chteufleur
/
HTTPAuthentificationOverXMPP
1
1
Fork 1
Code Issues 5 Pull Requests Releases Wiki Activity

Make the transaction ID mandatory again (for security issue).

This commit is contained in:
Chteufleur 2016-08-27 16:34:44 +02:00
parent b61490b75c
commit a06062e714
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@ -53,7 +53,7 @@ To ask authorization, just send an HTTP request to the path ``/auth`` with param
* __jid__ : JID of the user (user@host/resource or user@host) * __jid__ : JID of the user (user@host/resource or user@host)
* __domain__ : Domain you want to access * __domain__ : Domain you want to access
* __method__ : Method you access the domain * __method__ : Method you access the domain
* transaction_id : Transaction identifier (auto generated if not provide) * __transaction_id__ : Transaction identifier (auto generated if not provide)
* timeout : Timeout of the request in second (default : 60, max : 300) * timeout : Timeout of the request in second (default : 60, max : 300)
__Bold parameters__ are mandatory. __Bold parameters__ are mandatory.

4
http/http.go
View File

@ -62,15 +62,15 @@ func authHandler(w http.ResponseWriter, r *http.Request) {
jid := strings.Join(r.Form[PARAM_JID], "") jid := strings.Join(r.Form[PARAM_JID], "")
method := strings.Join(r.Form[METHOD_ACCESS], "") method := strings.Join(r.Form[METHOD_ACCESS], "")
domain := strings.Join(r.Form[DOMAIN_ACCESS], "") domain := strings.Join(r.Form[DOMAIN_ACCESS], "")
transaction := strings.Join(r.Form[TRANSACTION_ID], "")
if jid == "" || method == "" || domain == "" { if jid == "" || method == "" || domain == "" || transaction == "" {
// If mandatory params is missing // If mandatory params is missing
log.Printf("%sMandatory params is missing", LogInfo) log.Printf("%sMandatory params is missing", LogInfo)
w.WriteHeader(http.StatusBadRequest) w.WriteHeader(http.StatusBadRequest)
return return
} }
transaction := strings.Join(r.Form[TRANSACTION_ID], "")
timeoutStr := strings.Join(r.Form[TIMEOUTE], "") timeoutStr := strings.Join(r.Form[TIMEOUTE], "")
log.Printf("%sAuth %s", LogInfo, jid) log.Printf("%sAuth %s", LogInfo, jid)
timeout, err := strconv.Atoi(timeoutStr) timeout, err := strconv.Atoi(timeoutStr)

2
httpAuth.cfg
View File

@ -1,7 +1,7 @@
# XMPP informations (component) # XMPP informations (component)
xmpp_server_address=192.168.1.2 xmpp_server_address=192.168.1.2
xmpp_server_port=5347 xmpp_server_port=5347
xmpp_jid=xmppsteamm.kingpenguin.tk xmpp_jid=xmppsteam.kingpenguin.tk
xmpp_secret=xmpp4steam_password xmpp_secret=xmpp4steam_password
xmpp_debug=true xmpp_debug=true
xmpp_verify_cert_validity=true xmpp_verify_cert_validity=true