Sirius/tinyauth
1
0
Fork 0
mirror of https://github.com/tinyauthapp/tinyauth.git synced 2026-09-04 04:53:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: check for header spoofing regardless of fallbacks state

Browse Source
This commit is contained in:
Stavros
2026-08-23 12:18:18 +03:00
parent 8614f8768b
commit 9da7d3c7be
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controller/proxy_controller.go
+5 -5
View File
@@ -484,19 +484,19 @@ func (controller *ProxyController) getExtAuthzContext(c *gin.Context) (ProxyCont
}, nil }, nil
} }
func (controller *ProxyController) determineAuthModules(proxy ProxyType) []AuthModuleType { func (controller *ProxyController) determineAuthModules(proxy ProxyType, fallbacks bool) []AuthModuleType {
switch proxy { switch proxy {
case Traefik, Caddy: case Traefik, Caddy:
return []AuthModuleType{ForwardAuth} return []AuthModuleType{ForwardAuth}
case Envoy: case Envoy:
authModules := []AuthModuleType{ExtAuthz} authModules := []AuthModuleType{ExtAuthz}
if !controller.config.Experimental.DisableAuthModuleFallback { if fallbacks {
authModules = append(authModules, ForwardAuth) authModules = append(authModules, ForwardAuth)
} }
return authModules return authModules
case Nginx: case Nginx:
authModules := []AuthModuleType{AuthRequest} authModules := []AuthModuleType{AuthRequest}
if !controller.config.Experimental.DisableAuthModuleFallback { if fallbacks {
authModules = append(authModules, ForwardAuth) authModules = append(authModules, ForwardAuth)
} }
return authModules return authModules
@@ -578,13 +578,13 @@ func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext
controller.log.App.Debug().Msgf("Determined proxy type: %v", proxy) controller.log.App.Debug().Msgf("Determined proxy type: %v", proxy)
authModules := controller.determineAuthModules(proxy) authModules := controller.determineAuthModules(proxy, !controller.config.Experimental.DisableAuthModuleFallback)
if len(authModules) == 0 { if len(authModules) == 0 {
return ProxyContext{}, fmt.Errorf("no auth modules supported for proxy: %v", req.Proxy) return ProxyContext{}, fmt.Errorf("no auth modules supported for proxy: %v", req.Proxy)
} }
err = controller.ensureNoMultipleAuthModules(c, authModules) err = controller.ensureNoMultipleAuthModules(c, controller.determineAuthModules(proxy, true))
if err != nil { if err != nil {
return ProxyContext{}, err return ProxyContext{}, err