YunoHost/SSOwat
1
0
Fork 0
mirror of https://github.com/YunoHost/SSOwat.git synced 2024-09-03 20:06:27 +02:00
Code Issues Projects Releases Packages Wiki Activity

Replace the old perm_user_remote_user_var_in_nginx_conf with protect_against_basic_auth_spoofing such that every perm is protected against auth spoofing by default

Browse source
This commit is contained in:
Alexandre Aubin 2024-01-30 19:35:47 +01:00
parent d0683f01c4
commit 27f7faaf62
1 changed files with 5 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
access.lua
View file

@ -246,16 +246,15 @@ end
-- 5. CLEAR USER-PROVIDED AUTH HEADER -- 5. CLEAR USER-PROVIDED AUTH HEADER
-- --
-- Which could be spoofing attempts -- Which could be spoofing attempts
-- Unfortunately we can't yolo-clear them on every route because some
-- apps use legit basic auth mechanism ...
-- --
-- "Remote user" refers to the fact that Basic Auth headers is coupled to -- Apps can opt out of the auth spoofing protection using the setting
-- the $remote_user var in nginx, typically used by PHP apps -- 'protect_against_basic_auth_spoofing' set to false if they really need to,
-- but that's a huge security hole and ultimately should never be done...
--
-- ########################################################################### -- ###########################################################################
if permission ~= nil and ngx.req.get_headers()["Authorization"] ~= nil then if permission ~= nil and ngx.req.get_headers()["Authorization"] ~= nil then
perm_user_remote_user_var_in_nginx_conf = permission["use_remote_user_var_in_nginx_conf"] if permission["protect_against_basic_auth_spoofing"] == false then
if perm_user_remote_user_var_in_nginx_conf == nil or perm_user_remote_user_var_in_nginx_conf == true then
-- Ignore if not a Basic auth header -- Ignore if not a Basic auth header
-- otherwise, we interpret this as a Auth header spoofing attempt and clear it -- otherwise, we interpret this as a Auth header spoofing attempt and clear it
local auth_header_from_client = ngx.req.get_headers()["Authorization"] local auth_header_from_client = ngx.req.get_headers()["Authorization"]