knadh/listmonk
1
1
Fork 0
mirror of https://github.com/knadh/listmonk.git synced 2025-11-09 17:22:26 +08:00
Code Issues Projects Releases Packages Wiki Activity

Add cookie check hack to auth for v3 -> 4 browser BasicAuth session issue.

Browse source
This commit is contained in:
Kailash Nadh 2024-07-06 13:14:30 +05:30
parent 17b5cc1774
commit 72c7676ce5
1 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
internal/auth/auth.go
View file

@ -202,7 +202,19 @@ func (o *Auth) ExchangeOIDCToken(code, nonce string) (string, models.User, error
func (o *Auth) Middleware(next echo.HandlerFunc) echo.HandlerFunc { func (o *Auth) Middleware(next echo.HandlerFunc) echo.HandlerFunc {
return func(c echo.Context) error { return func(c echo.Context) error {
// It's an `Authorization` header request. // It's an `Authorization` header request.
hdr := c.Response().Header().Get("Authorization") hdr := strings.TrimSpace(c.Request().Header.Get("Authorization"))
// If cookie is set, ignore BasicAuth. This is to preserve backwards compatibility
// in v3 -> v4 upgrade where the user browser sessions would still have old
// BasicAuth credentials, which no longer work in the new system which expects
// session cookies instead, which causes a redirect loop despite loggin in and session
// cookies being set.
//
// TODO: This should be removed in a future version.
if c := strings.TrimSpace(c.Request().Header.Get("Cookie")); strings.Contains(c, "session=") {
hdr = ""
}
if len(hdr) > 0 { if len(hdr) > 0 {
key, token, err := parseAuthHeader(hdr) key, token, err := parseAuthHeader(hdr)
if err != nil { if err != nil {
@ -213,7 +225,7 @@ func (o *Auth) Middleware(next echo.HandlerFunc) echo.HandlerFunc {
// Validate the token. // Validate the token.
user, ok := o.GetToken(key, token) user, ok := o.GetToken(key, token)
if !ok { if !ok {
c.Set(UserKey, echo.NewHTTPError(http.StatusForbidden, "invalid token:secret")) c.Set(UserKey, echo.NewHTTPError(http.StatusForbidden, "invalid API credentials"))
return next(c) return next(c)
} }