mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
92d328926d
* refactor(handlers): lower case error messages also refactor verifyAuth function to detect malicious activity both with session cookie and authorization header. * refacto(handlers): simplify error construction * fix(handlers): check prefix in authorization header to determine auth method * fix(handlers): determining the method should be done with headers instead of query arg * refacto(handlers): rollback changes of verifyAuth * don't lowercase log messages * Apply suggestions from code review Make sure logger errors are not lowercased. * fix: uppercase logger errors and remove unused param * Do not lowercase logger errors * Remove unused param targetURL * Rename url variable to not conflict with imported package Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
61 lines
2.0 KiB
Go
61 lines
2.0 KiB
Go
package handlers
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
|
|
"github.com/authelia/authelia/v4/internal/middlewares"
|
|
"github.com/authelia/authelia/v4/internal/session"
|
|
)
|
|
|
|
func identityRetrieverFromStorage(ctx *middlewares.AutheliaCtx) (*session.Identity, error) {
|
|
var requestBody resetPasswordStep1RequestBody
|
|
err := json.Unmarshal(ctx.PostBody(), &requestBody)
|
|
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
details, err := ctx.Providers.UserProvider.GetDetails(requestBody.Username)
|
|
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if len(details.Emails) == 0 {
|
|
return nil, fmt.Errorf("user %s has no email address configured", requestBody.Username)
|
|
}
|
|
|
|
return &session.Identity{
|
|
Username: requestBody.Username,
|
|
Email: details.Emails[0],
|
|
}, nil
|
|
}
|
|
|
|
// ResetPasswordIdentityStart the handler for initiating the identity validation for resetting a password.
|
|
// We need to ensure the attacker cannot perform user enumeration by always replying with 200 whatever what happens in backend.
|
|
var ResetPasswordIdentityStart = middlewares.IdentityVerificationStart(middlewares.IdentityVerificationStartArgs{
|
|
MailTitle: "Reset your password",
|
|
MailButtonContent: "Reset",
|
|
TargetEndpoint: "/reset-password/step2",
|
|
ActionClaim: ActionResetPassword,
|
|
IdentityRetrieverFunc: identityRetrieverFromStorage,
|
|
})
|
|
|
|
func resetPasswordIdentityFinish(ctx *middlewares.AutheliaCtx, username string) {
|
|
userSession := ctx.GetSession()
|
|
// TODO(c.michaud): use JWT tokens to expire the request in only few seconds for better security.
|
|
userSession.PasswordResetUsername = &username
|
|
|
|
err := ctx.SaveSession(userSession)
|
|
if err != nil {
|
|
ctx.Logger.Errorf("Unable to clear password reset flag in session for user %s: %s", userSession.Username, err)
|
|
}
|
|
|
|
ctx.ReplyOK()
|
|
}
|
|
|
|
// ResetPasswordIdentityFinish the handler for finishing the identity validation.
|
|
var ResetPasswordIdentityFinish = middlewares.IdentityVerificationFinish(
|
|
middlewares.IdentityVerificationFinishArgs{ActionClaim: ActionResetPassword}, resetPasswordIdentityFinish)
|