bvandeusen
381e9cedb7
Fixes the defect the operator spotted in #370 immediately after it shipped: auth.ClientIP ignored X-Forwarded-For whenever RemoteAddr was public, so a proxy on a public address — a separate host, or a CDN, i.e. anyone running this publicly, since public means TLS means a proxy — recorded the PROXY for every session. created_ip and last_ip were then always equal and the "Address changed" signal could never fire. The feature looked like it worked and reported nothing. Replaced with the standard trusted-hop model (Rails, Caddy, Traefik, nginx). XFF grows left-to-right as each proxy appends the peer it received from, so for client -> CDN -> own-proxy -> app the app sees [client, CDN] with RemoteAddr = own-proxy, and the client sits at XFF[len - hops]: 0 RemoteAddr, XFF ignored — no proxy 1 the address your own proxy observed 2 through a CDN in front of your proxy Default 1, per the operator: publicly reachable means a TLS terminator in front. The cost is real and stated rather than hidden. hops >= 1 DECLARES that a proxy exists; set it with no proxy, or deeper than the actual chain, and the index reaches attacker-supplied entries, letting a visitor choose which address their own session shows — defeating exactly the detection #370 is for. That's inherent to the model, which is why 0 is a first-class value and the admin card says "count your proxies, don't guess high" instead of just exposing a number. Both mis-set shapes are pinned by tests so they stay known consequences rather than surprises. Migration 0053 + internal/netsettings, cached under an RWMutex. That's not an optimisation: ClientIP runs in RequireUser for every authenticated request, so a per-request query would put the database on the critical path of the whole API. New() always returns a usable service so a boot-time DB hiccup degrades to the default instead of breaking that path (rule #131), and Hops() is nil-safe because test routers construct middleware without it. RequireUser now takes a func() int rather than an int — the value is operator-editable at runtime while the middleware is built once at boot, and reading it per request is what makes a save take effect with no restart (rule #25). The admin card is verifiable, not just configurable: it reports the address the CURRENT setting resolves THIS request to, the raw forwarded chain, and the socket peer — so you set the number, save, and confirm the address matches the machine you're on. It also counts the arriving chain and says how many proxies that implies. GET/PUT both return that payload, PUT recomputed under the new value, so the effect is visible without a reload. Also fixes styling in the #370 card that CI could not catch: text-destructive and bg-destructive don't exist in this Tailwind config — the palette is colors.action.destructive — so the "Address changed" warning and the sign-out-others button were rendering unstyled. Both now use text-action-destructive / bg-action-destructive / text-action-fg. Not done here: requestlog.go still logs raw RemoteAddr and will disagree with the sessions UI about who connected. Left for its own change.
90 lines
2.2 KiB
Go
90 lines
2.2 KiB
Go
package auth
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"golang.org/x/crypto/bcrypt"
|
|
)
|
|
|
|
func TestMintSessionToken_ReturnsUrlSafeBase64(t *testing.T) {
|
|
token, err := MintSessionToken()
|
|
if err != nil {
|
|
t.Fatalf("MintSessionToken: %v", err)
|
|
}
|
|
if len(token) < 40 {
|
|
t.Errorf("token length = %d, want >= 40 (32B base64 url-safe)", len(token))
|
|
}
|
|
if strings.ContainsAny(token, "+/=") {
|
|
t.Errorf("token %q contains non-url-safe chars", token)
|
|
}
|
|
}
|
|
|
|
func TestHashSessionToken_IsDeterministicSHA256(t *testing.T) {
|
|
token := "test-token-xyz"
|
|
want := sha256.Sum256([]byte(token))
|
|
|
|
got := HashSessionToken(token)
|
|
if len(got) != sha256.Size {
|
|
t.Fatalf("hash length = %d, want %d", len(got), sha256.Size)
|
|
}
|
|
if base64.StdEncoding.EncodeToString(got) != base64.StdEncoding.EncodeToString(want[:]) {
|
|
t.Errorf("hash = %x, want %x", got, want)
|
|
}
|
|
}
|
|
|
|
func TestVerifyPassword(t *testing.T) {
|
|
hash, err := bcrypt.GenerateFromPassword([]byte("hunter2"), bcrypt.MinCost)
|
|
if err != nil {
|
|
t.Fatalf("GenerateFromPassword: %v", err)
|
|
}
|
|
if !VerifyPassword(string(hash), "hunter2") {
|
|
t.Error("correct password rejected")
|
|
}
|
|
if VerifyPassword(string(hash), "wrong") {
|
|
t.Error("wrong password accepted")
|
|
}
|
|
if VerifyPassword("not-a-hash", "hunter2") {
|
|
t.Error("malformed hash accepted")
|
|
}
|
|
}
|
|
|
|
func TestRequireUser_RejectsWhenNoCookieOrBearer(t *testing.T) {
|
|
next := http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
|
|
t.Fatal("handler must not be called")
|
|
})
|
|
h := RequireUser(nil, nil)(next)
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/me", nil)
|
|
w := httptest.NewRecorder()
|
|
h.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Errorf("status = %d, want 401", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestExtractBearerToken(t *testing.T) {
|
|
cases := []struct {
|
|
header string
|
|
want string
|
|
}{
|
|
{"", ""},
|
|
{"Bearer abc", "abc"},
|
|
{"bearer abc", "abc"},
|
|
{"Token abc", ""},
|
|
{"Bearer", ""},
|
|
{"Bearer whitespace-token ", "whitespace-token"},
|
|
}
|
|
for _, c := range cases {
|
|
got := extractBearerToken(c.header)
|
|
if got != c.want {
|
|
t.Errorf("extractBearerToken(%q) = %q, want %q", c.header, got, c.want)
|
|
}
|
|
}
|
|
}
|