Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Basic Auth only on protected routes #211

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
+18 −37
Open

Basic Auth only on protected routes #211

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
80d4ac0
Move "app.disable('x-powered-by')" into the auth middleware
adamgall May 13, 2020
92eea41
Remove all basic auth from app.js
adamgall May 13, 2020
cc33ff1
Wrap the baseActionsRouter export in a function that takes an "app" p…
adamgall May 13, 2020
6bd3630
Inject the auth middleware on just the RPC routes that require it
adamgall May 13, 2020
5a5f5da
Pass a "demo" parameter into auth, to selectively override auth if si…
adamgall May 13, 2020
7937a7e
If no password is set and user tries to access protected routes, thro…
adamgall May 13, 2020
de2ff1e
Merge branch 'master' into feature/selective-auth
adamgall Nov 8, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 1 addition & 8 deletions app.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,6 @@ var qrcode = require("qrcode");
var addressApi = require("./app/api/addressApi.js");
var electrumAddressApi = require("./app/api/electrumAddressApi.js");
var coreApi = require("./app/api/coreApi.js");
var auth = require('./app/auth.js');
var marked = require("marked");

var package_json = require('./package.json');
Expand All @@ -71,12 +70,6 @@ app.engine('pug', (path, options, fn) => {

app.set('view engine', 'pug');

// basic http authentication
if (process.env.BTCEXP_BASIC_AUTH_PASSWORD) {
app.disable('x-powered-by');
app.use(auth(process.env.BTCEXP_BASIC_AUTH_PASSWORD));
}

// uncomment after placing your favicon in /public
//app.use(favicon(__dirname + '/public/favicon.ico'));
//app.use(logger('dev'));
Expand Down Expand Up @@ -602,7 +595,7 @@ app.use(csurf(), (req, res, next) => {
next();
});

app.use('/', baseActionsRouter);
app.use('/', baseActionsRouter(app));
app.use('/api/', apiActionsRouter);
app.use('/snippet/', snippetActionsRouter);

Expand Down
7 changes: 6 additions & 1 deletion app/auth.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
var basicAuth = require('basic-auth');

module.exports = pass => (req, res, next) => {
module.exports = (app, pass, demo = false) => (req, res, next) => {
if (demo) return next();
if (!pass) return res.status(401).send("This section of the site requires authentication. Set an authentication password via the 'BTCEXP_BASIC_AUTH_PASSWORD' environment variable (see .env-sample file for more info).");

app.disable('x-powered-by');

var cred = basicAuth(req);

if (cred && cred.pass === pass) {
Expand Down
39 changes: 11 additions & 28 deletions routes/baseRouter.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,14 @@ var config = require("./../app/config.js");
var coreApi = require("./../app/api/coreApi.js");
var addressApi = require("./../app/api/addressApi.js");
var rpcApi = require("./../app/api/rpcApi.js");
var auth = require('./../app/auth.js');

const v8 = require('v8');

const forceCsrf = csurf({ ignoreMethods: [] });

const routerExport = app => {

router.get("/", function(req, res, next) {
if (req.session.host == null || req.session.host.trim() == "") {
if (req.cookies['rpc-host']) {
Expand Down Expand Up @@ -1179,29 +1182,13 @@ router.get("/address/:address", function(req, res, next) {
});
});

router.get("/rpc-terminal", function(req, res, next) {
if (!config.demoSite && !req.authenticated) {
res.send("RPC Terminal / Browser require authentication. Set an authentication password via the 'BTCEXP_BASIC_AUTH_PASSWORD' environment variable (see .env-sample file for more info).");

next();

return;
}

router.get("/rpc-terminal", auth(app, process.env.BTCEXP_BASIC_AUTH_PASSWORD, config.demoSite), function(req, res, next) {
res.render("rpc-terminal");

next();
});

router.post("/rpc-terminal", function(req, res, next) {
if (!config.demoSite && !req.authenticated) {
res.send("RPC Terminal / Browser require authentication. Set an authentication password via the 'BTCEXP_BASIC_AUTH_PASSWORD' environment variable (see .env-sample file for more info).");

next();

return;
}

router.post("/rpc-terminal", auth(app, process.env.BTCEXP_BASIC_AUTH_PASSWORD, config.demoSite), function(req, res, next) {
var params = req.body.cmd.trim().split(/\s+/);
var cmd = params.shift();
var parsedParams = [];
Expand Down Expand Up @@ -1256,15 +1243,7 @@ router.post("/rpc-terminal", function(req, res, next) {
});
});

router.get("/rpc-browser", function(req, res, next) {
if (!config.demoSite && !req.authenticated) {
res.send("RPC Terminal / Browser require authentication. Set an authentication password via the 'BTCEXP_BASIC_AUTH_PASSWORD' environment variable (see .env-sample file for more info).");

next();

return;
}

router.get("/rpc-browser", auth(app, process.env.BTCEXP_BASIC_AUTH_PASSWORD, config.demoSite), function(req, res, next) {
coreApi.getHelp().then(function(result) {
res.locals.gethelp = result;

Expand Down Expand Up @@ -1581,4 +1560,8 @@ router.get("/fun", function(req, res, next) {
next();
});

module.exports = router;
return router

}

module.exports = routerExport;