YunoHost/SSOwat
1
0
Fork 0
mirror of https://github.com/YunoHost/SSOwat.git synced 2024-09-03 20:06:27 +02:00
Code Issues Projects Releases Packages Wiki Activity

Have 'cookie_secret' as capslocked to make it ~obvious it's a global/constant

Browse source
This commit is contained in:
Alexandre Aubin 2024-01-30 20:52:23 +01:00
parent 46d3b2420b
commit f6090f86d6
2 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
access.lua
View file

@ -31,7 +31,7 @@ function cached_jwt_verify(data, secret)
if res == nil then if res == nil then
logger:debug("Result not found in cache, checking login") logger:debug("Result not found in cache, checking login")
-- Perform expensive calculation -- Perform expensive calculation
decoded, err = jwt.verify(data, "HS256", cookie_secret) decoded, err = jwt.verify(data, "HS256", COOKIE_SECRET)
if not decoded then if not decoded then
logger:error(err) logger:error(err)
return nil, nil, nil, nil, err return nil, nil, nil, nil, err
@ -102,11 +102,11 @@ function check_authentication()
-- cf. src/authenticators/ldap_ynhuser.py in YunoHost to see how the cookie is actually created -- cf. src/authenticators/ldap_ynhuser.py in YunoHost to see how the cookie is actually created
local cookie = ngx.var["cookie_" .. conf["cookie_name"]] local cookie = ngx.var["cookie_" .. conf["cookie_name"]]
if cookie == nil or cookie_secret == nil then if cookie == nil or COOKIE_SECRET == nil then
return false, nil, nil return false, nil, nil
end end
session_id, host, user, pwd, err = cached_jwt_verify(cookie, cookie_secret) session_id, host, user, pwd, err = cached_jwt_verify(cookie, COOKIE_SECRET)
if err ~= nil then if err ~= nil then
return false, nil, nil return false, nil, nil
@ -296,7 +296,7 @@ function set_basic_auth_header()
local password_enc_b64, iv_b64 = authPasswordEnc:match("([^|]+)|([^|]+)") local password_enc_b64, iv_b64 = authPasswordEnc:match("([^|]+)|([^|]+)")
local password_enc = ngx.decode_base64(password_enc_b64) local password_enc = ngx.decode_base64(password_enc_b64)
local iv = ngx.decode_base64(iv_b64) local iv = ngx.decode_base64(iv_b64)
password = cipher.new('aes-256-cbc'):decrypt(cookie_secret, iv):final(password_enc) password = cipher.new('aes-256-cbc'):decrypt(COOKIE_SECRET, iv):final(password_enc)
end end
-- Set `Authorization` header to enable HTTP authentification -- Set `Authorization` header to enable HTTP authentification

2
init.lua
View file

@ -19,7 +19,7 @@ package.path = package.path .. ";"..script_path.."?.lua"
-- add www-data in the file permissions, which could otherwise lead -- add www-data in the file permissions, which could otherwise lead
-- to comprised apps running with the www-data group to read the secret file? -- to comprised apps running with the www-data group to read the secret file?
local config = require("config") local config = require("config")
cookie_secret = config.get_cookie_secret() COOKIE_SECRET = config.get_cookie_secret()
-- --
-- Init logger -- Init logger