Commit Graph

104 Commits (4d3ac31051957b14d49b1495f96b0b6cd8f62c81)

Author SHA1 Message Date
James Elliott 0f64618cb6
i18n: update translations (#3699) 2022-08-09 10:35:33 +10:00
James Elliott 342497a869
refactor(server): use errgroup to supervise services (#3755)
Uses the errgroup package and pattern for supervising services like servers etc.
2022-08-09 07:50:12 +10:00
James Elliott f12346e39c
fix(server): missing cache-control header (#3737)
This fixes a missing cache control header.

Fixes #3732.
2022-07-25 20:43:50 +10:00
James Elliott f115f77df8
fix(web): offline_access consent description (#3679) 2022-07-11 16:24:09 +10:00
James Elliott 394dafde01
refactor(server): factorize and improve csp (#3509) 2022-07-09 12:00:21 +10:00
James Elliott 3b7c858477
i18n: update translations (#3544)
* i18n: update translation for portal.json (Chinese Simplified)

* i18n: update translation for portal.json (Dutch)

* i18n: update translation for portal.json (German)

* i18n: update translation for portal.json (French)
2022-07-08 23:34:43 +10:00
James Elliott d2f1e5d36d
feat(configuration): automatically map old keys (#3199)
This performs automatic remapping of deprecated configuration keys in most situations.
2022-06-28 13:15:50 +10:00
James Elliott 001589cd6d
feat(metrics): implement prometheus metrics (#3234)
Adds ability to record metrics and gather them for Prometheus.
2022-06-14 17:20:13 +10:00
James Elliott 5e3a1fd863
fix(server): handled errors not logged correctly (#3507)
This fixes an issue where errors handled by the ErrorHandler were not correctly logged. It also ensures the errors are logged with fields to make them easy to diagnose.

Fixes #3506
2022-06-12 09:26:28 +10:00
Amir Zarrinkafsh a22e320f42
refactor(server): alphabetize translations (#3499) 2022-06-10 11:55:38 +10:00
James Elliott a50d425863
refactor(middlewares): convert the bridge to a builder (#3338)
This adjusts the bridge to be utilized as a builder in order to make it more reusable.
2022-06-10 11:34:43 +10:00
Manuel Nuñez 37de389c2f
feat(web): translation for page title/footer (#3401)
Add translations for title and footer.
2022-06-09 11:46:15 +10:00
James Elliott a793ef8b5a
i18n: update translations (#3447) 2022-05-28 17:01:54 +10:00
haowei 3a2804928f
i18n: add zh-tw translation for portal.json (#3439) 2022-05-28 14:43:21 +10:00
SvanGlan 71c47c7344
i18n: update sv translation of portal.json (#3430)
Correct a few issues in the Swedish translation files.
2022-05-25 21:28:40 +10:00
James Elliott aa5bee68f7
i18n: update translations (#3425) 2022-05-25 12:46:47 +10:00
James Elliott 77ac770585
i18n: update translations (#3399) 2022-05-24 22:07:24 +10:00
SvanGlan 40bfef9aaa
i18n: add sv translation for portal.json (#3421) 2022-05-24 21:48:02 +10:00
Auzborn123 2e1bfaa7db
i18n: fix ru translation (#3384)
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-05-18 15:09:23 +10:00
Auzborn123 5dacdd1278
i18n: add ru translation for portal.json (#3367) 2022-05-16 11:19:28 +10:00
James Elliott 0855ea2f71
fix(server): missing cache and xss headers (#3289)
Addresses documentation and a couple of headers which were missed.
2022-05-04 14:47:23 +10:00
James Elliott 556a115c83
fix(server): missing modern security headers (#3288)
This fixes an issue with missing modern security headers such as the X-Content-Type-Options, Referer-Policy, etc.
2022-05-03 12:19:30 +10:00
James Elliott 4710de33a4
refactor(configuration): remove ptr for duoapi and notifier (#3200)
This adds to the ongoing effort to remove all pointers to structs in the configuration without breaking backwards compatibility.
2022-04-16 09:34:26 +10:00
James Elliott 79935c7e2e
fix(server): locale format incorrect (#3154)
This fixes an issue where the locale would be formatted as en-en instead of en-US.
2022-04-09 21:38:17 +10:00
James Elliott f9da940bfc
fix(web): description of profile scope is not accurate (#3146)
This adjusts the profile scope to be described as "Access your profile information" as it accesses more than the display name now.
2022-04-09 08:47:21 +10:00
James Elliott 66a450ed38
feat(oidc): pre-configured consent (#3118)
Allows users to pre-configure consent if enabled by the client configuration by selecting a checkbox during consent.

