User inner authentication improvements.
Ylian Saint-Hilaire committed
Apr 2, 2021 at 17:26 UTC
fc23237fe4a0502aa307d5deca07c8ef0cbdc12c
1 file changed
+8
-1
webserver.js
+8
-1
@@ -5263,7 +5263,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
5263
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { ws.close(); return; } // Check 3FA URL key
5264
PerformWSSessionAuth(ws, req, true, function (ws1, req1, domain, user, cookie) {
5265
if (user == null) { // User is not authenticated, perform inner server authentication
5266
- PerformWSSessionInnerAuth(ws, req, domain, function (ws1, req1, domain, user) { obj.meshUserHandler.CreateMeshUser(obj, obj.db, ws1, req1, obj.args, domain, user); }); // User is authenticated
5266
+ if (req.headers['x-meshauth'] === '*') {
5267
+ PerformWSSessionInnerAuth(ws, req, domain, function (ws1, req1, domain, user) { obj.meshUserHandler.CreateMeshUser(obj, obj.db, ws1, req1, obj.args, domain, user); }); // User is authenticated
5268
+ } else {
5269
+ try { ws.close(); } catch (ex) { } // user is not authenticated and inner authentication was not requested, disconnect now.
5270
+ }
5271
} else {
5272
obj.meshUserHandler.CreateMeshUser(obj, obj.db, ws1, req1, obj.args, domain, user); // User is authenticated
5273
}
@@ -5882,6 +5886,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
5886
if (domain == null) { parent.debug('web', 'WSERROR: Got no domain, user auth required.'); return; }
5887
}
5888
5889
+ // Check if inner authentication is requested
5890
+ if (req.headers['x-meshauth'] === '*') { func(ws, req, domain, null); return; }
5891
+
5892
var emailcheck = ((domain.mailserver != null) && (obj.parent.certificates.CommonName != null) && (obj.parent.certificates.CommonName.indexOf('.') != -1) && (obj.args.lanonly != true) && (domain.auth != 'sspi') && (domain.auth != 'ldap'))
5893
5894
// A web socket session can be authenticated in many ways (Default user, session, user/pass and cookie). Check authentication here.