cookie := &http.Cookie{
@@ -182,7 +182,6 @@ func (p *OauthProxy) SetCookie(rw http.ResponseWriter, req *http.Request, val st
182182
http.SetCookie(rw, cookie)
183183
}
184184

185-
186185
func (p *OauthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, message string) {
187186
log.Printf("ErrorPage %d %s %s", code, title, message)
188187
rw.WriteHeader(code)
@@ -202,14 +201,52 @@ func (p *OauthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code
202201
p.ClearCookie(rw, req)
203202
rw.WriteHeader(code)
204203
templates := getTemplates()
205-
t := struct{ SignInMessage string }{SignInMessage: p.SignInMessage}
204+
205+
t := struct{
206+
SignInMessage string
207+
Htpasswd bool
208+
}{
209+
SignInMessage: p.SignInMessage,
210+
Htpasswd: p.HtpasswdFile != nil,
211+
}
206212
templates.ExecuteTemplate(rw, "sign_in.html", t)
207213
}
208214

215+
func (p *OauthProxy) ManualSignIn(rw http.ResponseWriter, req *http.Request) (string, bool){
216+
if req.Method != "POST" || p.HtpasswdFile == nil{
217+
return "", false
218+
}
219+
user := req.FormValue("username")
220+
passwd := req.FormValue("password")
221+
if user == "" {
222+
return "", false
223+
}
224+
// check auth
225+
if p.HtpasswdFile.Validate(user, passwd) {
226+
log.Printf("authenticated %s via manual sign in", user)
227+
return user, true
228+
}
229+
return "", false
230+
}
231+
209232
func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
210233
// check if this is a redirect back at the end of oauth
234+
remoteIP := req.Header.Get("X-Real-IP")
235+
if remoteIP == "" {
236+
remoteIP = req.RemoteAddr
237+
}
238+
log.Printf("%s %s %s", remoteIP, req.Method, req.URL.Path)
239+
240+
var ok bool
241+
var user string
211242
if req.URL.Path == signInPath {
212-
p.SignInPage(rw, req, 200)
243+
user, ok = p.ManualSignIn(rw, req)
244+
if ok {
245+
p.SetCookie(rw, req, user)
246+
http.Redirect(rw, req, "/", 302)
247+
} else {
248+
p.SignInPage(rw, req, 200)
249+
}
213250
return
214251
}
215252
if req.URL.Path == oauthStartPath {
@@ -260,20 +297,22 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
260297
}
261298
}
262299

263-
cookie, err := req.Cookie(p.CookieKey)
264-
var ok bool
265-
var email string
266-
var user string
267-
if err == nil {
268-
email, ok = validateCookie(cookie, p.CookieSeed)
269-
user = strings.Split(email, "@")[0]
300+
if !ok {
301+
cookie, err := req.Cookie(p.CookieKey)
302+
if err == nil {
303+
var email string
304+
email, ok = validateCookie(cookie, p.CookieSeed)
305+
user = strings.Split(email, "@")[0]
306+
}
270307
}
271308

272309
if !ok {
273310
user, ok = p.CheckBasicAuth(req)
274-
if ok {
275-
p.SetCookie(rw, req, user)
276-
}
311+
// if we want to promote basic auth requests to cookie'd requests, we could do that here
312+
// not sure that would be ideal in all circumstances though
313+
// if ok {
314+
// p.SetCookie(rw, req, user)
315+
// }
277316
}
278317

279318
if !ok {
@@ -308,6 +347,7 @@ func (p *OauthProxy) CheckBasicAuth(req *http.Request) (string, bool) {
308347
return "", false
309348
}
310349
if p.HtpasswdFile.Validate(pair[0], pair[1]) {
350+
log.Printf("authenticated %s via basic auth", pair[0])
311351
return pair[0], true
312352
}
313353
return "", false

‎templates.go

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,34 @@ import (
77

88
func getTemplates() *template.Template {
99
t, err := template.New("foo").Parse(`{{define "sign_in.html"}}
10-
<html><head><title>Sign In</title></head>
11-
<body>
10+
<!DOCTYPE html>
11+
<html lang="en" charset="utf-8">
12+
<head><title>Sign In</title></head>
13+
<body>
1214
<form method="GET" action="/oauth2/start">
1315
<button type="submit">Sign In w/ Google</button>
1416
{{.SignInMessage}}
1517
</form>
16-
</body></html>
18+
{{ if .Htpasswd }}
19+
<fieldset>
20+
<form method="POST" action="/oauth2/sign_in">
21+
<label>Username: <input type="text" name="username" size="10"></label><br/>
22+
<label>Password: <input type="password" name="password" size="10"></label><br/>
23+
<button type="submit">Sign In</button>
24+
</form>
25+
</fieldset>
26+
{{ end }}
27+
</body>
28+
</html>
1729
{{end}}`)
1830
if err != nil {
1931
log.Fatalf("failed parsing template %s", err.Error())
2032
}
2133

2234
t, err = t.Parse(`{{define "error.html"}}
23-
<html><head><title>{{.Title}}</title></head>
35+
<!DOCTYPE html>
36+
<html lang="en" charset="utf-8">
37+
<head><title>{{.Title}}</title></head>
2438
<body>
2539
<h2>{{.Title}}</h2>
2640
<p>{{.Message}}</p>

0 commit comments

Comments
 (0)