AgeCommit message (Collapse)AuthorLines
Say what really differs between the auth filtersBryce Kwon-3/+4
The lookups were never the only difference, since the configuration and trim's place differ as well. The configuration is now set off by blank lines, as in the other extensions, instead of a heading.
Drop auth guards for input cgit never sendsBryce Kwon-8/+2
cgit names no repository with an empty string, never nil, so the check that the index stays up proved nothing, and auth-file in fact refuses the index too while its repos file cannot be read. A session_seconds of 0 signs a session that has expired by the time it comes back, so it needs no branch of its own in set_cookie.
Strip control characters from the location aloneBryce Kwon-9/+6
set_cookie only ever writes an empty value or a token secure_value built from url-encoded text, digits and hex, so stripping it changed nothing.
Drop the URL helpers' guards that cannot fireBryce Kwon-9/+1
Every caller hands the helpers a string, and a value with a line break is refused by validate_value whether or not CR LF is folded on the way.
Keep only the request fields the auth filters readBryce Kwon-21/+5
Seven of the twelve fields filter_open stored were never read. Naming all twelve parameters keeps the order cgit passes them in on record.
Take a signed cookie apart with one matchBryce Kwon-41/+5
The loop let a valid cookie through with a field appended, a doubled separator or a zero in front of its expiry. The payload now carries the expiry as written, so only the spelling secure_value issues verifies.
Say when a login fails, and line up the formBryce Kwon-8/+22
A wrong password sent the reader back to the same empty form, which looked no different from a crash. The redirect now carries a flag the form reads, the same for an unknown user as for a wrong password, and the form leaves the flag out of the way back it signs.
Claim and test Lua 5.5 for every extensionBryce Kwon-3/+3
luaossl from release 20260910 and luaposix load under Lua 5.5, and cgit renders the same pages under it as under LuaJIT. Running the suites there already caught a write to a for loop's control variable, which 5.5 makes read-only.
Say that a protected repository stays on the indexBryce Kwon-0/+4
Name the auth cookie __Host- where it can beBryce Kwon-2/+10
Without the prefix any host under the same domain could set a cgitauth cookie of its own, signing a visitor in as someone else or out.
End a session when its account's hash changesBryce Kwon-29/+44
A session stayed good for its whole week after the password changed or the account went away, which is when ending it matters most.
Load auth libraries only when a request needs oneBryce Kwon-6/+10
Required at the top, a missing luaossl or luaposix failed every request to the site, public pages included, and each public page paid to load both.
Say which hash kinds each system's crypt checksBryce Kwon-2/+13
The one recipe given, SHA-512 from Debian's mkpasswd, cannot log anyone in on OpenBSD, whose crypt checks only bcrypt, or on macOS, and libxcrypt, which most Linux distributions use, recommends yescrypt instead.
Spend a missing account's login on a real hashBryce Kwon-9/+14
The fixed SHA-512 stand-in matched only the documented setup, so a site hashing with yescrypt, other rounds or bcrypt answered for missing and real names in different times, and on OpenBSD it failed at once.
Turn down passwords past 256 bytes uncheckedBryce Kwon-1/+5
SHA-crypt hashes the password in most of its rounds, so the 4 KB that cgit's POST limit lets through cost about fifteen ordinary logins per anonymous attempt.
Read the auth cookie in linear timeBryce Kwon-5/+21
Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well.
Unify the docs, samples and extensionsBryce Kwon-1/+1
Clean up the whole treeBryce Kwon-22/+11
Give the login inputs explicit field typesBryce Kwon-1/+1
Trim the comments and dead code across the treeBryce Kwon-41/+25
Let password managers fill the login formBryce Kwon-4/+4
Restyle the filter extension headers and markupBryce Kwon-138/+158
Move the cookie-signing secret out of the cache v2.3.0Bryce Kwon-1/+1
Trim the lua headers and fix the Scintillua notesBryce Kwon-30/+3
Fix cookie name escaping and stored hash trimmingBryce Kwon-1/+10
Reorganize the tree into vendor/ and custom/Bryce Kwon-0/+0
Harden and reorganize the auth filtersBryce Kwon-147/+322
Harden the auth filter headers and session cookieBryce Kwon-5/+31
The filters signed the request url and later wrote it into a Location header, and the signing step re-encoded a newline that the verifying step decoded back, so a crafted url could smuggle CR and LF into the response. The cookie HMAC was also checked with a short-circuiting comparison and carried no SameSite attribute.
Prune and rename the filter extensionsBryce Kwon-2/+15
The gentoo LDAP filter is distro specific, the owner example only restates what cgit already renders, and the about converters are superseded by the built-in markdown rendering. The two auth filters do the same job and differ only in where their accounts live, so they become `auth-inline` for accounts kept in the script and `auth-file` for accounts kept on disk.
Reorganize into source, assets and librariesBryce Kwon-0/+0
The C sources move to source/, the served files to assets/, the bundled Git submodule to libraries/git and the filter scripts to extensions/. Everything the build generates now lands in build/, so a clean is a single remove and the tree stays clean.
filters: migrate from luacrypto to luaosslJason A. Donenfeld-12/+19
luaossl has no upstream anymore and doesn't support OpenSSL 1.1, whereas luaossl is quite active. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
auth-filters: use crypt() in simple-authenticationJason A. Donenfeld-13/+6
There's no use in giving a silly example to folks who will just copy it, so instead try to do something slightly better. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
auth-filters: generate secret securelyJason A. Donenfeld-8/+42
This is much better than having the user generate it themselves. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
auth-filters: do not use HMAC-SHA1Jason A. Donenfeld-2/+2
Though SHA1 is broken, HMAC-SHA1 is still fine. But let's not push our luck; SHA256 is more sensible anyway. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
simple-authentication.lua: tie secure cookies to field namesJason A. Donenfeld-13/+21
simple-authentication: styleJason A. Donenfeld-1/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
auth: document tweakables in lua scriptJason A. Donenfeld-0/+10
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
auth: have cgit calculate login addressJason A. Donenfeld-6/+1
This way we're sure to use virtual root, or any other strangeness encountered. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
auth: lua string comparisons are time invariantJason A. Donenfeld-2/+2
By default, strings are compared by hash, so we can remove this comment. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
authentication: use hidden form instead of refererJason A. Donenfeld-79/+121
This also gives us some CSRF protection. Note that we make use of the hmac to protect the redirect value. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
auth: add basic authentication filter frameworkJason A. Donenfeld-0/+225
This leverages the new lua support. See filters/simple-authentication.lua for explaination of how this works. There is also additional documentation in cgitrc.5.txt. Though this is a cookie-based approach, cgit's caching mechanism is preserved for authenticated pages. Very plugable and extendable depending on user needs. The sample script uses an HMAC-SHA1 based cookie to store the currently logged in user, with an expiration date. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 2026 Bryce Kwon. All Rights Deprecated.