fix htpasswd auth when cookie-refresh is enabled #1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If cookie-refresh is enabled, a cookie cipher will be enabled for encrypting the access token. But htpasswd-authenticated sessions will never have a session token and will always use the "plain" session state. We cannot assume that the "encrypted" form will always be used if we have a cookie cipher. (The "plain" form is still wrapped with authentication and expiry.)
ploxiln
force-pushed
the
session_state_htpasswd
branch
from
3fa91d8 to
8570ca0
Compare
|
one downside is that this results in a log message on every request after cookie-refresh and before cookie-expire for an htpasswd authed session: |
|
... but otherwise this works fine. Tested with github provider, htpasswd auth, and cookie-refresh |
htpasswd-authenticated sessions, which do not have a token, were re-saved after cookie-refresh period, but were not re-validated in any way, because they have no token (in the future we could use the password-hash as the token, and check that it is still present in the htpasswd file)
ploxiln
force-pushed
the
session_state_htpasswd
branch
from
08097da to
a4c57be
Compare
|
ok, fixed the logging issue, with just one more little tweak to |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If cookie-refresh is enabled, a cookie cipher will be enabled
for encrypting the access token. But htpasswd-authenticated sessions
will never have a session token and will always use the "plain"
session state. We cannot assume that the "encrypted" form will
always be used if we have a cookie cipher.
(The "plain" form is still wrapped with authentication and expiry.)