mingzailao
/
silverbullet
mirror of https://github.com/silverbulletmd/silverbullet.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixes #497

pull/513/head
Zef Hemel 2023-08-17 12:43:08 +02:00
parent 1e3f75ec7d
commit 4583991fa5
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
server/http_server.ts
View File

@ -177,9 +177,10 @@ export class HttpServer {
// Middleware handling the /.auth page and flow // Middleware handling the /.auth page and flow
app.use(async ({ request, response, cookies }, next) => { app.use(async ({ request, response, cookies }, next) => {
const host = request.url.host; // e.g. localhost:3000
if (request.url.pathname === "/.auth") { if (request.url.pathname === "/.auth") {
if (request.url.search === "?logout") { if (request.url.search === "?logout") {
await cookies.delete("auth"); await cookies.delete(authCookieName(host));
// Implicit fallthrough to login page // Implicit fallthrough to login page
} }
if (request.method === "GET") { if (request.method === "GET") {
@ -198,10 +199,14 @@ export class HttpServer {
password, password,
); );
if (hashedPassword) { if (hashedPassword) {
await cookies.set("auth", `${username}:${hashedPassword}`, { await cookies.set(
expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 7), // in a week authCookieName(host),
sameSite: "strict", `${username}:${hashedPassword}`,
}); {
expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 7), // in a week
sameSite: "strict",
},
);
response.redirect(refer || "/"); response.redirect(refer || "/");
// console.log("All headers", request.headers); // console.log("All headers", request.headers);
} else { } else {
@ -220,8 +225,9 @@ export class HttpServer {
if ((await this.authenticator.getAllUsers()).length > 0) { if ((await this.authenticator.getAllUsers()).length > 0) {
// Users defined, so enabling auth // Users defined, so enabling auth
app.use(async ({ request, response, cookies }, next) => { app.use(async ({ request, response, cookies }, next) => {
const host = request.url.host;
if (!excludedPaths.includes(request.url.pathname)) { if (!excludedPaths.includes(request.url.pathname)) {
const authCookie = await cookies.get("auth"); const authCookie = await cookies.get(authCookieName(host));
if (!authCookie) { if (!authCookie) {
response.redirect("/.auth"); response.redirect("/.auth");
return; return;
@ -478,3 +484,7 @@ export class HttpServer {
function utcDateString(mtime: number): string { function utcDateString(mtime: number): string {
return new Date(mtime).toUTCString(); return new Date(mtime).toUTCString();
} }
function authCookieName(host: string) {
return `auth:${host}`;
}