Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow KeyLookup in Cookie for KeyAuth middleware #1885

Closed
3 tasks done
FrontSide opened this issue May 31, 2021 · 1 comment · Fixed by #1929
Closed
3 tasks done

Allow KeyLookup in Cookie for KeyAuth middleware #1885

FrontSide opened this issue May 31, 2021 · 1 comment · Fixed by #1929

Comments

@FrontSide
Copy link

FrontSide commented May 31, 2021

Issue Description

It would be great if we could specify a cookie name for KeyLookup in the KeyAuth middleware config.
This way a user could pass the key credentials via a cookie, whereas now it is restricted to http headers, query params, and form fields.

Disclaimer: There might be good - security-related - reasons not to do this.

Checklist

  • Dependencies installed
  • No typos
  • Searched existing issues and docs

Expected behaviour

I can specify

KeyLookup: "cookie:<name>"

when defining KetAuthWithConfig, so the middleware reads the key from a cookie.

e.g.:

e := echo.New()
e.Use(middleware.KeyAuthWithConfig(middleware.KeyAuthConfig{
  KeyLookup: "cookie:api-key",
  Validator: func(key string, c echo.Context) (bool, error) {
               return key == "valid-key", nil
     },
}))

Actual behaviour

Currently only following KeyLookup methods are allowed

"header:<name>"
"query:<name>"
"form:<name>"	

Steps to reproduce

n.A.

Working code to debug

n.A.

Version/commit

v4.3.0/7846e3f

@lammel
Copy link
Contributor

lammel commented Jun 16, 2021

Could you provide a PR for that change? @FrontSide
Should be fairly easy to implement.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants