Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Say that logging in needs https
Only HTTPS=on counts, the same test cgit makes before it writes an
https link of its own.
Diffstat (limited to 'custom')
| -rw-r--r-- | custom/extensions/auth-file.lua | 11 | |
| -rw-r--r-- | custom/extensions/auth-inline.lua | 11 |
2 files changed, 18 insertions, 4 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index f05a59e..790c1fd 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -18,7 +18,9 @@ -- -- The session cookie is marked Secure by default, so a browser only sends -- it back over HTTPS. On an instance served over plain HTTP login loops --- until cookie_insecure below is set. +-- until cookie_insecure below is set. The login form warns of this whenever +-- the web server does not pass HTTPS=on, so one behind a proxy that ends TLS +-- should set that by hand. -- -- Two libraries are needed. luaossl provides openssl.rand and openssl.hmac and -- lives at <https://github.com/wahern/luaossl>, and luaposix provides @@ -533,6 +535,11 @@ function body() html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>") return 0 end + -- The session cookie is Secure, so over plain http the browser never + -- sends it back and a login would only bring the form round again. + if not cookie_insecure and http["https"] ~= "on" then + html("<p class='login-error' role='alert'>Logging in only works over https.</p>") + end -- cgit asks for the form only once the cookie has been turned down, so -- a session that still verifies belongs to someone not let in here. local cookie = get_cookie(http["cookie"], session_cookie) @@ -571,7 +578,7 @@ function filter_open(name, cookie, method, query, referer, path, host, https, repo, page, url, login) action = actions[name] post = {} - http = { cookie = cookie } + http = { cookie = cookie, https = https } cgit = { repo = repo, url = url, login = login } end diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index 878d55e..99e33d2 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -20,7 +20,9 @@ -- -- The session cookie is marked Secure by default, so a browser only sends -- it back over HTTPS. On an instance served over plain HTTP login loops --- until cookie_insecure below is set. +-- until cookie_insecure below is set. The login form warns of this whenever +-- the web server does not pass HTTPS=on, so one behind a proxy that ends TLS +-- should set that by hand. -- -- Two libraries are needed. luaossl provides openssl.rand and openssl.hmac and -- lives at <https://github.com/wahern/luaossl>, and luaposix provides @@ -496,6 +498,11 @@ function body() html("<p class='login-error' role='alert'>Logins are unavailable. The server's error log says why.</p>") return 0 end + -- The session cookie is Secure, so over plain http the browser never + -- sends it back and a login would only bring the form round again. + if not cookie_insecure and http["https"] ~= "on" then + html("<p class='login-error' role='alert'>Logging in only works over https.</p>") + end -- cgit asks for the form only once the cookie has been turned down, so -- a session that still verifies belongs to someone not let in here. local cookie = get_cookie(http["cookie"], session_cookie) @@ -534,7 +541,7 @@ function filter_open(name, cookie, method, query, referer, path, host, https, repo, page, url, login) action = actions[name] post = {} - http = { cookie = cookie } + http = { cookie = cookie, https = https } cgit = { repo = repo, url = url, login = login } end |