Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow Token API calls be authorized using the reverse-proxy header #15119

Merged
merged 13 commits into from
Nov 19, 2021
Merged
13 changes: 10 additions & 3 deletions routers/api/v1/api.go
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
//
// Security:
// - BasicAuth :
// - ReverseProxyAuth :
zeripath marked this conversation as resolved.
Show resolved Hide resolved
// - Token :
// - AccessToken :
// - AuthorizationHeaderToken :
Expand All @@ -32,6 +33,9 @@
// SecurityDefinitions:
// BasicAuth:
// type: basic
// ReverseProxyAuth:
// type: reverseProxy
// description: Reverse proxy auth using HTTP header.
zeripath marked this conversation as resolved.
Show resolved Hide resolved
// Token:
// type: apiKey
// name: token
Expand Down Expand Up @@ -212,10 +216,13 @@ func reqExploreSignIn() func(ctx *context.APIContext) {
}
}

func reqBasicAuth() func(ctx *context.APIContext) {
func reqBasicOrRevProxyAuth() func(ctx *context.APIContext) {
return func(ctx *context.APIContext) {
if ctx.IsSigned && setting.Service.EnableReverseProxyAuth {
return
}
if !ctx.Context.IsBasicAuth {
ctx.Error(http.StatusUnauthorized, "reqBasicAuth", "basic auth required")
ctx.Error(http.StatusUnauthorized, "reqBasicOrRevProxyAuth", "auth required")
return
}
ctx.CheckForOTP()
Expand Down Expand Up @@ -625,7 +632,7 @@ func Routes() *web.Route {
m.Combo("").Get(user.ListAccessTokens).
Post(bind(api.CreateAccessTokenOption{}), user.CreateAccessToken)
m.Combo("/{id}").Delete(user.DeleteAccessToken)
}, reqBasicAuth())
}, reqBasicOrRevProxyAuth())
})
})

Expand Down