cbda3cf · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

implement an error alert message for invalid basic auth credentials

commitcbda3cf618330aafb6ab0652513feb678781e85a authorAlexandru Ciobanu <aiciobanu_@outlook.com> dateThu 30 Jun 2022, 18:10 (4 years ago) parentdb74661

4 files changed+49−13

compare with master

unifiedsplit

oauthproxy.go+8−8 pkg/app/pagewriter/pagewriter.go+4−4 pkg/app/pagewriter/sign_in.html+34 pkg/app/pagewriter/sign_in_page.go+3−1

oauthproxy.go+8−8

@@ -568,26 +568,26 @@ func (p *OAuthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code

568568 redirectURL = "/"

569569 }

570570

571− p.pageWriter.WriteSignInPage(rw, req, redirectURL)

571+ p.pageWriter.WriteSignInPage(rw, req, redirectURL, code)

572572}

573573

574574// ManualSignIn handles basic auth logins to the proxy

575−func (p *OAuthProxy) ManualSignIn(req *http.Request) (string, bool) {

575+func (p *OAuthProxy) ManualSignIn(req *http.Request) (string, bool, int) {

576576 if req.Method != "POST" || p.basicAuthValidator == nil {

577− return "", false

577+ return "", false, http.StatusOK

578578 }

579579 user := req.FormValue("username")

580580 passwd := req.FormValue("password")

581581 if user == "" {

582− return "", false

582+ return "", false, http.StatusBadRequest

583583 }

584584 // check auth

585585 if p.basicAuthValidator.Validate(user, passwd) {

586586 logger.PrintAuthf(user, req, logger.AuthSuccess, "Authenticated via HtpasswdFile")

587− return user, true

587+ return user, true, http.StatusOK

588588 }

589589 logger.PrintAuthf(user, req, logger.AuthFailure, "Invalid authentication via HtpasswdFile")

590− return "", false

590+ return "", false, http.StatusUnauthorized

591591}

592592

593593// SignIn serves a page prompting users to sign in

@@ -599,7 +599,7 @@ func (p *OAuthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {

599599 return

600600 }

601601

602− user, ok := p.ManualSignIn(req)

602+ user, ok, statusCode := p.ManualSignIn(req)

603603 if ok {

604604 session := &sessionsapi.SessionState{User: user, Groups: p.basicAuthGroups}

605605 err = p.SaveSession(rw, req, session)

@@ -614,7 +614,7 @@ func (p *OAuthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {

614614 p.OAuthStart(rw, req)

615615 } else {

616616 // TODO - should we pass on /oauth2/sign_in query params to /oauth2/start?

617− p.SignInPage(rw, req, http.StatusOK)

617+ p.SignInPage(rw, req, statusCode)

618618 }

619619 }

620620}

pkg/app/pagewriter/pagewriter.go+4−4

@@ -10,7 +10,7 @@ import (

1010// It can also be used to write errors for the http.ReverseProxy used in the

1111// upstream package.

1212type Writer interface {

13− WriteSignInPage(rw http.ResponseWriter, req *http.Request, redirectURL string)

13+ WriteSignInPage(rw http.ResponseWriter, req *http.Request, redirectURL string, statusCode int)

1414 WriteErrorPage(rw http.ResponseWriter, opts ErrorPageOpts)

1515 ProxyErrorHandler(rw http.ResponseWriter, req *http.Request, proxyErr error)

1616 WriteRobotsTxt(rw http.ResponseWriter, req *http.Request)

@@ -108,7 +108,7 @@ func NewWriter(opts Opts) (Writer, error) {

108108// If any of the funcs are not provided, a default implementation will be used.

109109// This is primarily for us in testing.

110110type WriterFuncs struct {

111− SignInPageFunc func(rw http.ResponseWriter, req *http.Request, redirectURL string)

111+ SignInPageFunc func(rw http.ResponseWriter, req *http.Request, redirectURL string, statusCode int)

112112 ErrorPageFunc func(rw http.ResponseWriter, opts ErrorPageOpts)

113113 ProxyErrorFunc func(rw http.ResponseWriter, req *http.Request, proxyErr error)

114114 RobotsTxtfunc func(rw http.ResponseWriter, req *http.Request)

@@ -117,9 +117,9 @@ type WriterFuncs struct {

117117// WriteSignInPage implements the Writer interface.

118118// If the SignInPageFunc is provided, this will be used, else a default

119119// implementation will be used.

120−func (w *WriterFuncs) WriteSignInPage(rw http.ResponseWriter, req *http.Request, redirectURL string) {

120+func (w *WriterFuncs) WriteSignInPage(rw http.ResponseWriter, req *http.Request, redirectURL string, statusCode int) {

121121 if w.SignInPageFunc != nil {

122− w.SignInPageFunc(rw, req, redirectURL)

122+ w.SignInPageFunc(rw, req, redirectURL, statusCode)

123123 return

124124 }

125125

pkg/app/pagewriter/sign_in.html+34

@@ -18,6 +18,28 @@

1818 .logo-box {

1919 margin: 1.5rem 3rem;

2020 }

21+ .alert {

22+ padding: 5px;

23+ background-color: #f44336; /* Red */

24+ color: white;

25+ margin-bottom: 5px;

26+ border-radius: 5px

27+ }

28+ /* The close button */

29+ .closebtn {

30+ margin-left: 10px;

31+ color: white;

32+ font-weight: bold;

33+ float: right;

34+ font-size: 22px;

35+ line-height: 20px;

36+ cursor: pointer;

37+ transition: 0.3s;

38+ }

39+ /* When moving the mouse over the close button */

40+ .closebtn:hover {

41+ color: black;

42+ }

2143 footer a {

2244 text-decoration: underline;

2345 }

@@ -62,6 +84,18 @@

6284 <button class="button is-primary">Sign in</button>

6385 </form>

6486 {{ end }}

87+

88+ {{ if eq .StatusCode 400 401 }}

89+ <div class="alert">

90+ <span class="closebtn" onclick="this.parentElement.style.display='none';">×</span>

91+ {{ if eq .StatusCode 400 }}

92+ {{.StatusCode}}: Username cannot be empty

93+ {{ else }}

94+ {{.StatusCode}}: Invalid Username or Password

95+ {{ end }}

96+ </div>

97+ {{ end }}

98+

6599 </div>

66100 </section>

67101

pkg/app/pagewriter/sign_in_page.go+3−1

@@ -54,12 +54,13 @@ type signInPageWriter struct {

5454

5555// WriteSignInPage writes the sign-in page to the given response writer.

5656// It uses the redirectURL to be able to set the final destination for the user post login.

57−func (s *signInPageWriter) WriteSignInPage(rw http.ResponseWriter, req *http.Request, redirectURL string) {

57+func (s *signInPageWriter) WriteSignInPage(rw http.ResponseWriter, req *http.Request, redirectURL string, statusCode int) {

5858 // We allow unescaped template.HTML since it is user configured options

5959 /* #nosec G203 */

6060 t := struct {

6161 ProviderName string

6262 SignInMessage template.HTML

63+ StatusCode int

6364 CustomLogin bool

6465 Redirect string

6566 Version string

@@ -69,6 +70,7 @@ func (s *signInPageWriter) WriteSignInPage(rw http.ResponseWriter, req *http.Req

6970 }{

7071 ProviderName: s.providerName,

7172 SignInMessage: template.HTML(s.signInMessage),

73+ StatusCode: statusCode,

7274 CustomLogin: s.displayLoginForm,

7375 Redirect: redirectURL,

7476 Version: s.version,