Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Name the auth cookie __Host- where it can be
Without the prefix any host under the same domain could set a cgitauth
cookie of its own, signing a visitor in as someone else or out.
Diffstat (limited to 'custom/extensions')
| -rw-r--r-- | custom/extensions/auth-file.lua | 12 | |
| -rw-r--r-- | custom/extensions/auth-inline.lua | 12 |
2 files changed, 20 insertions, 4 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 2ef2328..f5d250c 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -101,6 +101,14 @@ local cookie_insecure = false -- the password's length, and one longer than this is turned down unchecked. local max_password_bytes = 256 +-- A browser accepts a cookie named __Host- only when it is Secure, covers the +-- whole host and was set by this host, so no sibling subdomain can plant a +-- session in its place. Either cookie setting above can rule that out. +local session_cookie = cookie_name +if not cookie_insecure and cookie_path == "/" then + session_cookie = "__Host-" .. cookie_name +end + -- One request reaches this script as an open, a write and a close, so what the -- open decodes is kept here for the calls that follow. local action, http, cgit, post @@ -502,7 +510,7 @@ function authenticate_post() end -- A failed login answers with an empty session, which clears the cookie. - set_cookie(cookie_name, session) + set_cookie(session_cookie, session) html("\n") return 0 @@ -517,7 +525,7 @@ function authenticate_cookie() return 1 end - local cookie = get_cookie(http["cookie"], cookie_name) + local cookie = get_cookie(http["cookie"], session_cookie) local username = validate_value("username", cookie, account_hash) if username == nil or not accepted_users[username:lower()] then return 0 diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index bce2472..ae21c7a 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -100,6 +100,14 @@ local cookie_insecure = false -- the password's length, and one longer than this is turned down unchecked. local max_password_bytes = 256 +-- A browser accepts a cookie named __Host- only when it is Secure, covers the +-- whole host and was set by this host, so no sibling subdomain can plant a +-- session in its place. Either cookie setting above can rule that out. +local session_cookie = cookie_name +if not cookie_insecure and cookie_path == "/" then + session_cookie = "__Host-" .. cookie_name +end + -- One request reaches this script as an open, a write and a close, so what the -- open decodes is kept here for the calls that follow. local action, http, cgit, post @@ -463,7 +471,7 @@ function authenticate_post() end -- A failed login answers with an empty session, which clears the cookie. - set_cookie(cookie_name, session) + set_cookie(session_cookie, session) html("\n") return 0 @@ -478,7 +486,7 @@ function authenticate_cookie() return 1 end - local cookie = get_cookie(http["cookie"], cookie_name) + local cookie = get_cookie(http["cookie"], session_cookie) local username = validate_value("username", cookie, account_hash) if username == nil or not accepted_users[username:lower()] then return 0 |