tdsds.com/gitea
1
1
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2025-11-03 21:08:25 +00:00
Code Releases Activity

Fix basic auth with webauthn (#32531) (#32536)

Browse Source 
Backport #32531 by @lunny

WebAuthn should behave the same way as TOTP. When enabled, basic auth
with username/password should need to WebAuthn auth, otherwise returned
401.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
This commit is contained in:
Giteabot
2024-11-17 02:21:00 +08:00
committed by GitHub
parent b6eef34874
commit 6555cfcac3
2 changed files with 63 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
services/auth/basic.go
View File

@@ -5,6 +5,7 @@
package auth
import (
"errors"
"net/http"
"strings"
@@ -141,6 +142,15 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore
}
if skipper, ok := source.Cfg.(LocalTwoFASkipper); !ok || !skipper.IsSkipLocalTwoFA() {
// Check if the user has webAuthn registration
hasWebAuthn, err := auth_model.HasWebAuthnRegistrationsByUID(req.Context(), u.ID)
if err != nil {
return nil, err
}
if hasWebAuthn {
return nil, errors.New("Basic authorization is not allowed while webAuthn enrolled")
}
if err := validateTOTP(req, u); err != nil {
return nil, err
}

53
tests/integration/api_twofa_test.go
View File

@@ -53,3 +53,56 @@ func TestAPITwoFactor(t *testing.T) {
req.Header.Set("X-Gitea-OTP", passcode)
MakeRequest(t, req, http.StatusOK)
}
func TestBasicAuthWithWebAuthn(t *testing.T) {
defer tests.PrepareTestEnv(t)()
// user1 has no webauthn enrolled, he can request API with basic auth
user1 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
unittest.AssertNotExistsBean(t, &auth_model.WebAuthnCredential{UserID: user1.ID})
req := NewRequest(t, "GET", "/api/v1/user")
req.SetBasicAuth(user1.Name, "password")
MakeRequest(t, req, http.StatusOK)
// user1 has no webauthn enrolled, he can request git protocol with basic auth
req = NewRequest(t, "GET", "/user2/repo1/info/refs")
req.SetBasicAuth(user1.Name, "password")
MakeRequest(t, req, http.StatusOK)
// user1 has no webauthn enrolled, he can request container package with basic auth
req = NewRequest(t, "GET", "/v2/token")
req.SetBasicAuth(user1.Name, "password")
resp := MakeRequest(t, req, http.StatusOK)
type tokenResponse struct {
Token string `json:"token"`
}
var tokenParsed tokenResponse
DecodeJSON(t, resp, &tokenParsed)
assert.NotEmpty(t, tokenParsed.Token)
// user32 has webauthn enrolled, he can't request API with basic auth
user32 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 32})
unittest.AssertExistsAndLoadBean(t, &auth_model.WebAuthnCredential{UserID: user32.ID})
req = NewRequest(t, "GET", "/api/v1/user")
req.SetBasicAuth(user32.Name, "notpassword")
resp = MakeRequest(t, req, http.StatusUnauthorized)
type userResponse struct {
Message string `json:"message"`
}
var userParsed userResponse
DecodeJSON(t, resp, &userParsed)
assert.EqualValues(t, "Basic authorization is not allowed while webAuthn enrolled", userParsed.Message)
// user32 has webauthn enrolled, he can't request git protocol with basic auth
req = NewRequest(t, "GET", "/user2/repo1/info/refs")
req.SetBasicAuth(user32.Name, "notpassword")
MakeRequest(t, req, http.StatusUnauthorized)
// user32 has webauthn enrolled, he can't request container package with basic auth
req = NewRequest(t, "GET", "/v2/token")
req.SetBasicAuth(user1.Name, "notpassword")
MakeRequest(t, req, http.StatusUnauthorized)
}