vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

pin the security headers in the swarm api 401 location property

Browse source
This commit is contained in:
atlas 2026-10-28 23:37:22 +01:00
commit ad06ce04a8
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/module-eval/core-toggle.nix
View file

@ -499,18 +499,22 @@ let
# with an error that says nothing about the session; only a request that
# asks for `text/html` gets the login. The `/` clause is the control: the
# page route still redirects, so a pass means the two routes differ.
# Each answer carries the gateway's security headers, which a location
# (or `if`) with an `add_header` of its own would otherwise drop.
name = "the controller API answers a refused bearer caller or fetch 401 and a page request the login";
ok =
let
l = allLocal.services.nginx.virtualHosts."t.local".locations;
api = l."/api/".extraConfig;
refused = l."@swarm_api_unauthorized".extraConfig;
sec = allLocal.services.hyperhive.gateway.lib.securityHeaders;
in
lib.hasInfix "error_page 401 = @swarm_api_unauthorized;" api
&& !(lib.hasInfix "=302" api)
&& lib.hasInfix ''proxy_set_header Authorization "";'' api
&& lib.hasInfix "if ($http_authorization) {\n add_header WWW-Authenticate 'Bearer realm=\"swarm\"' always;\n return 401;\n}" refused
&& lib.hasInfix "if ($http_authorization) {\n ${sec}\n add_header WWW-Authenticate 'Bearer realm=\"swarm\"' always;\n return 401;\n}" refused
&& lib.hasInfix "if ($http_accept ~* \"text/html\") {\n return 302 https://auth.t.local/?rd=$target_url;\n}" refused
&& lib.hasPrefix sec refused
&& lib.hasInfix "}\nadd_header WWW-Authenticate 'Bearer realm=\"swarm\"' always;\nreturn 401;" refused
&& lib.hasInfix "error_page 401 =302 https://auth.t.local/" l."/".extraConfig;
}