diff options
| author | Roland Reichwein <mail@reichwein.it> | 2020-04-15 20:01:25 +0200 |
|---|---|---|
| committer | Roland Reichwein <mail@reichwein.it> | 2020-04-15 20:01:25 +0200 |
| commit | f6e703a938a95c555b388f79966cf955c5d07dc6 (patch) | |
| tree | f47eae93adf9f72b1472ced2a1a051e90845dafe /response.cpp | |
| parent | 1ce0bb7ad50129fbab6c0a75f18eee6149ca1be3 (diff) | |
HTTP Auth (Basic)
Diffstat (limited to 'response.cpp')
| -rw-r--r-- | response.cpp | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/response.cpp b/response.cpp index 8f66c54..0c619a2 100644 --- a/response.cpp +++ b/response.cpp @@ -1,4 +1,6 @@ #include "response.h" + +#include "base64.h" #include "file.h" #include <boost/algorithm/string/predicate.hpp> @@ -183,6 +185,8 @@ response_type HttpStatus(std::string status, std::string message, response_type& { res.result(unsigned(stoul(status))); res.set(http::field::content_type, "text/html"); + if (res.result_int() == 401) + res.set(http::field::www_authenticate, "Basic realm=\"Webbox Login\""); res.body() = "<html><body><h1>"s + VersionString + " Error</h1><p>"s + status + " "s + message + "</p></body></html>"s; res.prepare_payload(); @@ -201,6 +205,30 @@ response_type generate_response(request_type& req, Server& server) try { RequestContext req_ctx{req, server}; // can throw std::out_of_range + auto& auth{req_ctx.GetPath().auth}; + if (auth.size() != 0) { + std::string authorization{req[http::field::authorization]}; + if (authorization.substr(0, 6) != "Basic "s) + return HttpStatus("401", "Bad Authorization Type", res); + + authorization = authorization.substr(6); + authorization = decode64(authorization); + + size_t pos {authorization.find(':')}; + if (pos == authorization.npos) + return HttpStatus("401", "Bad Authorization Encoding", res); + + std::string login{authorization.substr(0, pos)}; + std::string password{authorization.substr(pos + 1)}; + + auto it {auth.find(login)}; + if (it == auth.end()) + return HttpStatus("401", "Bad Authorization", res); + + if (it->second != password) + return HttpStatus("401", "Bad Authorization", res); // should be same message as previous one to prevent login guessing + } + plugin_type plugin{req_ctx.GetPlugin()}; auto GetServerParamFunction {std::function<std::string(const std::string& key)>(std::bind(GetServerParam, _1, std::ref(server)))}; |