You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
101 lines
2.3 KiB
Go
101 lines
2.3 KiB
Go
package basicauth
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/sha256"
|
|
"crypto/subtle"
|
|
"encoding/base64"
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"gitea.com/lunny/tango"
|
|
)
|
|
|
|
type Auther interface {
|
|
AskAuth() bool
|
|
}
|
|
|
|
type NoAuth struct {
|
|
}
|
|
|
|
func (NoAuth) AskAuth() bool {
|
|
return false
|
|
}
|
|
|
|
type BasicAuth struct {
|
|
Realm string
|
|
User string
|
|
Password string
|
|
}
|
|
|
|
func New(name, pass string) *BasicAuth {
|
|
return &BasicAuth{"Restricted", name, pass}
|
|
}
|
|
|
|
func (b *BasicAuth) authenticate(r *http.Request) bool {
|
|
const basicScheme string = "Basic "
|
|
|
|
// Confirm the request is sending Basic Authentication credentials.
|
|
auth := r.Header.Get("Authorization")
|
|
if !strings.HasPrefix(auth, basicScheme) {
|
|
return false
|
|
}
|
|
|
|
// Get the plain-text username and password from the request
|
|
// The first six characters are skipped - e.g. "Basic ".
|
|
str, err := base64.StdEncoding.DecodeString(auth[len(basicScheme):])
|
|
if err != nil {
|
|
return false
|
|
}
|
|
|
|
// Split on the first ":" character only, with any subsequent colons assumed to be part
|
|
// of the password. Note that the RFC2617 standard does not place any limitations on
|
|
// allowable characters in the password.
|
|
creds := bytes.SplitN(str, []byte(":"), 2)
|
|
|
|
// Equalize lengths of supplied and required credentials
|
|
// by hashing them
|
|
givenUser := sha256.Sum256(creds[0])
|
|
givenPass := sha256.Sum256(creds[1])
|
|
requiredUser := sha256.Sum256([]byte(b.User))
|
|
requiredPass := sha256.Sum256([]byte(b.Password))
|
|
|
|
if len(creds) != 2 {
|
|
return false
|
|
}
|
|
|
|
// Compare the supplied credentials to those set in our options
|
|
if subtle.ConstantTimeCompare(givenUser[:], requiredUser[:]) == 1 &&
|
|
subtle.ConstantTimeCompare(givenPass[:], requiredPass[:]) == 1 {
|
|
return true
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
func (b *BasicAuth) Handle(ctx *tango.Context) {
|
|
if action := ctx.Action(); action != nil {
|
|
if a, ok := action.(Auther); ok {
|
|
if !a.AskAuth() {
|
|
ctx.Next()
|
|
return
|
|
}
|
|
}
|
|
}
|
|
|
|
if b.authenticate(ctx.Req()) {
|
|
ctx.Next()
|
|
return
|
|
}
|
|
|
|
ctx.Header().Set("WWW-Authenticate", fmt.Sprintf(`Basic realm=%q`, b.Realm))
|
|
ctx.Unauthorized()
|
|
return
|
|
}
|
|
|
|
// defaultUnauthorizedHandler provides a default HTTP 401 Unauthorized response.
|
|
func defaultUnauthorizedHandler(w http.ResponseWriter, r *http.Request) {
|
|
http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
|
|
}
|