135/netdisco
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

only AuthZ header for api use, and alway regen key on login

Browse Source
This commit is contained in:
Oliver Gorwits
2018-12-31 17:39:36 +00:00
parent 227d0ced40
commit 3b7bb65387
1 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
lib/App/Netdisco/Web/AuthN.pm
View File

@@ -40,9 +40,10 @@ hook 'before' => sub {
and (index(request->path,uri_for('/api/')->path) == 0 and (index(request->path,uri_for('/api/')->path) == 0
or request->path eq uri_for('/swagger.json')->path)) { or request->path eq uri_for('/swagger.json')->path)) {
my $token = request->header('X-API-Key') || param('api_key'); my $token = request->header('Authorization');
my $user = $provider->validate_api_token($token) my $user = $provider->validate_api_token($token)
or return; or return;
session(logged_in_user => $user); session(logged_in_user => $user);
session(logged_in_user_realm => 'users'); session(logged_in_user_realm => 'users');
} }
@@ -68,7 +69,7 @@ post '/login' => sub {
: 'WebUI'); : 'WebUI');
# get authN data from request (HTTP BasicAuth or URL params) # get authN data from request (HTTP BasicAuth or URL params)
my $authheader = request->header('Authorization'); my $authheader = request->header('Authorization');
if (defined $authheader and $authheader =~ /^Basic (.*)$/) { if (defined $authheader and $authheader =~ /^Basic (.*)$/i) {
my ($u, $p) = split(m/:/, (MIME::Base64::decode($1) || ":")); my ($u, $p) = split(m/:/, (MIME::Base64::decode($1) || ":"));
params->{username} = $u; params->{username} = $u;
params->{password} = $p; params->{password} = $p;
@@ -97,13 +98,10 @@ post '/login' => sub {
# if API return a token and record its lifetime # if API return a token and record its lifetime
if ($mode eq 'API') { if ($mode eq 'API') {
if (! $user->token_from or ! $user->token or
$user->token_from < (time - setting('api_token_lifetime'))) {
$user->update({ $user->update({
token_from => time, token_from => time,
token => \'md5(random()::text)', token => \'md5(random()::text)',
})->discard_changes(); })->discard_changes();
}
return 'api_key:'. $user->token; return 'api_key:'. $user->token;
} }