Documentation
¶
Overview ¶
Package httpauth pkg/httpauth/auth.go c0-com-http
Package httpauth pkg/httpauth/handler.go c0-com-http
Package httpauth pkg/httpauth/memory_store.go c0-com-http
Package httpauth pkg/httpauth/nonce-storer.go c0-com-http
Package httpauth pkg/httpauth/redis-store.go c0-com-http
Package httpauth pkg/httpauth/whitelist.go c0-com-http
Index ¶
- Variables
- func GetRemoteAddr(r *http.Request) string
- func GetRemoteAddrLB(r *http.Request) string
- func MakeLoadTestingMiddleware(store NonceStore) func(next http.Handler) http.Handler
- func MakeMiddleware(store NonceStore) func(next http.Handler) http.Handler
- func PKFromCtx(ctx context.Context) cipher.PubKey
- func PayloadWithNonce(payload []byte, nonce Nonce) []byte
- func ReadKeyList(r *http.Request) ([]cipher.PubKey, error)
- func Sign(payload []byte, nonce Nonce, sec cipher.SecKey) (cipher.Sig, error)
- func Verify(payload []byte, nonce Nonce, pub cipher.PubKey, sig cipher.Sig) error
- func WithAuth(store NonceStore, original http.Handler, shouldVerifyAuth bool) http.Handler
- type Auth
- type HTTPError
- type HTTPResponse
- type NextNonceResponse
- type Nonce
- type NonceHandler
- type NonceStore
- type Whitelist
Constants ¶
This section is empty.
Variables ¶
var ( // ContextAuthKey stores authenticated PubKey in Context . ContextAuthKey = struct{}{} // LogAuthKey stores authentication PubKey in log entry LogAuthKey = "PK" )
var ( // ErrNotWhitelisted means the caller's key is not in the Whitelist. ErrNotWhitelisted = errors.New("caller is not whitelisted") // ErrNotDmsg means the request did not arrive over dmsg or skynet, so it has // no authenticated caller. ErrNotDmsg = errors.New("whitelisted endpoints are served over dmsg only") )
Functions ¶
func GetRemoteAddr ¶
GetRemoteAddr gets the remote address from the request in case of dmsghttp the RemoteAddress is a pk so it gets the RemoteAddr from the header instead
func GetRemoteAddrLB ¶
GetRemoteAddrLB gets the remote address from the request behind LB in case of dmsghttp the RemoteAddress is a pk so it gets the RemoteAddr from the header instead
func MakeLoadTestingMiddleware ¶
func MakeLoadTestingMiddleware(store NonceStore) func(next http.Handler) http.Handler
MakeLoadTestingMiddleware is the same as `MakeMiddleware` but omits auth checks to simplify load testing.
func MakeMiddleware ¶
func MakeMiddleware(store NonceStore) func(next http.Handler) http.Handler
MakeMiddleware is a convenience function that calls WithAuth.
func PayloadWithNonce ¶
PayloadWithNonce returns the concatenation of payload and nonce.
func ReadKeyList ¶
ReadKeyList reads a request body holding a JSON array of public keys.
func WithAuth ¶
WithAuth wraps a http.Handler and adds authentication logic. The original http.Handler is responsible for setting the status code. The middleware logic should only increment the security nonce if the status code from the original http.Handler is of 2xx value (representing success). Any http.Handler that is wrapped with this function will have available the authenticated public key from it's context, stored in the value ContextAuthKey.
Types ¶
type Auth ¶
Auth holds authentication mandatory values
func AuthFromHeaders ¶
AuthFromHeaders attempts to extract auth from request header
type HTTPResponse ¶
type HTTPResponse struct {
Error *HTTPError `json:"error,omitempty"`
Data interface{} `json:"data,omitempty"`
}
HTTPResponse represents the http response struct
func NewHTTPErrorResponse ¶
func NewHTTPErrorResponse(code int, msg string) HTTPResponse
NewHTTPErrorResponse returns an HTTPResponse with the Error field populated
type NextNonceResponse ¶
type NextNonceResponse struct {
Edge cipher.PubKey `json:"edge"`
NextNonce Nonce `json:"next_nonce"`
}
NextNonceResponse represents a ServeHTTP response for json encoding
type NonceHandler ¶
type NonceHandler struct {
Store NonceStore
}
NonceHandler provides server-side logic for Skywire-related RESTFUL authorization and authentication.
func (*NonceHandler) ServeHTTP ¶
func (as *NonceHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
ServeHTTP implements http Handler Use this in endpoint: mux.Handle("/security/nonces/", &NonceHandler{Store})
type NonceStore ¶
type NonceStore interface {
// IncrementNonce increments the nonce associated with the specified remote entity.
// It returns the next expected nonce after it has been incremented and returns error on failure.
IncrementNonce(ctx context.Context, remotePK cipher.PubKey) (nonce Nonce, err error)
// Nonce obtains the next expected nonce for a given remote entity (represented by public key).
// It returns error on failure.
Nonce(ctx context.Context, remotePK cipher.PubKey) (nonce Nonce, err error)
// Count obtains the number of entries stored in the underlying database.
Count(ctx context.Context) (n int, err error)
}
NonceStore stores Incrementing Security Nonces.
func NewNonceStore ¶
func NewNonceStore(ctx context.Context, config storeconfig.Config, prefix string) (NonceStore, error)
NewNonceStore returns a new nonce storer of the given kind that connects to given Store's url. Nonce count should not be shared between services, so it should be stored in a unique key for every service.
type Whitelist ¶
type Whitelist map[string]struct{}
Whitelist holds the keys, in hex, allowed to call the bulk deregistration endpoints of the deployment services.
func (Whitelist) Authorize ¶
Authorize returns the key of a caller allowed by the Whitelist, or the HTTP status to answer with. The caller is the authenticated remote key of a dmsg stream, which includes a stream a host visor hands over from skynet. A plain HTTP request has no such key and is refused.
Source Files