Mercurial > prosody-modules

annotate mod_http_authentication/mod_http_authentication.lua @ 5461:06640647d193

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_http_oauth2: Fix use of arbitrary ports in loopback redirect URIs Per draft-ietf-oauth-v2-1-08#section-8.4.2 > The authorization server MUST allow any port to be specified at the > time of the request for loopback IP redirect URIs, to accommodate > clients that obtain an available ephemeral port from the operating > system at the time of the request. Uncertain if it should normalize the host part, but it also seems harmless to treat IPv6 and IPv4 the same here. One thing is that "localhost" is NOT RECOMMENDED because it can sometimes be pointed to non-loopback interfaces via DNS or hosts file.
author Kim Alvefur <zash@zash.se>
date Wed, 17 May 2023 13:51:30 +0200
parents 05725785e3a6
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
2337
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
1
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
2 module:set_global();
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
3
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
4 local b64_decode = require "util.encodings".base64.decode;
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
5 local server = require "net.http.server";
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
6
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
7 local credentials = module:get_option_string("http_credentials", "username:secretpassword");
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
8 local unauthed_endpoints = module:get_option_set("unauthenticated_http_endpoints", { "/http-bind", "/http-bind/" })._items;
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
9
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
10 module:wrap_object_event(server._events, false, function (handlers, event_name, event_data)
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
11 local request = event_data.request;
3442
05725785e3a6 mod_http_authentication: Allow HTTP error events to pass through (fixes #1293)
Kim Alvefur <zash@zash.se>
parents: 2337
diff changeset
12 if event_name ~= "http-error" and request and not unauthed_endpoints[request.path] then
2337
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
13 local response = event_data.response;
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
14 local headers = request.headers;
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
15 if not headers.authorization then
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
16 response.headers.www_authenticate = ("Basic realm=%q"):format(module.host.."/"..module.name);
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
17 return 401;
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
18 end
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
19 local user_password = b64_decode(headers.authorization:match("%s(%S*)$"));
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
20 if user_password ~= credentials then
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
21 return 401;
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
22 end
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
23 end
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
24 return handlers(event_name, event_data);
c6e86b74f62e Add mod_http_authentication.lua
JC Brand <jcbrand@minddistrict.com>
parents:
diff changeset
25 end);