Welcome to mirror list, hosted at ThFree Co, Russian Federation.

gitlab.com/gitlab-org/gitlab-pages.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/internal/auth
AgeCommit message (Collapse)Author
2023-05-08Upgrade golangci-lint to v1.52.2 on CIJaime Martinez
2023-04-12Update golangci-lint toolKassio Borges
2023-01-19Refactor auth constructor to use options structNaman Jagdish Gala
2022-12-28Merge branch 'master' into 'security-arbitrary-protocol-redirection'Naman Jagdish Gala
# Conflicts: # internal/auth/auth_test.go
2022-12-28Reduce race condition on pages authenticationKassio Borges
2022-11-29Restrict arbitrary protocol redirection to only https or http URLsngala
This commit restricts arbitrary protocol redirection to only https or http URLs and introduces nolint: gocyclo for auth.handleProxyingAuth method. Changelog: security
2022-11-03Add auth-cookie-session-timeout flagKassio Borges
Related to: https://gitlab.com/gitlab-org/gitlab-pages/-/issues/806 Changelog: added
2022-06-28Improve consistency of log fieldsfeistel
2022-06-01Add comment about https redirect in authorization middlewarefeistel
2022-06-01Add missing newlineJaime Martinez
2022-05-22Reduce lookup path requests in the handler pipelinefeistel
2022-05-02Add nolintlint linter configurationfeistel
Require an explanation for nolint rules and warn about unused rules
2022-04-08chore: move check outside of fetching token functionJaime Martinez
2022-04-08fix: handle context canceled gracefully for auth and artifactsJaime Martinez
Changelog: changed
2022-04-06Add comment details for nonce sizeVishal Tak
2022-04-06Update nonce to make it of standard sizeVishal Tak
Changelog: changed
2022-04-05Merge branch 'refactor/specialized-require' into 'master'Jaime Martinez
test: replace require.Equal with specialized assertions See merge request gitlab-org/gitlab-pages!685
2022-03-24fix: validate that session was issued on the same hostVladimir Shushlin
Currently, sessions are valid across all domains. And our auth tokens are also valid for all pages projects user has access to. This means that cookie from one website can be reused on the another. Attackers can steal cookies in many different ways. The easiest way would be to setup a validated custom domain, then proxy all requests to pages server, but log the cookies. Once you have a cookie for attackers domain, you can reuse it on any other pages domain the target user has access to. This commit saves current domain in the session and validates it when reading the session. Changelog: security
2022-03-15feat: allow auth http.Client timeout to be configurableOsman İlge Ünaldı
Changelog: added
2022-03-11Add correlation_id to all exception capturesKassio Borges
2022-02-24test: replace require.Equal with specialized assertionsfeistel
2022-02-18refactor: use testhelpers.Close()yigithankardas
2022-02-04Merge branch 'test/move-mocks' into 'master'Vladimir Shushlin
test: move mocks to their own package See merge request gitlab-org/gitlab-pages!671
2022-01-31fix: ensure logging status codes field names are consistentStan Hu
LabKit logs all HTTP responses with a `status` field of an integer. We ensure that all errors now use this convention and store the full status text as `status_text`. This is needed to enusre Elasticsearch doesn't drop logs due to mapping conflicts. Changelog: fixed
2022-01-26test: move mocks to their own packagefeistel
2022-01-24lint: fix gci issuesfeistel
2021-12-08Merge branch 'remove-unused-ctx' into 'master'Jaime Martinez
refactor: enable unparam in .gitlabci.yml See merge request gitlab-org/gitlab-pages!631
2021-12-07refactor: enable unparam in .golangci.ymlVladimir Shushlin
and fix offences
2021-12-07chore: upgrade to labkit 1.11.0Jaime Martinez
And report stack trace with error tracking to Sentry. Changelog: other
2021-11-22chore(auth): add unit tests for domainAllowedMarkus Legner
2021-11-22fix(auth): check suffix correctly in domainAllowedMarkus Legner
Changelog: fixed
2021-11-19Merge branch 'joernchen-master-patch-26405' into 'master'Jaime Martinez
Escape user supplied code before inserting as a POST parameter See merge request gitlab-org/gitlab-pages!620
2021-11-19Escape user supplied code before inserting as a POST parameterJoern Schneeweisz
2021-11-17test: stop calling mockController.Finish directlyfeistel
This is handled by mockgen 1.5.0+
2021-10-26refactor: rename imported domain packagesVladimir Shushlin
2021-10-25refactor: remove domain from requestJaime Martinez
2021-10-01Merge branch 'fix/source-mock' into 'master'Alessio Caiazza
test: update source mock to use mockgen Closes #277 See merge request gitlab-org/gitlab-pages!525
2021-10-01test: simplify assertionfeistel
replace require.Equal with require.False/True
2021-09-29docs: update middlewares method doc for signature changeJaime Martinez
2021-09-28refactor: move acl to auth package and update function signaturefeistel
2021-09-16refactor: move middlewares to corresponding packagesfeistel
2021-09-09test: update source mock to use mockgenfeistel
2021-09-09refactor: move away from ioutil (deprecated)feistel
2021-09-02refactor: replace magic numbers with http status codesfeistel
2021-08-19test: fix response body not being closedfeistel
nolint is added when the body is nil or if the body can't be closed
2021-08-10Merge branch 'fix/no-ctx' into 'master'Jaime Martinez
fix: propagate context to sub requests See merge request gitlab-org/gitlab-pages!538
2021-08-09feat: capture errors when trying to fetch the access tokenfeistel
2021-08-09refactor: improve checkAuthentication logic, check error first and log ↵feistel
status code during an unexpected response
2021-08-08fix: propagate context to sub requestsfeistel
2021-08-05fix: close response body and fix memory leakfeistel
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-13 01:36:50 +0300