Ghost/core/server/services/auth/authenticate.js

112 lines
4.9 KiB
JavaScript
Raw Normal View History

const passport = require('passport');
const authUtils = require('./utils');
const models = require('../../models');
const common = require('../../lib/common');
const session = require('./session');
const apiKeyAuth = require('./api-key');
const members = require('./members');
const authenticate = {
// ### Authenticate Client Middleware
authenticateClient: function authenticateClient(req, res, next) {
🐛 Fixed error for password authentication with Bearer Token (#9227) refs #8613, refs #9228 - if you send a request to /authentication/token with `grant_type:password` and a Bearer token, Ghost was not able to handle this combination - because it skipped the client authentication, see https://github.com/TryGhost/Ghost/blob/1.17.0/core/server/auth/authenticate.js#L13 - and OAuth detects the `grant_type: password` and jumps in the target implementation - the target implementation for password authentication **again** tried to fetch the client and failed, because it relied on the previous client authentication - see https://github.com/TryGhost/Ghost/blob/1.17.0/core/server/auth/oauth.js#L40 (client.slug is undefined if client authentication is skipped) - ^ so this is the bug - we **can** skip client authentication for requests to the API to fetch data for example e.g. GET /posts (including Bearer) - so when is a client authentication required? - RFC (https://tools.ietf.org/html/rfc6749#page-38) differentiates between confidential and public clients, Ghost has no implementation for this at the moment - so in theory, public clients don't have to be authenticated, only if the credentials are included - to not invent a breaking change, i decided to only make the client authentication required for password authentication - we could change this in Ghost 2.0 I have removed the extra client request to the database for the password authentication, this is not needed. We already do client password authentication [here](https://github.com/TryGhost/Ghost/blob/1.17.0/core/server/auth/auth-strategies.js#L19); If a Bearer token is present and you have not send a `grant_type` (which signalises OAuth to do authentication), you can skip the client authentication.
2017-11-09 17:11:29 +03:00
/**
* In theory, client authentication is not required for public clients, only for confidential clients.
* See e.g. https://tools.ietf.org/html/rfc6749#page-38. Ghost has no differentiation for this at the moment.
* See also See https://tools.ietf.org/html/rfc6749#section-2.1.
*
* Ghost requires client authentication for `grant_type: password`, because we have to ensure that
* we tie a client to a new access token. That means `grant_type: refresh_token` does not require
* client authentication, because binding a client already happened.
*
* To sum up:
* - password authentication requires client authentication
* - refreshing a token does not require client authentication
* - public API requires client authentication
* - as soon as you send an access token in the header or via query
* - we deny public API access
* - API access with a Bearer does not require client authentication
*/
if (authUtils.getBearerAutorizationToken(req) && !authUtils.hasGrantType(req, 'password')) {
return next();
}
if (req.query && req.query.client_id) {
req.body.client_id = req.query.client_id;
}
if (req.query && req.query.client_secret) {
req.body.client_secret = req.query.client_secret;
}
if (!req.body.client_id || !req.body.client_secret) {
return next(new common.errors.UnauthorizedError({
message: common.i18n.t('errors.middleware.auth.accessDenied'),
context: common.i18n.t('errors.middleware.auth.clientCredentialsNotProvided'),
help: common.i18n.t('errors.middleware.auth.forInformationRead', {url: 'https://api.ghost.org/docs/client-authentication'})
}));
}
return passport.authenticate(['oauth2-client-password'], {session: false, failWithError: false},
function authenticate(err, client) {
if (err) {
return next(err); // will generate a 500 error
}
// req.body needs to be null for GET requests to build options correctly
delete req.body.client_id;
delete req.body.client_secret;
if (!client) {
return next(new common.errors.UnauthorizedError({
message: common.i18n.t('errors.middleware.auth.accessDenied'),
context: common.i18n.t('errors.middleware.auth.clientCredentialsNotValid'),
help: common.i18n.t('errors.middleware.auth.forInformationRead', {url: 'https://api.ghost.org/docs/client-authentication'})
}));
}
req.client = client;
common.events.emit('client.authenticated', client);
return next(null, client);
}
)(req, res, next);
},
// ### Authenticate User Middleware
authenticateUser: function authenticateUser(req, res, next) {
return passport.authenticate('bearer', {session: false, failWithError: false},
function authenticate(err, user, info) {
if (err) {
return next(err); // will generate a 500 error
}
if (user) {
req.authInfo = info;
req.user = user;
common.events.emit('user.authenticated', user);
return next(null, user, info);
} else if (authUtils.getBearerAutorizationToken(req)) {
return next(new common.errors.UnauthorizedError({
message: common.i18n.t('errors.middleware.auth.accessDenied')
}));
} else if (req.client) {
req.user = {id: models.User.externalUser};
return next();
}
return next(new common.errors.UnauthorizedError({
message: common.i18n.t('errors.middleware.auth.accessDenied')
}));
}
)(req, res, next);
},
// ### v2 API auth middleware
authenticateAdminApi: [session.safeGetSession, session.getUser],
authenticateAdminApiKey: apiKeyAuth.admin.authenticateAdminApiKey,
authenticateContentApi: [apiKeyAuth.content.authenticateContentApiKey, members.authenticateMembersToken]
};
module.exports = authenticate;