Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix Basic Auth Configuration for Multiple Paths #267

Merged
merged 6 commits into from
Nov 1, 2023
Merged

Fix Basic Auth Configuration for Multiple Paths #267

merged 6 commits into from
Nov 1, 2023

Conversation

rathahin
Copy link

Types of changes

  • Bug fix (a non-breaking change which fixes an issue)
  • New feature (a non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Description

The existing implementation of basic authentication works partially when multiple routes are specified. The .some() method used in the code causes it to return as soon as one matching path is found, leading to incorrect behavior for additional paths.

This change replaces the .some() method with individual variables to track the exclude and include lists. It uses .some() to update these variables and then checks them to decide whether to block the request.

This fix ensures that all specified paths in both the exclude and include arrays are correctly checked. It provides a clearer and more accurate way to handle basic authentication for multiple routes.

Resolves: #[Issue Number]

Checklist:

  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes (if not applicable, please state why)

@vercel
Copy link

vercel bot commented Oct 26, 2023 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
nuxt-security ✅ Ready (Inspect) Visit Preview 💬 Add feedback Oct 31, 2023 1:47pm

Baroshem
Baroshem requested changes Oct 27, 2023
View reviewed changes
Copy link
Owner

@Baroshem Baroshem left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One small issue. If you revert it, it should be ready to review and further merge :)

pnpm-lock.yaml Outdated Show resolved Hide resolved
Baroshem
Baroshem approved these changes Oct 30, 2023
View reviewed changes
Copy link
Owner

@Baroshem Baroshem left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@Baroshem Baroshem changed the base branch from main to chore/1.0.0-rc.3 October 30, 2023 10:32
@Baroshem
Copy link
Owner

Hey @rathahin

Could you please adjust the unit tests to fix the CI?

@Baroshem Baroshem linked an issue Oct 30, 2023 that may be closed by this pull request
basicAuth Configuration Not Working Properly for Multiple Routes #266
Closed
Ensure that when exclusion is not configured, access to the entire gl…
d8df6ed 
…obal site is permitted, with only the inclusion criteria taking effect.
@Baroshem
Copy link
Owner

Baroshem commented Nov 1, 2023

Thanks @rathahin 💚

I will merge it now to the rc branch, conduct some tests and will release a new RC version today :)

@Baroshem Baroshem merged commit 76841ce into Baroshem:chore/1.0.0-rc.3 Nov 1, 2023
3 checks passed
@Baroshem
Copy link
Owner

Baroshem commented Nov 1, 2023

Thank you @rathahin ! 💚

dargmuesli added a commit to maevsi/maevsi that referenced this pull request Nov 2, 2023
@dargmuesli
chore(deps): update dependency nuxt-security to v1.0.0-rc.3 (#1421)
31672c3 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [nuxt-security](https://nuxt-security.vercel.app)
([source](https://togithub.com/Baroshem/nuxt-security)) | [`1.0.0-rc.2`
->
`1.0.0-rc.3`](https://renovatebot.com/diffs/npm/nuxt-security/1.0.0-rc.2/1.0.0-rc.3)
|
[![age](https://developer.mend.io/api/mc/badges/age/npm/nuxt-security/1.0.0-rc.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/nuxt-security/1.0.0-rc.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/nuxt-security/1.0.0-rc.2/1.0.0-rc.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nuxt-security/1.0.0-rc.2/1.0.0-rc.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>Baroshem/nuxt-security (nuxt-security)</summary>

###
[`v1.0.0-rc.3`](https://togithub.com/Baroshem/nuxt-security/releases/tag/v1.0.0-rc.3):
1.0.0-rc.3

[Compare
Source](https://togithub.com/Baroshem/nuxt-security/compare/42f7399289e8edc50b2c68e1e70b1012ac95d8dd...v1.0.0-rc.3)

> 1.0.0-rc.3 is the next release candidate

#### 🗞️ Next steps

We are planning to release one or two more release candidate versions
with bugfixes before a stable 1.0.0 version will be released.

#### ✅ Migration Guide

This version includes ⚠️ breaking changes but don't worry, we have
prepared migration guide for you 😉

#####

In the previous version, `nonce` could be either an object with a type
`NonceOptions` or `false`.

```ts
export type NonceOptions = {
  enabled: boolean;
  mode?: 'renew' | 'check';
  value?: (() => string);
}
```

Now it is only a boolean value:

```ts
export default defineNuxtConfig({
  security: {
    nonce: true | false
  }
}
```

This change was necessary to resolve security vulnerability for nonce
reported by vejja
[Baroshem/nuxt-security#257.
Read more about the new usage of nonce in this module
https://nuxt-security.vercel.app/documentation/headers/csp#nonce

👉 Changelog
[compare
changes](https://togithub.com/Baroshem/nuxt-security/compare/v1.0.0-rc.1...v1.0.0-rc.3)

#### 🚀 Enhancements

-   Add `credentialless` value to `Cross-Origin-Embedder-Policy` header
-   Export configuration type
-   Improve CSP Compliance
-   ensure csp plugins are added last
-   Extend CSP support of SSG mode
-   use cheerio HTML parser for CSP

#### 🩹 Fixes

-   Basic Auth Configuration for Multiple Paths
- Nonce value is injected in all pre-rendered pages if the `nonce`
option is set to `true`

#### 📖 Documentation

-   Clarify rateLimiter `interval` property

#### 🏡 Chore

-   Improve TS config

#### ⚠️ Breaking Changes

-   CSP Compliance

#### ❤️ Contributors

- Espen Solli Grande ([@&#8203;espensgr](https://togithub.com/espensgr))
-   vejja ([@&#8203;vejja](https://togithub.com/vejja))
-   Tristan ([@&#8203;Tristan971](https://togithub.com/Tristan971))
- Jonas Thelemann
([@&#8203;dargmuesli](https://togithub.com/dargmuesli))
-   nsratha ([@&#8203;rathahin](https://togithub.com/rathahin))

#### 🏋️‍♂️ New Contributors

- [@&#8203;espensgr](https://togithub.com/espensgr) made their first
contribution in
[Baroshem/nuxt-security#261
- [@&#8203;vejja](https://togithub.com/vejja) made their first
contribution in
[Baroshem/nuxt-security#245
- [@&#8203;rathahin](https://togithub.com/rathahin) made their first
contribution in
[Baroshem/nuxt-security#267

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/maevsi/maevsi).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zMS41IiwidXBkYXRlZEluVmVyIjoiMzcuMzEuNSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciJ9-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Baroshem Baroshem Baroshem approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

basicAuth Configuration Not Working Properly for Multiple Routes
2 participants
@rathahin @Baroshem