rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix collision between connect API key & Session middlewares

Browse Source 
Signed-off-by: Émile Ré <nemile.re@gmail.com>
This commit is contained in:
Émile Ré
2025-12-19 13:37:40 +01:00
committed by Bryan Frimin
parent 433c081d22
commit 2af9eb47a7
2 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/server/api/connect/v1/api_key_middleware.go
View File

@@ -42,12 +42,6 @@ func NewAPIKeyMiddleware(svc *iam.Service) func(next http.Handler) http.Handler
func(w http.ResponseWriter, r *http.Request) { func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context() ctx := r.Context()
session := SessionFromContext(ctx)
if session != nil {
httpserver.RenderError(w, http.StatusBadRequest, errors.New("api key authentication cannot be used with session authentication"))
return
}
tokenValue, err := securetoken.Get(r, "") tokenValue, err := securetoken.Get(r, "")
if err != nil { if err != nil {
next.ServeHTTP(w, r) next.ServeHTTP(w, r)
@@ -60,6 +54,12 @@ func NewAPIKeyMiddleware(svc *iam.Service) func(next http.Handler) http.Handler
return return
} }
session := SessionFromContext(ctx)
if keyID != gid.Nil && session != nil {
httpserver.RenderError(w, http.StatusBadRequest, errors.New("api key authentication cannot be used with session authentication"))
return
}
apiKey, err := svc.APIKeyService.GetAPIKey(ctx, keyID) apiKey, err := svc.APIKeyService.GetAPIKey(ctx, keyID)
if err != nil { if err != nil {
var errUserAPIKeyNotFound *iam.ErrUserAPIKeyNotFound var errUserAPIKeyNotFound *iam.ErrUserAPIKeyNotFound

12
pkg/server/api/connect/v1/session_middleware.go
View File

@@ -49,12 +49,6 @@ func NewSessionMiddleware(svc *iam.Service, cookieConfig securecookie.Config) fu
func(w http.ResponseWriter, r *http.Request) { func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context() ctx := r.Context()
apiKey := APIKeyFromContext(ctx)
if apiKey != nil {
httpserver.RenderError(w, http.StatusBadRequest, errors.New("session authentication cannot be used with API key authentication"))
return
}
cookieValue, err := securecookie.Get(r, cookieConfig) cookieValue, err := securecookie.Get(r, cookieConfig)
if err != nil { if err != nil {
next.ServeHTTP(w, r) next.ServeHTTP(w, r)
@@ -68,6 +62,12 @@ func NewSessionMiddleware(svc *iam.Service, cookieConfig securecookie.Config) fu
return return
} }
apiKey := APIKeyFromContext(ctx)
if sessionID != gid.Nil && apiKey != nil {
httpserver.RenderError(w, http.StatusBadRequest, errors.New("session authentication cannot be used with API key authentication"))
return
}
session, err := svc.SessionService.GetSession(ctx, sessionID) session, err := svc.SessionService.GetSession(ctx, sessionID)
if err != nil { if err != nil {
var errSessionNotFound *iam.ErrSessionNotFound var errSessionNotFound *iam.ErrSessionNotFound