demus/openhab-core
1
0
Fork 0
mirror of https://github.com/danieldemus/openhab-core.git synced 2026-07-29 12:34:22 +02:00
Code Issues 1 Packages Projects Releases Wiki Activity

[REST/Auth] Always accept tokens in the alt header (#1631)

Browse Source 
Currently the AuthFilter will try to find a token in the
X-OPENHAB-TOKEN HTTP header - only when it finds a cookie
named X-OPENHAB-AUTH-HEADER. It can cause problems because
browsers or proxies might block the cookie from being sent
for various reasons (for instance if there's a path set
for it).

There is no downside IMHO to always try to fallback to
checking the X-OPENHAB-TOKEN header for a token, if and
only if it's not already provided in the Authorization
header. It is the responsibility of the client to decide
how it wants to authorize the request among the available
options - by checking a cookie, or something else entirely.

Also removed the '?api_key=' option because Swagger UI
doesn't provide tokens that way anymore.

Signed-off-by: Yannick Schaus <github@schaus.net>
This commit is contained in:
Yannick Schaus
2020-09-09 20:48:10 +02:00
committed by GitHub
parent b3880ebe88
commit 426bd112b7
1 changed files with 5 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bundles/org.openhab.core.io.rest.auth/src/main/java/org/openhab/core/io/rest/auth/internal/AuthFilter.java
+5 -19
View File
@@ -47,7 +47,6 @@ import org.osgi.service.jaxrs.whiteboard.propertytypes.JaxrsExtension;
@Priority(Priorities.AUTHENTICATION)
@Provider
public class AuthFilter implements ContainerRequestFilter {
private static final String COOKIE_AUTH_HEADER = "X-OPENHAB-AUTH-HEADER";
private static final String ALT_AUTH_HEADER = "X-OPENHAB-TOKEN";
@Reference
@@ -57,7 +56,6 @@ public class AuthFilter implements ContainerRequestFilter {
public void filter(ContainerRequestContext requestContext) throws IOException {
try {
String authHeader = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION);
if (authHeader != null) {
String[] authParts = authHeader.split(" ");
if (authParts.length == 2) {
@@ -69,23 +67,11 @@ public class AuthFilter implements ContainerRequestFilter {
}
}
if (requestContext.getCookies().containsKey(COOKIE_AUTH_HEADER)) {
String altTokenHeader = requestContext.getHeaderString(ALT_AUTH_HEADER);
if (altTokenHeader != null) {
Authentication auth = jwtHelper.verifyAndParseJwtAccessToken(altTokenHeader);
requestContext.setSecurityContext(new JwtSecurityContext(auth));
return;
}
}
// support the api_key query parameter of the Swagger UI
if (requestContext.getUriInfo().getRequestUri().toString().contains("api_key=")) {
String apiKey = requestContext.getUriInfo().getQueryParameters(true).getFirst("api_key");
if (apiKey != null) {
Authentication auth = jwtHelper.verifyAndParseJwtAccessToken(apiKey);
requestContext.setSecurityContext(new JwtSecurityContext(auth));
return;
}
String altTokenHeader = requestContext.getHeaderString(ALT_AUTH_HEADER);
if (altTokenHeader != null) {
Authentication auth = jwtHelper.verifyAndParseJwtAccessToken(altTokenHeader);
requestContext.setSecurityContext(new JwtSecurityContext(auth));
return;
}
} catch (AuthenticationException e) {
requestContext.abortWith(JSONResponse.createErrorResponse(Status.UNAUTHORIZED, "Invalid token"));