Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't log error for HEAD requests which later match a GET route #1098

Closed
mcserv opened this issue Aug 20, 2019 · 11 comments
Closed

Don't log error for HEAD requests which later match a GET route #1098

mcserv opened this issue Aug 20, 2019 · 11 comments
Labels
accepted An accepted request or suggestion suggestion A suggestion to change functionality

Comments

@mcserv
Copy link

mcserv commented Aug 20, 2019

I get this warning in "production" environment, with log level set only to critical.

I'm not sure if it matters for this case, but it's running inside docker container with linux alpine, hosted on heroku, compiled with target x86_64-unknown-linux-musl.

I use latest rocket version (rocket = "0.4") and latest nightly (today's build). Same version for rocket_contrib.

I am also using Tera templating engine fairing, and routing to / like this:

use std::collections::HashMap;

use rocket_contrib::templates::Template;

#[rocket::get("/")]
pub(crate) fn index() -> Template {
    let context = HashMap::<String, String>::new();

    Template::render("index", context)
}

Of course, it's mounted like this:

.mount("/", rocket::routes![routes::website::index])

Accessing / using GET is alright, works as expected.

Rocket claims that it handles HEAD requests automatically if there would be matching GET anyway...

But every time I try to send HEAD request (using https://apitester.com/):

HEAD / HTTP/1.1
Host: sahsahae.herokuapp.com
Accept: */*
User-Agent: Mozilla/5.0 (compatible; Rigor/1.0.0; http://rigor.com)

I get this output:

HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 657
Content-Type: text/html; charset=utf-8
Date: Tue, 20 Aug 2019 21:52:16 GMT
Server: Rocket
Via: 1.1 vegur

And yet, it displays this error message every time I try to access it using HEAD?

For example, now I requested HEAD 5 times in a row:

2019-08-20T21:56:51.300655+00:00 app[web.1]: Error: No matching routes for HEAD /.
2019-08-20T21:56:51.307382+00:00 heroku[router]: at=info method=HEAD path="/" ... status=200 protocol=https
2019-08-20T21:56:52.291467+00:00 heroku[router]: at=info method=HEAD path="/" ... status=200 protocol=https
2019-08-20T21:56:52.284715+00:00 app[web.1]: Error: No matching routes for HEAD /.
2019-08-20T21:56:52.950319+00:00 app[web.1]: Error: No matching routes for HEAD /.
2019-08-20T21:56:52.957171+00:00 heroku[router]: at=info method=HEAD path="/" ... status=200 protocol=https
2019-08-20T21:56:54.248074+00:00 heroku[router]: at=info method=HEAD path="/" ... status=200 protocol=https
2019-08-20T21:56:54.241197+00:00 app[web.1]: Error: No matching routes for HEAD /.
2019-08-20T21:56:54.934550+00:00 app[web.1]: Error: No matching routes for HEAD /.
2019-08-20T21:56:54.941391+00:00 heroku[router]: at=info method=HEAD path="/" ... status=200 protocol=https

Each time it fails, but returns 200 OK.

What could be the issue?

@mcserv mcserv changed the title Error: No matching routes for HEAD / text/html. Error: No matching routes for HEAD / . Aug 20, 2019
@jebrosen
Copy link
Collaborator

I believe this or almost this was discussed in #606, which was moved to #21. If I remember correctly, the only problem here is the logging: You will get "ERROR: No matching routes for HEAD /" but not the following message that it will be handled anyway by trying the corresponding GET request and the successful response.

@jebrosen jebrosen added the question A question (converts to discussion) label Aug 21, 2019
@mcserv
Copy link
Author

mcserv commented Aug 22, 2019

I see, the duplication then seems to be related to the way log levels are handled?

In my opinion, such reroute notice should be debug level log, but for some reason, it also gets sent as a critical type of log, which is the only kind of logs my configuration is set to display.

I was mainly confused because heroku router would forward 200 OK even if rocket itself shows critical Error.

Thanks for clarification, hopefully this will be fixed :)

@SergioBenitez
Copy link
Member

@sahsahae That's correct. Effectively, the router comes along and searches for something matching the HEAD request, just as it would any other request. If it fails to find something, it emits an error log indicating so, just like it would for any other request. Unlike any other request, however, the router then tries to find a GET request that otherwise matches, which succeeds (in your case), and the response is then returned. Of course, the error has already been logged at this point, even though it is effectively a false negative.

