From ca67c5a8a72f3d26bb0808ba7a63cd4875cd5229 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Wed, 28 Dec 2022 13:53:28 +0800 Subject: refactor auth interface to return error when verify failure (#22119) This PR changed the Auth interface signature from `Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User` to `Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)`. There is a new return argument `error` which means the verification condition matched but verify process failed, we should stop the auth process. Before this PR, when return a `nil` user, we don't know the reason why it returned `nil`. If the match condition is not satisfied or it verified failure? For these two different results, we should have different handler. If the match condition is not satisfied, we should try next auth method and if there is no more auth method, it's an anonymous user. If the condition matched but verify failed, the auth process should be stop and return immediately. This will fix #20563 Co-authored-by: KN4CK3R Co-authored-by: Jason Song --- services/packages/auth.go | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'services/packages/auth.go') diff --git a/services/packages/auth.go b/services/packages/auth.go index 9b84ac79a6..a7acdaf1c3 100644 --- a/services/packages/auth.go +++ b/services/packages/auth.go @@ -10,6 +10,7 @@ import ( "time" user_model "code.gitea.io/gitea/models/user" + "code.gitea.io/gitea/modules/log" "code.gitea.io/gitea/modules/setting" "github.com/golang-jwt/jwt/v4" @@ -41,9 +42,15 @@ func CreateAuthorizationToken(u *user_model.User) (string, error) { } func ParseAuthorizationToken(req *http.Request) (int64, error) { - parts := strings.SplitN(req.Header.Get("Authorization"), " ", 2) + h := req.Header.Get("Authorization") + if h == "" { + return 0, nil + } + + parts := strings.SplitN(h, " ", 2) if len(parts) != 2 { - return 0, fmt.Errorf("no token") + log.Error("split token failed: %s", h) + return 0, fmt.Errorf("split token failed") } token, err := jwt.ParseWithClaims(parts[1], &packageClaims{}, func(t *jwt.Token) (interface{}, error) { -- cgit v1.2.3