github-mirror/grocy
1
0
Fork 0
mirror of https://github.com/grocy/grocy.git synced 2026-03-28 07:39:25 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Forbid empty username header for reverse proxy authentication

Browse Source 
Consider the case where a Grocy user wants to use reverse proxy
authentication OR authentication with an API key.

By default, authenticating reverse proxy will unconditionally perform
user authentication, before allowing a request to be passed to Grocy
which will verify an API key, rendering them virtually useless.
So the proxy needs to be configured not to perform authentication in
certain cases, for example the presence of the `Grocy-Api-Key` HTTP
header, or the path being a subdirectory of `/api/`.

It can however be tricky to configure this though. For example, nginx
does not allow conditional authentication, or conditional header
setting. In those cases, when the condition is met, the username header
would still be returned, albeit empty. Grocy will then create an user
with empty username (not normally possible). It default to having all
permissions, and while most are removable, reading chores/stock/etc.
do not seem to be, and would thus be public.

This returns an error when the username is empty, to accomodate for
those cases.
This commit is contained in:
Geoffrey “Frogeye” Preud'homme 2025-11-29 23:08:27 +01:00
parent 68b4abfac4
commit 1734484ba7
No known key found for this signature in database
GPG Key ID: C72403E7F82E6AD8
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
middleware/ReverseProxyAuthMiddleware.php
View File

@ -43,9 +43,14 @@ class ReverseProxyAuthMiddleware extends AuthMiddleware
if (count($username) !== 1)
{
// Invalid configuration of Proxy
throw new \Exception('ReverseProxyAuthMiddleware: ' . GROCY_REVERSE_PROXY_AUTH_HEADER . ' header is missing or invalid');
throw new \Exception('ReverseProxyAuthMiddleware: ' . GROCY_REVERSE_PROXY_AUTH_HEADER . ' header is missing');
}
$username = $username[0];
if (strlen($username) === 0)
{
// Header is empty
throw new \Exception('ReverseProxyAuthMiddleware: ' . GROCY_REVERSE_PROXY_AUTH_HEADER . ' header is invalid');
}
}
$user = $db->users()->where('username', $username)->fetch();