diff --git a/README.md b/README.md index d1d1605..2e7452e 100644 --- a/README.md +++ b/README.md @@ -60,13 +60,13 @@ _Note for Caddy users_: Not all parameters are available in Caddy. See the table | -logout-url | string | | X | The url or path to redirect after logout | | -osiam | value | | X | OSIAM login backend opts: endpoint=..,client_id=..,client_secret=.. | | -port | string | "6789" | - | The port to listen on | +| -redirect | boolean | true | X | Allow dynamic overwriting of the the success by query parameter (default true) | +| -redirect-query-parameter | string | "backTo" | X | URL parameter for the redirect target (default "backTo") | +| -redirect-check-referer | boolean | true | X | Check the referer header to ensure it matches the host header on dynamic redirects | +| -redirect-host-file | string | "" | X | A file containing a list of domains that redirects are allowed to, one domain per line | | -simple | value | | X | Simple login backend opts: user1=password,user2=password,.. | | -success-url | string | "/" | X | The url to redirect after login | -| -allow-redirects | boolean | true | X | Allow dynamic redirects | -| -redirect-query-parameter | string | "backTo" | X | The query parameter to find the dynamic redirect in | | -prevent-external-redirects | boolean | true | X | Prevent dynamic redirects to external domains | -| -check-referer-on-redirects | boolean | true | X | Check the referer header to ensure it matches the host header on dynamic redirects | -| -whitelist-domains-file | string | "" | X | File containing whitelist of domains for dynamic redirects, one domain per line | | -template | string | | X | An alternative template for the login form | | -text-logging | boolean | true | - | Log in text format instead of json | | -jwt-refreshes | int | 0 | X | The maximum amount of jwt refreshes. | @@ -110,14 +110,15 @@ Performs the login and returns the JWT. Depending on the content-type and parame #### Runtime Parameters -| Parameter-Type | Parameter | Description | | -| ------------------|--------------------------------------------------|-----------------------------------------------------------|----------| -| Http-Header | Accept: text/html | Set the JWT-Token as Cookie 'jwt_token'. | default | -| Http-Header | Accept: application/jwt | Returns the JWT-Token within the body. No Cookie is set. | | -| Http-Header | Content-Type: application/x-www-form-urlencoded | Expect the credentials as form encoded parameters. | default | -| Http-Header | Content-Type: application/json | Take the credentials from the provided json object. | | -| Post-Parameter | username | The username | | -| Post-Parameter | password | The password | | +| Parameter-Type | Parameter | Description | | +| ------------------|--------------------------------------------------|-------------------------------------------------------------------|--------------| +| Http-Header | Accept: text/html | Set the JWT-Token as Cookie 'jwt_token'. | default | +| Http-Header | Accept: application/jwt | Returns the JWT-Token within the body. No Cookie is set. | | +| Http-Header | Content-Type: application/x-www-form-urlencoded | Expect the credentials as form encoded parameters. | default | +| Http-Header | Content-Type: application/json | Take the credentials from the provided json object. | | +| Post-Parameter | username | The username | | +| Post-Parameter | password | The password | | +| Get or Post | backTo | Dynamic redirect target after login (see (Redirects)[#redirects]) | -success-url | #### Possible Return Codes @@ -177,6 +178,17 @@ Location: / Set-Cookie: jwt_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJib2IifQ.-51G5JQmpJleARHp8rIljBczPFanWT93d_N_7LQGUXU; HttpOnly ``` +### Redirects + +The api has support for a redirect query paramter, e.g. `?backTo=/dynamic/return/path`. For security reasons, the default behaviour is very restrictive: + +* Only local redirects (same host) are allowed. +* The `Referer` header is checked in the way, that the call to the login page has to come from the same page. + +These restrictions are there, to prevent you from unchecked redirect attacks, e.g. using your site for fishing or doing login attacks. +If you know, what you are doing, you can disable the referer check with `--redirect-check-referer=false` and provide a whitelist file +for allowed external domains with `--redirect-host-file=/some/domains.txt`. + ## The JWT Token Depending on the provider, the token may look as follows: ``` @@ -309,3 +321,4 @@ When you specify a custom template, only the layout of the original template is ``` + diff --git a/caddy/demo/Caddyfile b/caddy/demo/Caddyfile index 18abd50..f835532 100644 --- a/caddy/demo/Caddyfile +++ b/caddy/demo/Caddyfile @@ -15,6 +15,7 @@ http://localhost:8080 { login { success_url /private htpasswd file=passwords + redirect_host_file ../redirect_hosts.txt } } diff --git a/caddy/demo/redirect_hosts.txt b/caddy/demo/redirect_hosts.txt new file mode 100644 index 0000000..9e42a1c --- /dev/null +++ b/caddy/demo/redirect_hosts.txt @@ -0,0 +1 @@ +www.example.org diff --git a/caddy/demo/webroot/index.html b/caddy/demo/webroot/index.html index 174ae33..cab2bc9 100644 --- a/caddy/demo/webroot/index.html +++ b/caddy/demo/webroot/index.html @@ -26,7 +26,9 @@

Caddy Login Demo Application

- Please login with demo/demo. +
Please login as demo/demo.
+ +
Or login with redirect as demo/demo.