lwIP - A Lightweight TCP/IP stack - Patches: patch #9576, Adding authorization cookie...
You are not allowed to post comments on this tracker with your current authentication level.
patch #9576: Adding authorization cookie management
Submitter: | Giuseppe Modugno <giusloq> | ||
Submitted: | Tue 27 Feb 2018 09:38:58 AM UTC | ||
Category: | apps | Priority: | 5 - Normal |
Status: | None | Privacy: | Public |
Assigned to: | None | Open/Closed: | Open |
Planned Release: | None |
( Jump to the original submission )
Tue 13 Mar 2018 11:18:58 AM UTC, comment #13: |
Mike Kleshov <kleshov>![]() |
Tue 13 Mar 2018 11:03:54 AM UTC, comment #12: Mike, I'm trying to add an authorization layer as per your idea.
|
Giuseppe Modugno <giusloq> |
Fri 02 Mar 2018 07:27:06 PM UTC, comment #11: Both sides have valid arguments. Still I would like to make httpd open enough to allow people reading and adding cookies. I wouldn't want to tightly couple this into its API though. Instead, I think the whole server might need some API cleanup. This won't be done for 2.1.0. |
Simon Goldschmidt <goldsimon>![]() |
Fri 02 Mar 2018 11:42:40 AM UTC, comment #10:
That's not true. Requests come from javascript (XMLHttpRequest), so no history, no bookmarks, no URI when printing. You'll have to use a sniffer or fire up browser's debugger, but in this case a cookie is just as visible.
Same here. I'm just trying to present arguments accurately. |
Mike Kleshov <kleshov>![]() |
Fri 02 Mar 2018 10:42:27 AM UTC, comment #9:
|
Giuseppe Modugno <giusloq> |
Thu 01 Mar 2018 12:02:48 PM UTC, comment #8:
Come on. It's easy enough to obfuscate the password, mix it with current time or request counter. That's not an issue. |
Mike Kleshov <kleshov>![]() |
Thu 01 Mar 2018 11:14:37 AM UTC, comment #7:
|
Giuseppe Modugno <giusloq> |
Thu 01 Mar 2018 11:08:39 AM UTC, comment #6:
Simon, if you give me more details, I can try to change my patch.
|
Giuseppe Modugno <giusloq> |
Thu 01 Mar 2018 11:00:22 AM UTC, comment #5:
Create a single-page web application. Protected data is pulled from the server using javascript, request URI must contain ?user=---&pass=---, so the server is able to check credentials and grant or deny the request. Username and password validity in login form can be checked in a similar manner. Credentials can be stored in browser's local storage.
|
Mike Kleshov <kleshov>![]() |
Thu 01 Mar 2018 10:41:51 AM UTC, comment #4:
Please, please, suggest one authentication scheme that can be used without changing current httpd.
Simple, but highly configurabile. My patch can be completely disabled by macros, as usual in lwip. So if you don't want, don't enable it.
|
Giuseppe Modugno <giusloq> |
Thu 01 Mar 2018 10:39:10 AM UTC, comment #3:
|
Giuseppe Modugno <giusloq> |
Wed 28 Feb 2018 03:21:44 PM UTC, comment #2: I haven't really had the time to look at this patch, yet, but reading the original submission, I tend to not include it.
|
Simon Goldschmidt <goldsimon>![]() |
Wed 28 Feb 2018 01:07:17 PM UTC, comment #1: I'm not very familiar with various authentication schemes, but I think a number of them can be implemented without having to modify httpd. That's one reason not to apply this patch. The other one is the this: httpd is rather simple, please keep it this way. |
Mike Kleshov <kleshov>![]() |
Tue 27 Feb 2018 09:38:58 AM UTC, original submission:
I tried to add authorization cookie management to httpd. You have to enable LWIP_HTTPD_SUPPORT_AUTH_COOKIE and define HTTP_AUTH_COOKIE_NAME (usually "Auth") and HTTP_LOGIN_FILE (the name of the file that is returned to every HTTP requests without a valid authorization cookie... it is usually the login.html web page to force entering username/password).
|
Giuseppe Modugno <giusloq> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follows 1 latest change.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2018-02-27 | giusloq | Attached File | - | ![]() |
Added patch.diff, #43407 |
Apparently, I am using 'old style CGI'. Looking at httpd code, I can see that the handler is called.