nutomic/ibis
1
0
Fork 0
mirror of https://github.com/Nutomic/ibis.git synced 2025-01-24 06:35:52 +00:00
Code Projects Releases Packages Activity

Correctly check duplicate auth cookies

Browse source
This commit is contained in:
Felix Ableitner 2025-01-14 10:55:08 +01:00
parent e86521236a
commit 8048d02b3b
1 changed files with 15 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
src/backend/api/mod.rs
View file

@ -34,8 +34,8 @@ use axum::{
Json, Json,
Router, Router,
}; };
use axum_extra::extract::CookieJar;
use axum_macros::debug_handler; use axum_macros::debug_handler;
use http::header::COOKIE;
use instance::list_remote_instances; use instance::list_remote_instances;
use std::collections::HashSet; use std::collections::HashSet;
use user::{count_notifications, list_notifications, update_user_profile}; use user::{count_notifications, list_notifications, update_user_profile};
@ -75,28 +75,31 @@ pub fn api_routes() -> Router<()> {
async fn auth( async fn auth(
data: Data<IbisData>, data: Data<IbisData>,
jar: CookieJar,
mut request: Request<Body>, mut request: Request<Body>,
next: Next, next: Next,
) -> Result<Response, StatusCode> { ) -> Result<Response, StatusCode> {
// Check all duplicate auth headers and cookies for the first valid one. // Check all duplicate auth headers and cookies for the first valid one.
let auth: HashSet<_> = request // We need to extract cookies manually because CookieJar ignores duplicates.
let cookies = request
.headers()
.get(COOKIE)
.and_then(|h| h.to_str().ok())
.unwrap_or_default()
.split(';')
.flat_map(|s| s.split_once('='))
.filter(|s| s.0 == AUTH_COOKIE)
.map(|s| s.1);
let headers = request
.headers() .headers()
.get_all(AUTH_COOKIE) .get_all(AUTH_COOKIE)
.into_iter() .into_iter()
.filter_map(|h| h.to_str().ok()) .filter_map(|h| h.to_str().ok());
.chain( let auth: HashSet<_> = headers.chain(cookies).map(|s| s.to_string()).collect();
jar.iter()
.filter(|c| c.name() == AUTH_COOKIE)
.map(|c| c.value()),
)
.map(|s| s.to_string())
.collect();
for a in &auth { for a in &auth {
if let Ok(user) = validate(a, &data).await { if let Ok(user) = validate(a, &data).await {
request.extensions_mut().insert(user); request.extensions_mut().insert(user);
continue; break;
} }
} }
let response = next.run(request).await; let response = next.run(request).await;