To provide better behavior here, we would need to hold off on logging the error message until we try a GET request first. If the GET request succeeds, we'd probably want to log a warning instead of an error. If it fails, we can log the error as today.

As the code stands today, I can't find an elegant way to accomplish this. I'll leave this issue open to keep it in mind. It's certainly something we should fix, irrespective of #21.

@jebrosen jebrosen added accepted An accepted request or suggestion suggestion A suggestion to change functionality and removed question A question (converts to discussion) labels Dec 21, 2019
@SergioBenitez SergioBenitez changed the title Error: No matching routes for HEAD / . Don't log error for HEAD requests which later match a GET route Jul 1, 2021
@shaoxp
Copy link

shaoxp commented Jul 29, 2021

can we config a route with both GET and HEAD method ? this can also help to mitigate the issue here. currently, i am duplicating a route with HEAD to clear the error log.

@jblachly
Copy link

can we config a route with both GET and HEAD method ? this can also help to mitigate the issue here. currently, i am duplicating a route with HEAD to clear the error log.

Ideally, HEAD would be automatically generated from the GET route by introspecting on its (successful) return type, no? It should (could) be automatically generated.

@the10thWiz
Copy link
Collaborator

While certainly possible, this would require some significant changes to the routes macro, since it would need to mount two routes for every GET route. The current solution also extends to routes that don't take advantage of the codegen, while this solution wouldn't.

@jinakola
Copy link

To provide better behavior here, we would need to hold off on logging the error message until we try a GET request first. If the GET request succeeds, we'd probably want to log a warning instead of an error. If it fails, we can log the error as today.

Could this be implemented as always warning if no matching HEAD was found? This way if GET request succeeds we are left with one warning from HEAD and if it fails we are left with one warning from HEAD and one error from GET

jjlin added a commit to jjlin/vaultwarden that referenced this issue Mar 5, 2023
Rocket automatically implements a HEAD route when there's a matching GET
route, but relying on this behavior also means a spurious error gets
logged due to <rwf2/Rocket#1098>.

Add explicit HEAD routes for `/` and `/alive` to prevent uptime monitoring
services from generating error messages like `No matching routes for HEAD /`.
With these new routes, `HEAD /` only checks that the server can respond over
the network, while `HEAD /alive` also checks that the database connection is
alive, similar to `GET /alive`.
@tessus
Copy link

tessus commented Mar 5, 2023

@SergioBenitez

As the code stands today, I can't find an elegant way to accomplish this.

What I don't fully understand is why rocket would throw an error message for HEAD, when nobody created a HEAD route.

jjlin mentioned that rocket automatically implements a HEAD route when there's a matching GET route, but I don't understand why this is needed in the first place. If I wanted a HEAD route, I would add one. Why does rocket do this autmatically?

Either way, the solution to this problem is rather obvious. Do not let rocket create a HEAD route when I don't ask for it.

But maybe I am missing something crucial here.

jjlin added a commit to jjlin/vaultwarden that referenced this issue Mar 5, 2023
Rocket automatically implements a HEAD route when there's a matching GET
route, but relying on this behavior also means a spurious error gets
logged due to <rwf2/Rocket#1098>.

Add explicit HEAD routes for `/` and `/alive` to prevent uptime monitoring
services from generating error messages like `No matching routes for HEAD /`.
With these new routes, `HEAD /` only checks that the server can respond over
the network, while `HEAD /alive` also checks that the database connection is
alive, similar to `GET /alive`.
Ping-timeout pushed a commit to Ping-timeout/vaultwarden that referenced this issue Apr 3, 2023
* Fix remaning inline format

* Use more modern meta tag for charset encoding

* fix (2fa.directory): Allow api.2fa.directory, and remove 2fa.directory

* Optimize CipherSyncData for very large vaults

As mentioned in dani-garcia#3111, using a very very large vault causes some issues.
Mainly because of a SQLite limit, but, it could also cause issue on
MariaDB/MySQL or PostgreSQL. It also uses a lot of memory, and memory
allocations.

This PR solves this by removing the need of all the cipher_uuid's just
to gather the correct attachments.

