Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
basicauth: Re-prompt after invalid credentials (fix #3239) (#3240)
Matt Holt committed
Apr 7, 2020 at 20:39 UTC
fbd9515d3523a24e83b0e671f2fc0e17dcdd9b19
1 file changed
+15
-15
modules/caddyhttp/caddyauth/basicauth.go
+15
-15
@@ -105,20 +105,8 @@ func (hba *HTTPBasicAuth) Provision(ctx caddy.Context) error {
105
// Authenticate validates the user credentials in req and returns the user, if valid.
106
func (hba HTTPBasicAuth) Authenticate(w http.ResponseWriter, req *http.Request) (User, bool, error) {
107
username, plaintextPasswordStr, ok := req.BasicAuth()
108
-
109
- // if basic auth is missing or invalid, prompt for credentials
108
if !ok {
111
- // browsers show a message that says something like:
112
- // "The website says: <realm>"
113
- // which is kinda dumb, but whatever.
114
- realm := hba.Realm
115
- if realm == "" {
116
- realm = "restricted"
117
- }
118
-
119
- w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Basic realm="%s"`, realm))
120
-
121
- return User{}, false, nil
109
+ return hba.promptForCredentials(w, nil)
110
}
111
112
plaintextPassword := []byte(plaintextPasswordStr)
@@ -129,15 +117,27 @@ func (hba HTTPBasicAuth) Authenticate(w http.ResponseWriter, req *http.Request)
117
118
same, err := hba.Hash.Compare(account.password, plaintextPassword, account.salt)
119
if err != nil {
132
- return User{}, false, err
120
+ return hba.promptForCredentials(w, err)
121
}
122
if !same || !accountExists {
135
- return User{}, false, nil
123
+ return hba.promptForCredentials(w, nil)
124
}
125
126
return User{ID: username}, true, nil
127
}
128
129
+func (hba HTTPBasicAuth) promptForCredentials(w http.ResponseWriter, err error) (User, bool, error) {
130
+ // browsers show a message that says something like:
131
+ // "The website says: <realm>"
132
+ // which is kinda dumb, but whatever.
133
+ realm := hba.Realm
134
+ if realm == "" {
135
+ realm = "restricted"
136
+ }
137
+ w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Basic realm="%s"`, realm))
138
+ return User{}, false, err
139
+}
140
+
141
// Comparer is a type that can securely compare
142
// a plaintext password with a hashed password
143
// in constant-time. Comparers should hash the