new config authorization_header (no UI)
Massimo Melina committed
Sep 18, 2024 at 22:40 UTC
1664e195d51eb29b624666e8f620c1566361a1bd
2 files changed
+4
-2
config.md
+2
-1
@@ -120,8 +120,9 @@ Configuration can be done in several ways
120
- `dynamic_dns_url` URL to be requested to keep a domain updated with your latest IP address.
121
Optionally, you can append “>” followed by a regular expression to determine a successful answer, otherwise status code will be used.
122
Multiple URLs are supported and you can specify one for each line.
123
-- `auto_basic` automatically detect (based on user-agent) when the basic web inteface should be served, to support legacy browsers. Default true.
123
+- `auto_basic` automatically detect (based on user-agent) when the basic web inteface should be served, to support legacy browsers. Default is true.
124
- `allow_session_ip_change` should requests of the same login session be allowed from different IP addresses. Default is false, to prevent cookie stealing. You can set it `true` to always allow it, or `https` to allow only on https, where stealing the cookie is harder.
125
+- `authorization_header` support Authentication HTTP header. Default is true.
126
- `create-admin` special entry to quickly create an admin account. The value will be set as password. As soon as the account is created, this entry is removed.
127
128
#### Virtual File System (VFS)
src/middlewares.ts
+2
-1
@@ -19,6 +19,7 @@ import events from './events'
19
const allowSessionIpChange = defineConfig<boolean | 'https'>('allow_session_ip_change', false)
20
const forceHttps = defineConfig('force_https', true)
21
const ignoreProxies = defineConfig('ignore_proxies', false)
22
+const allowAuthorizationHeader = defineConfig('authorization_header', true)
23
export const sessionDuration = defineConfig('session_duration', Number(process.env.SESSION_DURATION) || DAY/1000,
24
v => v * 1000)
25
@@ -116,7 +117,7 @@ export const prepareState: Koa.Middleware = async (ctx, next) => {
117
}
118
119
function getHttpAccount() {
119
- const b64 = ctx.get('authorization')?.split(' ')[1]
120
+ const b64 = allowAuthorizationHeader.get() && ctx.get('authorization')?.split(' ')[1]
121
if (!b64) return
122
try {
123
const [u, p] = atob(b64).split(':')