It will use the user_uuid and org_uuid's to get all attachments linked
to both, weither the user has access to them or not. This isn't an
issue, since the matching is done per cipher and the attachment data is
only returned if there is a matching cipher to where the user has access to.

I also modified some code to be able to use `::with_capacity(n)` where
possible. This prevents re-allocations if the `Vec` increases size,
which will happen a lot if there are a lot of ciphers.

According to my tests measuring the time it takes to sync, it seems to
have lowered the duration a bit more.

Fixes dani-garcia#3111

* Add MFA icon to org member overview

The Organization member overview supports showing an icon if the user
has MFA enabled or not. This PR adds this feature.

This is very useful if you want to enable force mfa for example.

* Add avatar color support

The new web-vault v2023.1.0 supports a custom color for the avatar.
bitwarden/server#2330

This PR adds this feature.

* Update Rust to v1.66.1 to patch CVE

This PR sets Rust to v1.66.1 to fix a CVE.
https://blog.rust-lang.org/2023/01/10/cve-2022-46176.html
https://blog.rust-lang.org/2023/01/10/Rust-1.66.1.html

Also updated some packages while at it.

* Use more modern meta tag for charset encoding

* Use more modern meta tag for charset encoding

* Fix remaning inline format

* Use more modern meta tag for charset encoding

* Fix remaning inline format

* fix (2fa.directory): Allow api.2fa.directory, and remove 2fa.directory

* Use more modern meta tag for charset encoding

* Fix remaning inline format

* fix (2fa.directory): Allow api.2fa.directory, and remove 2fa.directory

* Add MFA icon to org member overview

The Organization member overview supports showing an icon if the user
has MFA enabled or not. This PR adds this feature.

This is very useful if you want to enable force mfa for example.

* Use more modern meta tag for charset encoding

* Fix remaning inline format

* fix (2fa.directory): Allow api.2fa.directory, and remove 2fa.directory

* Add MFA icon to org member overview

The Organization member overview supports showing an icon if the user
has MFA enabled or not. This PR adds this feature.

This is very useful if you want to enable force mfa for example.

* Update Rust to v1.66.1 to patch CVE

This PR sets Rust to v1.66.1 to fix a CVE.
https://blog.rust-lang.org/2023/01/10/cve-2022-46176.html
https://blog.rust-lang.org/2023/01/10/Rust-1.66.1.html

Also updated some packages while at it.

* Use more modern meta tag for charset encoding

* Fix remaning inline format

* fix (2fa.directory): Allow api.2fa.directory, and remove 2fa.directory

* Add MFA icon to org member overview

The Organization member overview supports showing an icon if the user
has MFA enabled or not. This PR adds this feature.

This is very useful if you want to enable force mfa for example.

* Update Rust to v1.66.1 to patch CVE

This PR sets Rust to v1.66.1 to fix a CVE.
https://blog.rust-lang.org/2023/01/10/cve-2022-46176.html
https://blog.rust-lang.org/2023/01/10/Rust-1.66.1.html

Also updated some packages while at it.

* Add avatar color support

The new web-vault v2023.1.0 supports a custom color for the avatar.
bitwarden/server#2330

This PR adds this feature.

* Update web vault to 2023.1.0

* include key into user.set_password

* include key into user.set_password

* Validate note sizes on key-rotation.

We also need to validate the note sizes on key-rotation.
If we do not validate them before we store them, that could lead to a
partial or total loss of the password vault. Validating these
restrictions before actually processing them to store/replace the
existing ciphers should prevent this.

There was also a small bug when using web-sockets. The client which is
triggering the password/key-rotation change should not be forced to
logout via a web-socket request. That is something the client will
handle it self. Refactored the logout notification to either send the
device uuid or not on specific actions.

Fixes dani-garcia#3152

* include key into user.set_password

* Update KDF Configuration and processing

- Change default Password Hash KDF Storage from 100_000 to 600_000 iterations
- Update Password Hash when the default iteration value is different
- Validate password_iterations
- Validate client-side KDF to prevent it from being set lower than 100_000

* include key into user.set_password

* Validate note sizes on key-rotation.

We also need to validate the note sizes on key-rotation.
If we do not validate them before we store them, that could lead to a
partial or total loss of the password vault. Validating these
restrictions before actually processing them to store/replace the
existing ciphers should prevent this.

