|
@ -15,8 +15,6 @@ |
|
|
package caddyauth |
|
|
package caddyauth |
|
|
|
|
|
|
|
|
import ( |
|
|
import ( |
|
|
"crypto/sha256" |
|
|
|
|
|
"crypto/subtle" |
|
|
|
|
|
"encoding/json" |
|
|
"encoding/json" |
|
|
"fmt" |
|
|
"fmt" |
|
|
"net/http" |
|
|
"net/http" |
|
@ -126,30 +124,6 @@ type Comparer interface { |
|
|
Compare(hashedPassword, plaintextPassword, salt []byte) (bool, error) |
|
|
Compare(hashedPassword, plaintextPassword, salt []byte) (bool, error) |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
type quickComparer struct{} |
|
|
|
|
|
|
|
|
|
|
|
func (quickComparer) Compare(theirHash, plaintext, _ []byte) (bool, error) { |
|
|
|
|
|
ourHash := quickHash(plaintext) |
|
|
|
|
|
return hashesMatch(ourHash, theirHash), nil |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
func hashesMatch(pwdHash1, pwdHash2 []byte) bool { |
|
|
|
|
|
return subtle.ConstantTimeCompare(pwdHash1, pwdHash2) == 1 |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
// quickHash returns the SHA-256 of v. It
|
|
|
|
|
|
// is not secure for password storage, but
|
|
|
|
|
|
// it is useful for efficiently normalizing
|
|
|
|
|
|
// the length of plaintext passwords for
|
|
|
|
|
|
// constant-time comparisons.
|
|
|
|
|
|
//
|
|
|
|
|
|
// Errors are discarded.
|
|
|
|
|
|
func quickHash(v []byte) []byte { |
|
|
|
|
|
h := sha256.New() |
|
|
|
|
|
h.Write([]byte(v)) |
|
|
|
|
|
return h.Sum(nil) |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
// Account contains a username, password, and salt (if applicable).
|
|
|
// Account contains a username, password, and salt (if applicable).
|
|
|
type Account struct { |
|
|
type Account struct { |
|
|
Username string `json:"username"` |
|
|
Username string `json:"username"` |
|
|