Closes #2598
2022-04-08 15:35:21 +10:00
James Elliott 4503ac07be
fix(web): lowercase locales are not consistent with localization platforms (#3141)
This fixes an issue with localization platforms and the docs regarding localization, and the forcing locale names to lowercase.
2022-04-08 14:53:46 +10:00
James Elliott ce6bf74c8d
fix(server): incorrect remote ip logged in error handler (#3139)
This fixes edge cases where the remote IP was not correctly logged. Generally this is not an issue as most errors do not hit this handler, but in instances where a transport error occurs this is important.
2022-04-08 14:13:47 +10:00
James Elliott 90edf11b88
feat(web): add user display name to oidc consent view (#3138)
This adds the current logged in users display name to the consent page as well as some other minor tweaks.

Closes #2595
2022-04-08 12:50:55 +10:00
James Elliott 4ebd8fdf4e
feat(oidc): provide cors config including options handlers (#3005)
This adjusts the CORS headers appropriately for OpenID Connect. This includes responding to OPTIONS requests appropriately. Currently this is only configured to operate when the Origin scheme is HTTPS; but can easily be expanded in the future to include additional Origins.
2022-04-07 10:58:51 +10:00
renovate[bot] d96c93ef2b
build(deps): update module github.com/valyala/fasthttp to v1.35.0 (#3120)
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-04-06 07:57:23 +10:00
Clément Michaud 3ca438e3d5
feat: implement mutual tls in the web server (#3065)
Mutual TLS helps prevent untrusted clients communicating with services like Authelia. This can be utilized to reduce the attack surface.

Fixes #3041
2022-04-05 09:57:47 +10:00
James Elliott a2eb0316c8
feat(web): password reset custom url (#3111)
This allows providing a custom URL for password resets. If provided the disable_reset_password option is ignored, the password reset API is disabled, and the button provided in the UI to reset the password redirects users to the configured endpoint.

Closes #1934, Closes #2854

Co-authored-by: you1996 <youssri@flyweight.tech>
2022-04-04 17:46:55 +10:00
James Elliott aac4c4772c
feat(web): i18n asset overrides (#3040)
This allows overriding translation files in folders with lowercase RFC5646 / BCP47 Format language codes. This also fixes an issues where languages which don't expressly match the language code specified due to having a variant will also match the existing codes.

Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-04-04 12:15:26 +10:00
James Elliott 2502d89682
fix(server): respond with 404/405 appropriately (#3087)
This adjusts the not found handler to not respond with a 404 on not found endpoints that are part of the /api or /.well-known folders, and respond with a 405 when the method isn't implemented.

Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-04-04 09:58:01 +10:00
James Elliott 9e05066097
refactor(handlers): ppolicy (#3103)
Add tests and makes the password policy a provider so the configuration can be loaded to memory on startup.
2022-04-03 21:58:27 +10:00
James Elliott 70ab8aab15
fix(web): show appropriate default and available methods (#2999)
This ensures that; the method set when a user does not have a preference is a method that is available, that if a user has a preferred method that is not available it is changed to an enabled method with preference put on methods the user has configured, that the frontend does not show the method selection option when only one method is available.
2022-03-28 12:26:30 +11:00
James Elliott 2f31db2db3
fix(server): healthcheck ipv6 format is invalid (#3055)
This fixes an issue with the healthcheck writting the IPv6 host without brackets.
2022-03-25 11:56:23 +11:00
James Elliott b43ee50368
fix(configuration): remember me duration disabled impossible (#2997)
This fixes an issue not properly resolved by db6dd32151.
2022-03-13 13:51:23 +11:00
James Elliott 8f05846e21
feat: webauthn (#2707)
This implements Webauthn. Old devices can be used to authenticate via the appid compatibility layer which should be automatic. New devices will be registered via Webauthn, and devices which do not support FIDO2 will no longer be able to be registered. At this time it does not fully support multiple devices (backend does, frontend doesn't allow registration of additional devices). Does not support passwordless.
2022-03-03 22:20:43 +11:00
James Elliott 6276883f04
refactor(configuration): utilize time duration decode hook (#2938)
This enhances the existing time.Duration parser to allow multiple units, and implements a decode hook which can be used by koanf to decode string/integers into time.Durations as applicable.
2022-03-02 17:40:26 +11:00
James Elliott bed7a8ae32
feat(server): csp template (#2856)
Implements the ability for advanced users to override the CSP and easily include the required nonce.
2022-02-21 10:14:09 +11:00
James Elliott 26236f491e
fix(server): use of inconsistent methods for determining origin (#2848)
This unifies the methods to obtain the X-Forwarded-* header values and provides logical fallbacks. In addition, so we can ensure this functionality extends to the templated files we've converted the ServeTemplatedFile method into a function that operates as a middlewares.RequestHandler.

Fixes #2765
2022-02-07 00:37:28 +11:00
James Elliott 9a8c6602dd
fix(middlewares): smart delay on reset password (#2767)
This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
2022-01-21 10:46:13 +11:00
James Elliott 7df242f1e3
refactor: remove ioutil (#2635)
Was deprecated in 1.16 and has more performant options available.
2021-12-02 00:14:15 +11:00
James Elliott ad8e844af6
feat(totp): algorithm and digits config (#2634)
Allow users to configure the TOTP Algorithm and Digits. This should be used with caution as many TOTP applications do not support it. Some will also fail to notify the user that there is an issue. i.e. if the algorithm in the QR code is sha512, they continue to generate one time passwords with sha1. In addition this drastically refactors TOTP in general to be more user friendly by not forcing them to register a new device if the administrator changes the period (or algorithm).

Fixes #1226.
2021-12-01 23:11:29 +11:00
Philipp Staiger 01b77384f9
feat(duo): multi device selection (#2137)
Allow users to select and save the preferred duo device and method, depending on availability in the duo account. A default enrollment URL is provided and adjusted if returned by the duo API. This allows auto-enrollment if enabled by the administrator.

Closes #594. Closes #1039.
2021-12-01 14:32:58 +11:00
Amir Zarrinkafsh 0be883befb
feat: customizable static assets (#2597)
* feat: customizable static assets

This change provides the means to override specific assets from the embedded Go FS with files situated on disk.

We only allow overriding the following files currently:
* favicon.ico
* logo.png

* refactor(server): make logo string a const

* refactor(suites): override favicon and use ntp3 in traefik2 suite

* test(suites): test logo override in traefik2 suite

* test(suites): test asset override fallback in traefik suite

Closes #1630.
2021-11-15 19:37:58 +11:00
James Elliott 7efcac6017
fix(session): use crypto/rand for session id generator (#2594)
This adjusts the session ID generator making it use it's own random function rather than using one from the utils lib. This allows us to utilize crypto/rand or math/rand interchangeably. Additionally refactor the utils.RandomString func.
2021-11-11 20:13:32 +11:00
James Elliott 0d7777e3f5
fix(server): provide correct scheme to templated files (#2486)
This utilizes the context of the request and configuration to determine the correct scheme to use for the base URL.

Fixes #2485. Fixes #2476.
2021-10-10 21:19:47 +11:00