There was also a small bug when using web-sockets. The client which is
triggering the password/key-rotation change should not be forced to
logout via a web-socket request. That is something the client will
handle it self. Refactored the logout notification to either send the
device uuid or not on specific actions.

Fixes dani-garcia#3152

* Updated web vault to 2023.1.1 and rust dependencies

* Re-License Vaultwarden to AGPLv3

This commit prepares Vaultwarden for the Re-Licensing to AGPLv3
Solves #2450

* Remove `arm32v6`-specific tag

This section of code seems to be breaking the Docker release workflow as of a
few days ago, though it's unclear why. This tag only existed to work around
an issue with Docker pulling the wrong image for ARMv6 platforms; that issue
was resolved in Docker 20.10.0, which has been out for a few years now, so it
seems like a reasonable time to drop this tag.

* Rename `.buildx` Dockerfiles to `.buildkit`

This is a more accurate name, since these Dockerfiles require BuildKit, not Buildx.

* Disable Hadolint check for consecutive `RUN` instructions (DL3059)

This check doesn't seem to add enough value to justify the difficulties it
tends to create when generating `RUN` instructions from a template.

* added database migration

* working implementation

* fixes for current upstream main

* "Spell-Jacking" mitigation ~ prevent sensitive data leak from spell checker.
@see https://www.otto-js.com/news/article/chrome-and-edge-enhanced-spellcheck-features-expose-pii-even-your-passwords

* Fix Javascript issue on non sqlite databases

When a non sqlite database is used, loading the admin interface fails
because the backup button is not generated.
This PR is solves it by checking if the elements are valid.

Also made some other changes and fixed some eslint errors.
Showing `_post` errors is better now.

Update jquery to latest version.

Fixes dani-garcia#3166

* Allow listening on privileged ports (below 1024) as non-root

This is done by running `setcap cap_net_bind_service=+ep` on the executable
in the build stage (doing it in the runtime stage creates an extra copy of
the executable that bloats the image). This only works when using the
BuildKit-based builder, since the `COPY` instruction doesn't copy
capabilities on the legacy builder.

* don't nullify key when editing emergency access

the client does not send the key on every update of an emergency access
contact so the field would be emptied on a change of the wait days or access level.

* Replaced wrong mysql column type

* improved security, disabling policy usage on
email-disabled clients and some refactoring

* rust lang specific improvements

* completly hide reset password policy
on email disabled instances

* change description of domain configuration

Vaultwarden send won't work if the domain includes a trailing slash.
This should be documented, as it may lead to confusion amoung users.

* improve wording of domain description

* Generate distinct log messages for regex vs. IP blacklisting.

When an icon will not be downloaded due to matching a configured
blacklist, ensure that the log message indicates the type of blacklist
that was matched.

* Ensure that all results from check_domain_blacklist_reason are cached.

* remove documentation of bug since I'm fixing it

* fix trailing slash not being removed from domain

* allow editing/unhiding by group

Fixes dani-garcia#2989

Signed-off-by: Jan Jansen <jan.jansen@gdata.de>

* Revert "fix trailing slash not being removed from domain"

This reverts commit 679bc7a.

* fix trailing slash in configuration builder

* remove warn when sanitizing domain

* add argon2 kdf fields

* Add support for sendmail as a mail transport

* check if SENDMAIL_COMMAND is valid using 'which' crate

* add EXE_SUFFIX to sendmail executable when not specified

* Updated Rust and crates

- Updated Rust to v1.67.0
- Updated all crates except for `cookies` and `webauthn`

* docs: add build status badge in readme

* Fix Organization delete when groups are configured

With existing groups configured within an org, deleting that org would
fail because of Foreign Key issues.

This PR fixes this by making sure the groups get deleted before the org does.

Fixes dani-garcia#3247

* Fix Collection Read Only access for groups

I messed up with identation sorry it's my first PR

Fix Collection Read Only access for groups

Fix Collection Read Only access for groups

With indentation modification

* Validate all needed fields for client API login

During the client API login we need to have a `device_identifier`, `device_name` and `device_type`.
When these were not provided Vaultwarden would panic.

