Browse Source

basicauth: Re-prompt after invalid credentials (fix #3239) (#3240)

master
Matt Holt 5 years ago
committed by GitHub
parent
commit
fbd9515d35
No known key found for this signature in database GPG Key ID: 4AEE18F83AFDEB23
  1. 30
      modules/caddyhttp/caddyauth/basicauth.go

30
modules/caddyhttp/caddyauth/basicauth.go

@ -105,20 +105,8 @@ func (hba *HTTPBasicAuth) Provision(ctx caddy.Context) error {
// Authenticate validates the user credentials in req and returns the user, if valid. // Authenticate validates the user credentials in req and returns the user, if valid.
func (hba HTTPBasicAuth) Authenticate(w http.ResponseWriter, req *http.Request) (User, bool, error) { func (hba HTTPBasicAuth) Authenticate(w http.ResponseWriter, req *http.Request) (User, bool, error) {
username, plaintextPasswordStr, ok := req.BasicAuth() username, plaintextPasswordStr, ok := req.BasicAuth()
// if basic auth is missing or invalid, prompt for credentials
if !ok { if !ok {
// browsers show a message that says something like: return hba.promptForCredentials(w, nil)
// "The website says: <realm>"
// which is kinda dumb, but whatever.
realm := hba.Realm
if realm == "" {
realm = "restricted"
}
w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Basic realm="%s"`, realm))
return User{}, false, nil
} }
plaintextPassword := []byte(plaintextPasswordStr) plaintextPassword := []byte(plaintextPasswordStr)
@ -129,15 +117,27 @@ func (hba HTTPBasicAuth) Authenticate(w http.ResponseWriter, req *http.Request)
same, err := hba.Hash.Compare(account.password, plaintextPassword, account.salt) same, err := hba.Hash.Compare(account.password, plaintextPassword, account.salt)
if err != nil { if err != nil {
return User{}, false, err return hba.promptForCredentials(w, err)
} }
if !same || !accountExists { if !same || !accountExists {
return User{}, false, nil return hba.promptForCredentials(w, nil)
} }
return User{ID: username}, true, nil return User{ID: username}, true, nil
} }
func (hba HTTPBasicAuth) promptForCredentials(w http.ResponseWriter, err error) (User, bool, error) {
// browsers show a message that says something like:
// "The website says: <realm>"
// which is kinda dumb, but whatever.
realm := hba.Realm
if realm == "" {
realm = "restricted"
}
w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Basic realm="%s"`, realm))
return User{}, false, err
}
// Comparer is a type that can securely compare // Comparer is a type that can securely compare
// a plaintext password with a hashed password // a plaintext password with a hashed password
// in constant-time. Comparers should hash the // in constant-time. Comparers should hash the

Loading…
Cancel
Save