home/loginsrv
2
0
Fork 0
mirror of https://github.com/wahyd4/loginsrv.git synced 2026-08-09 04:46:29 +10:00
Code Issues Packages Projects Releases Wiki Activity

redirect documentation and caddy demo

Browse Source
This commit is contained in:
Sebastian Mancke
2018-01-09 23:55:55 +01:00
parent 83ccded6f0
commit b230877149
4 changed files with 30 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+25 -12
View File
@@ -60,13 +60,13 @@ _Note for Caddy users_: Not all parameters are available in Caddy. See the table
| -logout-url | string | | X | The url or path to redirect after logout |
| -osiam | value | | X | OSIAM login backend opts: endpoint=..,client_id=..,client_secret=.. |
| -port | string | "6789" | - | The port to listen on |
| -redirect | boolean | true | X | Allow dynamic overwriting of the the success by query parameter (default true) |
| -redirect-query-parameter | string | "backTo" | X | URL parameter for the redirect target (default "backTo") |
| -redirect-check-referer | boolean | true | X | Check the referer header to ensure it matches the host header on dynamic redirects |
| -redirect-host-file | string | "" | X | A file containing a list of domains that redirects are allowed to, one domain per line |
| -simple | value | | X | Simple login backend opts: user1=password,user2=password,.. |
| -success-url | string | "/" | X | The url to redirect after login |
| -allow-redirects | boolean | true | X | Allow dynamic redirects |
| -redirect-query-parameter | string | "backTo" | X | The query parameter to find the dynamic redirect in |
| -prevent-external-redirects | boolean | true | X | Prevent dynamic redirects to external domains |
| -check-referer-on-redirects | boolean | true | X | Check the referer header to ensure it matches the host header on dynamic redirects |
| -whitelist-domains-file | string | "" | X | File containing whitelist of domains for dynamic redirects, one domain per line |
| -template | string | | X | An alternative template for the login form |
| -text-logging | boolean | true | - | Log in text format instead of json |
| -jwt-refreshes | int | 0 | X | The maximum amount of jwt refreshes. |
@@ -110,14 +110,15 @@ Performs the login and returns the JWT. Depending on the content-type and parame
#### Runtime Parameters
| Parameter-Type | Parameter | Description | |
| ------------------|--------------------------------------------------|-----------------------------------------------------------|----------|
| Http-Header | Accept: text/html | Set the JWT-Token as Cookie 'jwt_token'. | default |
| Http-Header | Accept: application/jwt | Returns the JWT-Token within the body. No Cookie is set. | |
| Http-Header | Content-Type: application/x-www-form-urlencoded | Expect the credentials as form encoded parameters. | default |
| Http-Header | Content-Type: application/json | Take the credentials from the provided json object. | |
| Post-Parameter | username | The username | |
| Post-Parameter | password | The password | |
| Parameter-Type | Parameter | Description | |
| ------------------|--------------------------------------------------|-------------------------------------------------------------------|--------------|
| Http-Header | Accept: text/html | Set the JWT-Token as Cookie 'jwt_token'. | default |
| Http-Header | Accept: application/jwt | Returns the JWT-Token within the body. No Cookie is set. | |
| Http-Header | Content-Type: application/x-www-form-urlencoded | Expect the credentials as form encoded parameters. | default |
| Http-Header | Content-Type: application/json | Take the credentials from the provided json object. | |
| Post-Parameter | username | The username | |
| Post-Parameter | password | The password | |
| Get or Post | backTo | Dynamic redirect target after login (see (Redirects)[#redirects]) | -success-url |
#### Possible Return Codes
@@ -177,6 +178,17 @@ Location: /
Set-Cookie: jwt_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJib2IifQ.-51G5JQmpJleARHp8rIljBczPFanWT93d_N_7LQGUXU; HttpOnly
```
### Redirects
The api has support for a redirect query paramter, e.g. `?backTo=/dynamic/return/path`. For security reasons, the default behaviour is very restrictive:
* Only local redirects (same host) are allowed.
* The `Referer` header is checked in the way, that the call to the login page has to come from the same page.
These restrictions are there, to prevent you from unchecked redirect attacks, e.g. using your site for fishing or doing login attacks.
If you know, what you are doing, you can disable the referer check with `--redirect-check-referer=false` and provide a whitelist file
for allowed external domains with `--redirect-host-file=/some/domains.txt`.
## The JWT Token
Depending on the provider, the token may look as follows:
```
@@ -309,3 +321,4 @@ When you specify a custom template, only the layout of the original template is
</body>
</html>
```
caddy/demo/Caddyfile
+1
View File
@@ -15,6 +15,7 @@ http://localhost:8080 {
login {
success_url /private
htpasswd file=passwords
redirect_host_file ../redirect_hosts.txt
}
}
caddy/demo/redirect_hosts.txt
+1
View File
@@ -0,0 +1 @@
www.example.org
caddy/demo/webroot/index.html
+3 -1
View File
@@ -26,7 +26,9 @@
<div class="container">
<div class="jumbotron">
<h3>Caddy Login Demo Application</h3>
Please <a href="/login">login</a> with <code>demo/demo</code>.
<div>Please <a href="/login">login</a> as <code>demo/demo</code>.</div>
<div>Or <a href="/login?backTo=http://www.example.org/">login with redirect</a> as <code>demo/demo</code>.</div>
</div>
</div>