65 lines
1.8 KiB
Go
65 lines
1.8 KiB
Go
|
package handlers
|
||
|
|
|
||
|
|
import (
|
||
|
|
"fmt"
|
||
|
|
"net/url"
|
||
|
|
|
||
|
|
"github.com/valyala/fasthttp"
|
||
|
|
|
||
|
|
"github.com/authelia/authelia/v4/internal/authorization"
|
||
|
|
"github.com/authelia/authelia/v4/internal/middlewares"
|
||
|
|
)
|
||
|
|
|
||
|
|
func handleAuthzGetObjectLegacy(ctx *middlewares.AutheliaCtx) (object authorization.Object, err error) {
|
||
|
|
var (
|
||
|
|
targetURL *url.URL
|
||
|
|
method []byte
|
||
|
|
)
|
||
|
|
|
||
|
|
if targetURL, err = ctx.GetXOriginalURLOrXForwardedURL(); err != nil {
|
||
|
|
return object, fmt.Errorf("failed to get target URL: %w", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
if method = ctx.XForwardedMethod(); len(method) == 0 {
|
||
|
|
method = ctx.Method()
|
||
|
|
}
|
||
|
|
|
||
|
|
if hasInvalidMethodCharacters(method) {
|
||
|
|
return object, fmt.Errorf("header 'X-Forwarded-Method' with value '%s' has invalid characters", method)
|
||
|
|
}
|
||
|
|
|
||
|
|
return authorization.NewObjectRaw(targetURL, method), nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func handleAuthzUnauthorizedLegacy(ctx *middlewares.AutheliaCtx, authn *Authn, redirectionURL *url.URL) {
|
||
|
|
var (
|
||
|
|
statusCode int
|
||
|
|
)
|
||
|
|
|
||
|
|
if authn.Type == AuthnTypeAuthorization {
|
||
|
|
handleAuthzUnauthorizedAuthorizationBasic(ctx, authn)
|
||
|
|
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
switch {
|
||
|
|
case ctx.IsXHR() || !ctx.AcceptsMIME("text/html") || redirectionURL == nil:
|
||
|
|
statusCode = fasthttp.StatusUnauthorized
|
||
|
|
default:
|
||
|
|
switch authn.Object.Method {
|
||
|
|
case fasthttp.MethodGet, fasthttp.MethodOptions, "":
|
||
|
|
statusCode = fasthttp.StatusFound
|
||
|
|
default:
|
||
|
|
statusCode = fasthttp.StatusSeeOther
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if redirectionURL != nil {
|
||
|
|
ctx.Logger.Infof("Access to %s (method %s) is not authorized to user %s, responding with status code %d with location redirect to %s", authn.Object.URL.String(), authn.Method, authn.Username, statusCode, redirectionURL.String())
|
||
|
|
ctx.SpecialRedirect(redirectionURL.String(), statusCode)
|
||
|
|
} else {
|
||
|
|
ctx.Logger.Infof("Access to %s (method %s) is not authorized to user %s, responding with status code %d", authn.Object.URL.String(), authn.Method, authn.Username, statusCode)
|
||
|
|
ctx.ReplyUnauthorized()
|
||
|
|
}
|
||
|
|
}
|