This PR add checks for these fields and makes sure it returns a better error message instead of causing a panic.

* Make the admin cookie lifetime adjustable

* Add function to fetch user by email address

* Apply Admin Session Lifetime to JWT

* Apply rewording

* docs: add build status badge in readme

* docs: add build status badge in readme

* Validate all needed fields for client API login

During the client API login we need to have a `device_identifier`, `device_name` and `device_type`.
When these were not provided Vaultwarden would panic.

This PR add checks for these fields and makes sure it returns a better error message instead of causing a panic.

* docs: add build status badge in readme

* Validate all needed fields for client API login

During the client API login we need to have a `device_identifier`, `device_name` and `device_type`.
When these were not provided Vaultwarden would panic.

This PR add checks for these fields and makes sure it returns a better error message instead of causing a panic.

* Fix Organization delete when groups are configured

With existing groups configured within an org, deleting that org would
fail because of Foreign Key issues.

This PR fixes this by making sure the groups get deleted before the org does.

Fixes dani-garcia#3247

* docs: add build status badge in readme

* Validate all needed fields for client API login

During the client API login we need to have a `device_identifier`, `device_name` and `device_type`.
When these were not provided Vaultwarden would panic.

This PR add checks for these fields and makes sure it returns a better error message instead of causing a panic.

* Fix Organization delete when groups are configured

With existing groups configured within an org, deleting that org would
fail because of Foreign Key issues.

This PR fixes this by making sure the groups get deleted before the org does.

Fixes dani-garcia#3247

* Fix Collection Read Only access for groups

I messed up with identation sorry it's my first PR

Fix Collection Read Only access for groups

Fix Collection Read Only access for groups

With indentation modification

* docs: add build status badge in readme

* Validate all needed fields for client API login

During the client API login we need to have a `device_identifier`, `device_name` and `device_type`.
When these were not provided Vaultwarden would panic.

This PR add checks for these fields and makes sure it returns a better error message instead of causing a panic.

* Fix Organization delete when groups are configured

With existing groups configured within an org, deleting that org would
fail because of Foreign Key issues.

This PR fixes this by making sure the groups get deleted before the org does.

Fixes dani-garcia#3247

* Fix Collection Read Only access for groups

I messed up with identation sorry it's my first PR

Fix Collection Read Only access for groups

Fix Collection Read Only access for groups

With indentation modification

* Make the admin cookie lifetime adjustable

* Apply Admin Session Lifetime to JWT

* Apply rewording

* Add missing collections/details endpoint, based on the existing one

* Update web vault to v2023.2.0 and dependencies

* Fix vault item display in org vault view

In the org vault view, the Bitwarden web vault currently tries to fetch the
groups for an org regardless of whether it claims to have group support.
If this errors out, no vault items are displayed.

* Add confirmation for removing 2FA and deauth sessions in admin panel

* Fix the web-vault v2023.2.0 API calls

- Supports the new Collection/Group/User editing UI's
- Support `/partial` endpoint for cipher updating to allow folder and favorite update for read-only ciphers.
- Prevent `Favorite`, `Folder`, `read-only` and `hide-passwords` from being added to the organizational sync.
- Added and corrected some `Object` key's to the output json.

Fixes dani-garcia#3279

* Some Admin Interface updates

- Updated datatables
- Added NTP Time check
- Added Collections, Groups and Events count for orgs
- Renamed `Items` to `Ciphers`
- Some small style updates

* Fix confirmation for removing 2FA and deauthing sessions in admin panel

* Admin token Argon2 hashing support

Added support for Argon2 hashing support for the `ADMIN_TOKEN` instead
of only supporting a plain text string.

The hash must be a PHC string which can be generated via the `argon2`
CLI **or** via the also built-in hash command in Vaultwarden.

You can simply run `vaultwarden hash` to generate a hash based upon a
password the user provides them self.

Added a warning during startup and within the admin settings panel is
the `ADMIN_TOKEN` is not an Argon2 hash.

Within the admin environment a user can ignore that warning and it will
not be shown for at least 30 days. After that the warning will appear
again unless the `ADMIN_TOKEN` has be converted to an Argon2 hash.

I have also tested this on my RaspberryPi 2b and there the `Bitwarden`
preset takes almost 4.5 seconds to generate/verify the Argon2 hash.

