go/echo
go/echo
1
0
Fork 0
mirror of https://github.com/labstack/echo.git synced 2025-06-13 00:07:25 +02:00
Code Issues Releases Activity

Fixed basic auth middleware, closes #799

Browse Source 
Signed-off-by: Vishal Rana <vr@labstack.com>
This commit is contained in:
Vishal Rana 2017-01-05 12:12:31 -08:00
parent bf317578d7
commit 4cbef06bef
3 changed files with 7 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
middleware/basic_auth.go
View File

@ -2,7 +2,6 @@ package middleware
import ( import (
"encoding/base64" "encoding/base64"
"net/http"
"github.com/labstack/echo" "github.com/labstack/echo"
) )
@ -19,7 +18,7 @@ type (
} }
// BasicAuthValidator defines a function to validate BasicAuth credentials. // BasicAuthValidator defines a function to validate BasicAuth credentials.
BasicAuthValidator func(string, string) bool BasicAuthValidator func(string, string, echo.Context) bool
) )
const ( const (
@ -36,8 +35,7 @@ var (
// BasicAuth returns an BasicAuth middleware. // BasicAuth returns an BasicAuth middleware.
// //
// For valid credentials it calls the next handler. // For valid credentials it calls the next handler.
// For invalid credentials, it sends "401 - Unauthorized" response. // For missing or invalid credentials, it sends "401 - Unauthorized" response.
// For missing or invalid `Authorization` header, it sends "400 - Bad Request" response.
func BasicAuth(fn BasicAuthValidator) echo.MiddlewareFunc { func BasicAuth(fn BasicAuthValidator) echo.MiddlewareFunc {
c := DefaultBasicAuthConfig c := DefaultBasicAuthConfig
c.Validator = fn c.Validator = fn
@ -62,9 +60,6 @@ func BasicAuthWithConfig(config BasicAuthConfig) echo.MiddlewareFunc {
} }
auth := c.Request().Header.Get(echo.HeaderAuthorization) auth := c.Request().Header.Get(echo.HeaderAuthorization)
if auth == "" {
return echo.NewHTTPError(http.StatusBadRequest, "Missing authorization header")
}
l := len(basic) l := len(basic)
if len(auth) > l+1 && auth[:l] == basic { if len(auth) > l+1 && auth[:l] == basic {
@ -76,13 +71,11 @@ func BasicAuthWithConfig(config BasicAuthConfig) echo.MiddlewareFunc {
for i := 0; i < len(cred); i++ { for i := 0; i < len(cred); i++ {
if cred[i] == ':' { if cred[i] == ':' {
// Verify credentials // Verify credentials
if config.Validator(cred[:i], cred[i+1:]) { if config.Validator(cred[:i], cred[i+1:], c) {
return next(c) return next(c)
} }
} }
} }
} else {
return echo.NewHTTPError(http.StatusBadRequest, "Invalid authorization header")
} }
// Need to return `401` for browsers to pop-up login box. // Need to return `401` for browsers to pop-up login box.

6
middleware/basic_auth_test.go
View File

@ -15,7 +15,7 @@ func TestBasicAuth(t *testing.T) {
req, _ := http.NewRequest(echo.GET, "/", nil) req, _ := http.NewRequest(echo.GET, "/", nil)
res := httptest.NewRecorder() res := httptest.NewRecorder()
c := e.NewContext(req, res) c := e.NewContext(req, res)
f := func(u, p string) bool { f := func(u, p string, c echo.Context) bool {
if u == "joe" && p == "secret" { if u == "joe" && p == "secret" {
return true return true
} }
@ -40,11 +40,11 @@ func TestBasicAuth(t *testing.T) {
// Missing Authorization header // Missing Authorization header
req.Header.Del(echo.HeaderAuthorization) req.Header.Del(echo.HeaderAuthorization)
he = h(c).(*echo.HTTPError) he = h(c).(*echo.HTTPError)
assert.Equal(t, http.StatusBadRequest, he.Code) assert.Equal(t, http.StatusUnauthorized, he.Code)
// Invalid Authorization header // Invalid Authorization header
auth = base64.StdEncoding.EncodeToString([]byte("invalid")) auth = base64.StdEncoding.EncodeToString([]byte("invalid"))
req.Header.Set(echo.HeaderAuthorization, auth) req.Header.Set(echo.HeaderAuthorization, auth)
he = h(c).(*echo.HTTPError) he = h(c).(*echo.HTTPError)
assert.Equal(t, http.StatusBadRequest, he.Code) assert.Equal(t, http.StatusUnauthorized, he.Code)
} }

3
website/content/middleware/basic-auth.md
View File

@ -10,8 +10,7 @@ description = "Basic auth middleware for Echo"
Basic auth middleware provides an HTTP basic authentication. Basic auth middleware provides an HTTP basic authentication.
- For valid credentials it calls the next handler. - For valid credentials it calls the next handler.
- For invalid credentials, it sends "401 - Unauthorized" response. - For missing or invalid credentials, it sends "401 - Unauthorized" response.
- For missing or invalid `Authorization` header, it sends "400 - Bad Request" response.
*Usage* *Usage*