IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

AuthN: Use EqualFold for skipping introspection endpoint (#69126)

Browse Source 
Add equality check for introspect ep in basic.go
This commit is contained in:
Misi 2023-05-26 10:22:59 +02:00 committed by GitHub
parent 6a995d526a
commit 6702f07a87
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/services/authn/clients/basic.go
View File

@ -44,7 +44,7 @@ func (c *Basic) Test(ctx context.Context, r *authn.Request) bool {
return false return false
} }
// The OAuth2 introspection endpoint uses basic auth but is handled by the oauthserver package. // The OAuth2 introspection endpoint uses basic auth but is handled by the oauthserver package.
if strings.HasPrefix(r.HTTPRequest.RequestURI, "/oauth2/introspect") { if strings.EqualFold(r.HTTPRequest.RequestURI, "/oauth2/introspect") {
return false return false
} }
return looksLikeBasicAuthRequest(r) return looksLikeBasicAuthRequest(r)

6
pkg/services/authn/clients/basic_test.go
View File

@ -85,6 +85,12 @@ func TestBasic_Test(t *testing.T) {
HTTPRequest: &http.Request{Header: map[string][]string{authorizationHeaderName: {"something"}}}, HTTPRequest: &http.Request{Header: map[string][]string{authorizationHeaderName: {"something"}}},
}, },
}, },
{
desc: "should fail when the URL ends with /oauth2/introspect",
req: &authn.Request{
HTTPRequest: &http.Request{Header: map[string][]string{authorizationHeaderName: {encodeBasicAuth("user", "password")}}, RequestURI: "/oauth2/introspect"},
},
},
} }
for _, tt := range tests { for _, tt := range tests {