Using the `OWASP` preset it is below 1 second, which I think should be
fine for low-graded hardware. If it is needed people could use lower
memory settings, but in those cases I even doubt Vaultwarden it self
would run. They can always use the `argon2` CLI and generate a faster hash.

* Add HEAD routes to avoid spurious error messages

Rocket automatically implements a HEAD route when there's a matching GET
route, but relying on this behavior also means a spurious error gets
logged due to <rwf2/Rocket#1098>.

Add explicit HEAD routes for `/` and `/alive` to prevent uptime monitoring
services from generating error messages like `No matching routes for HEAD /`.
With these new routes, `HEAD /` only checks that the server can respond over
the network, while `HEAD /alive` also checks that the database connection is
alive, similar to `GET /alive`.

* Fix web-vault Member UI show/edit/save

There was a small bug left in regards to the web-vault v2023.2.0 fixes.
This PR fixes the left items. I think all should be addressed now.
When editing a User, you were not able to see or edit groups, or see
wich collections a user bellonged to.

Fixes dani-garcia#3311

* Upd Crates, Rust, MSRV, GHA and remove Backtrace

- Changed MSRV to v1.65.
  Discussed this with @dani-garcia, and we will support **N-2**.
  This is/will be the same as for the `time` crate we use.
  Also updated the wiki regarding this https://github.com/dani-garcia/vaultwarden/wiki/Building-binary
- Removed backtrace crate in favor of `std::backtrace` stable since v1.65
- Updated Rust to v1.67.1
- Updated all the crates
- Updated the GHA action versions
- Adjusted the GHA MSRV build to extract the MSRV from `Cargo.toml`

* Merge ClientIp with Headers.

Since we now use the `ClientIp` Guard on a lot more places, it also
increases the size of binary, and the macro generated code because of
this extra Guard. By merging the `ClientIp` Guard with the several
`Header` guards we have it reduces the amount of code generated
(including LLVM IR), but also a small speedup in build time.

I also spotted some small `json!()` optimizations which also reduced the
amount of code generated.

* Add support for `/api/devices/knowndevice` with HTTP header params

Upstream PR: bitwarden/server#2682

* Update Rust, MSRV and Crates

- Updated all the crates
- Updated Rust and MSRV

* Update web vault to v2023.3.0 and dependencies

* add endpoint to bulk delete groups

* add endpoint to bulk delete collections

* don't use `assert()` in production code

Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>

* Add support for Quay.io and GHCR.io as registries

- Added support for Quay.io
- Added support for GHCR.io

To enable support for these container image registries the following needs to be added.

As `Actions secrets and variables` - `Secrets`
- `DOCKERHUB_TOKEN` and `DOCKERHUB_USERNAME`
- `QUAY_TOKEN` and `QUAY_USERNAME`

As `Actions secrets and variables` - `Variables` - `Repository Variables`
- `DOCKERHUB_REPO`
- `GHCR_REPO`
- `QUAY_REPO`

The `DOCKERHUB_REPO` currently configured in `Secrets` can be removed if wanted, probably best after this PR has been merged.

If one of the vars/secrets are not configured it will skip that specific registry!

* Some small fixes and updates

- Updated workflows to use new checkout version
  This probably fixes the curl download for hadolint also.
- Updated crates including Rocket to the latest rc3 :party:
- Applied 2 nightly clippy lints to prevent future clippy issues.

* Update web vault to v2023.3.0b

* Decode knowndevice `X-Request-Email` as base64url with no padding

The clients end up removing the padding characters [1][2].

[1] https://github.com/bitwarden/clients/blob/web-v2023.3.0/libs/common/src/misc/utils.ts#L141-L143
[2] https://github.com/bitwarden/mobile/blob/v2023.3.1/src/Core/Utilities/CoreHelpers.cs#L227-L234

* Fix password reset issues

There was used a wrong macro to produce an error message when mailing
the user his password was reset failed. It was using `error!()` which
does not return an `Err` and aborts the rest of the code.

This resulted in the users password still being resetted, but not being
notified. This PR fixes this by using `err!()`. Also, do not set the
user object as mutable until it really is needed.

Second, when a user was using the new Argon2id KDF with custom values
like memory and parallelism, that would have rendered the password
incorrect. The endpoint which should return all the data did not
returned all the new Argon2id values.

