kalugin66/kimai
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new stateless firewall to prevent new sessions for API calls (#3602)

Browse Source
This commit is contained in:
Kevin Papst
2022-10-28 15:13:40 +02:00
committed by GitHub
parent 78749ad3b4
commit 0461539f4b
6 changed files with 228 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/Security/TokenAuthenticator.php
View File

@@ -24,7 +24,6 @@ class TokenAuthenticator extends AbstractGuardAuthenticator
{
public const HEADER_USERNAME = 'X-AUTH-USER';
public const HEADER_TOKEN = 'X-AUTH-TOKEN';
public const HEADER_JAVASCRIPT = 'X-AUTH-SESSION';
private $encoderFactory;
@@ -47,7 +46,7 @@ class TokenAuthenticator extends AbstractGuardAuthenticator
// only try to use this authenticator, when the URL contains the /api/ path
if (strpos($request->getRequestUri(), '/api/') !== false) {
// javascript requests can set a header to disable this authenticator and use the existing session
return !$request->headers->has(self::HEADER_JAVASCRIPT);
return $request->headers->has(self::HEADER_USERNAME) && $request->headers->has(self::HEADER_TOKEN);
}
return false;