TryGhost/Ghost
1
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2024-12-22 10:21:36 +03:00
Code Issues Projects Releases Wiki Activity
9,219 Commits 250 Branches 1,686 Tags 392 MiB
d989d62c10
Commit Graph

9 Commits

Author SHA1 Message Date
Fabien O'Carroll
4e6a6a24ac Updated Admin API key auth to require kid in header (#10538) 
* Required kid be a header claim as according to spec

https://tools.ietf.org/html/rfc7515#section-4.1.4 (JWT is an extension of JWS)

* Updated error message for missing kid

* Fixed admin-api key unit tests

* Fixed regression and acceptance tests
 2019-02-26 11:03:47 +07:00
Fabien O'Carroll
4a1a245e9b
Updated audience validation for admin api tokens (#10519) 
no-issue
 2019-02-23 12:51:21 +01:00
Nazar Gargol
3274138ff3 Added a note on secret transformation before token verification 
refs #9865

- Added some clarificatoin around why secret used for token verification has to be transformed binary decoded from hex
 2019-02-01 14:04:25 +00:00
Nazar Gargol
776e23696d Added audience check in Admin API key authentication 
refs #9865

- Extracted tests related to Admin API key authenticatoin into separate
acceptance test suite
 2019-01-23 15:01:22 +00:00
kirrg001
1126997244 Added easy way to enable admin api key authentication 
refs #9865

- small refactoring to make both session and admin api key handling similar
- admin api key authentication is still disabled, but easy to enable
- added proof test how to authenticate using admin api keys
 2019-01-18 18:57:58 +01:00
kirrg001
3f758c6a0a Protected against empty admin api key 
refs #9865
 2019-01-18 17:54:04 +01:00
kirrg001
1b5b95e198 Renamed authenticateAdminApiKey to authenticate for admin api key auth 
refs #9865

- the outer authentication layer wants a consistent interface of each authentication package
  - admin.authenticate
  - session.authenticate

- furthermore, there is no need to put the full feature into the exposed function name
 2019-01-18 17:30:07 +01:00
kirrg001
462865981e Updated admin api key authentication to expect api key id in payload 
refs #9865

- see https://github.com/TryGhost/Ghost/blob/2.11.1/core/server/lib/members/index.js#L52
- consistency
 2019-01-18 17:22:19 +01:00
Fabien O'Carroll
1c56221d80 Added API Key auth middleware to v2 Admin API (#10006) 
refs #9865

- Added `auth.authenticate.authenticateAdminApiKey` middleware
  - accepts signed JWT in an `Authorization: Ghost [token]` header
  - sets `req.api_key` if the token is valid
- Updated `authenticatePrivate` middleware stack for v2 admin routes
 2019-01-18 12:45:06 +00:00