Fixes dani-garcia#3388

Co-authored-by: Stefan Melmuk <509385+stefan0xC@users.noreply.github.com>

* support `/users/<uuid>/invite/resend` admin api

* fmt

* always return KdfMemory and KdfParallelism

the client will ignore the value of theses fields in case of `PBKDF2`
(whether they are unset or left from trying out `Argon2id` as KDF).

with `Argon2id` those fields should never be `null` but always in a
valid state. if they are `null` (how would that even happen?) the
client still assumes default values for `Argon2id` (i.e. m=64 and p=4)
and if they are set to something else login will fail anyway.

* clear kdf memory and parallelism with pbkdf2

when changing back from argon2id to PBKDF2 the unused parameters
should be set to 0.

also fix small bug in _register

* add mail check

* add check user state

* Revert setcap, update rust and crates

- Revert dani-garcia#3170 as discussed in #3387
  In hindsight it's better to not have this feature
- Update Dockerfile.j2 for easy version changes.
  Just change it in one place instead of multiple
- Updated to Rust to latest patched version
- Updated crates to latest available
- Pinned mimalloc to an older version, as it breaks on musl builds

* Fix sending out multiple websocket notifications

For some reason I encountered a strange bug which resulted in sending
out multiple websocket notifications for the exact same user.

Added a `distinct()` for the query to filter out multiple uuid's.

---------

Signed-off-by: Jan Jansen <jan.jansen@gdata.de>
Co-authored-by: BlackDex <black.dex@gmail.com>
Co-authored-by: Rychart Redwerkz <redwerkz@users.noreply.github.com>
Co-authored-by: GeekCorner <45696571+GeekCornerGH@users.noreply.github.com>
Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>
Co-authored-by: sirux88 <sirux88@gmail.com>
Co-authored-by: Jeremy Lin <jjlin@users.noreply.github.com>
Co-authored-by: Daniel Hammer <daniel.hammer+oss@gmail.com>
Co-authored-by: Stefan Melmuk <stefan.melmuk@gmail.com>
Co-authored-by: BlockListed <44610569+BlockListed@users.noreply.github.com>
Co-authored-by: Kevin P. Fleming <kevin@km6g.us>
Co-authored-by: Jan Jansen <jan.jansen@gdata.de>
Co-authored-by: Helmut K. C. Tessarek <tessarek@evermeet.cx>
Co-authored-by: soruh <mail@soruh.de>
Co-authored-by: r3drun3 <simone.ragonesi@kiratech.it>
Co-authored-by: Misterbabou <58564168+Misterbabou@users.noreply.github.com>
Co-authored-by: Nils Mittler <nmittler@bcf-pc03.desktop>
Co-authored-by: Jeremy Lin <jeremy.lin@gmail.com>
Co-authored-by: Jonathan Elias Caicedo <jonathan@jcaicedo.com>
Co-authored-by: Dylan Pinsonneault <dylanp2222@gmail.com>
Co-authored-by: Stefan Melmuk <509385+stefan0xC@users.noreply.github.com>
Co-authored-by: Nikolay Nikolaev <nikolaevn.home@gmail.com>
@SergioBenitez
Copy link
Member

@tessus There's no HEAD route being created. What's happening is that Rocket is automatically handling HEAD requests for you by checking/using the corresponding GET route. This is the whole point of HEAD requests, and since Rocket can do it automatically for you, it does, and it does so because otherwise you'd need to do it yourself to have a properly functioning web server.

The error message that Rocket emits when a HEAD request is automatically handled indicates that Rocket wasn't able to find a route that you registered that matches the HEAD request. It then proceeds with its automatic handling by calling the GET route and stripping the appropriate information to form a proper response.

Rocket isn't doing some weird or wrong, nor are the log messages wrong. In fact, they're too precise. In this case, we want to omit information, or at least change how we present it.

@tessus
Copy link

tessus commented May 4, 2023

@SergioBenitez Thanks for the explanation. This makes sense!

@SergioBenitez
Copy link
Member

Let's handle this when we handle #21.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
accepted An accepted request or suggestion suggestion A suggestion to change functionality
Projects
None yet
Development

No branches or pull requests

8 participants