lyra
5258e175a1
Tests / test (pull_request) Successful in 1m8s
The login page, failed logins, redirects, and rate-limit/error pages could be stored by the browser (Symfony's default 'no-cache, private' still permits storage — it only requires revalidation). Older Safari builds may then replay a stale pre-auth response on refresh, appearing to log the user back out, or show a previous session after logging in again. - SecurityHeadersListener: send strict anti-caching headers on non-2xx responses only (no-store/no-cache/must-revalidate/proxy-revalidate, max-age=0, s-maxage=0 + Pragma, Expires, Surrogate-Control, Vary: *). 2xx grants (already-authenticated / public access) are consumed by Caddy's forward_auth check and never reach the browser, and protected services' own cache headers must stay untouched. - templates/_script.html.twig: fetch() with cache: 'no-store'; follow redirects with location.replace() to keep the login page out of history and the back-forward cache. - docs/Caddyfile: reusable (preauth_no_store) snippet imported into every forward_auth block, using header_down so the guarantee holds at the edge (verified: replaces conflicting upstream values, leaves service responses alone). - tests: unit coverage for the listener and functional coverage for the full HTTP kernel (login/failure/redirect/rate-limit not cacheable; 200 grants untouched); asserts the rendered page carries the JS changes. - readme/CHANGELOG updates.
86 lines
3.4 KiB
Twig
86 lines
3.4 KiB
Twig
<script>
|
|
const form = document.getElementById('preauth-form');
|
|
const message = document.getElementById('preauth-message');
|
|
const body = document.getElementById('preauth-body');
|
|
const style = document.getElementById('preauth-style');
|
|
|
|
form.addEventListener('submit', (event) => {
|
|
event.preventDefault();
|
|
|
|
{# make base64url string containing our payload json object #}
|
|
const data = btoa(JSON.stringify({
|
|
id: form.username.value?.trim() ?? '',
|
|
token: form.totp.value?.trim() ?? '',
|
|
nonce: form.nonce.value?.trim() ?? '',
|
|
json: true
|
|
})).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
|
|
|
|
{# send our request to the server #}
|
|
fetch(window.location.href, {
|
|
method: 'GET',
|
|
headers: { 'X-Preauth': data },
|
|
// never serve this request from, or store it in, the HTTP cache
|
|
cache: 'no-store',
|
|
}).then((response) => {
|
|
{% if env.debug > 2 -%}
|
|
console.log(response);
|
|
{% endif -%}
|
|
if (response.headers.has('Location')) {
|
|
{# follow redirect (probably not needed) #}
|
|
{% if env.debug > 2 -%}
|
|
console.log('got redirect response');
|
|
{% endif -%}
|
|
// replace() keeps the login page out of history and the back-forward cache
|
|
window.location.replace(response.headers.get('Location'));
|
|
} else if (response.headers.get('Content-Type')?.toLowerCase().includes('application/json') ?? false) {
|
|
{# got json, update the page #}
|
|
{% if env.debug > 2 -%}
|
|
console.log('got json response');
|
|
{% endif -%}
|
|
response.json().then((content) => {
|
|
if (Object.hasOwn(content, 'message')) {
|
|
message.innerText = content.message;
|
|
}
|
|
if (Object.hasOwn(content, 'nonce')) {
|
|
form.nonce.value = content.nonce;
|
|
form.totp.value = '';
|
|
form.totp.focus();
|
|
}
|
|
}).catch((error) => {
|
|
console.log('failed to parse json from response');
|
|
console.log(error);
|
|
});
|
|
} else if (response.headers.get('Content-Type')?.toLowerCase().includes('text/html') ?? false) {
|
|
{# got html, replace the page #}
|
|
{% if env.debug > 2 -%}
|
|
console.log('got html response');
|
|
{% endif -%}
|
|
response.text().then((html) => {
|
|
document.documentElement.innerHTML = html;
|
|
}).catch((error) => {
|
|
console.log('failed to get html from response');
|
|
console.log(error);
|
|
});
|
|
} else {
|
|
{# non-json, non-html, non-redirect response #}
|
|
{# update the page, change style to plain text #}
|
|
{% if env.debug > 2 -%}
|
|
console.log('got misc response');
|
|
{% endif -%}
|
|
response.text().then((text) => {
|
|
body.innerText = text;
|
|
style.disabled = true;
|
|
body.style.whiteSpace = 'pre-wrap';
|
|
body.style.wordWrap = 'break-word';
|
|
}).catch((error) => {
|
|
console.log('failed to get text from response');
|
|
console.log(error);
|
|
});
|
|
}
|
|
}).catch((error) => {
|
|
console.log('failed to get response');
|
|
console.log(error);
|
|
});
|
|
});
|
|
</script>
|