Kaladaran/briar
0
0
Fork 0
mirror of https://code.briarproject.org/briar/briar.git synced 2026-02-12 02:39:05 +01:00
Code Issues Projects Releases Wiki Activity

[headless] change websocket authentication from basic auth to token message

Browse Source
This commit is contained in:
Torsten Grote
2018-11-08 10:15:17 -02:00
parent c12422d949
commit 32c8ac6576
2 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
briar-headless/README.md
View File

@@ -161,21 +161,18 @@ The Briar peer uses a websocket to notify a connected API client about new event
`WS /v1/ws`
The websocket request must use basic auth,
with the authentication token as the username and a blank password.
Immediately after making the connection,
you must send the authentication token as a message to the websocket.
If you fail to do this, you will not receive messages on that socket.
You can test connecting to the websocket with curl:
In JavaScript, it would look like this:
$ curl --no-buffer \
--header "Connection: Upgrade" \
--header "Upgrade: websocket" \
--header "Sec-WebSocket-Key: SGVsbG8sIHdvcmxkIQ==" \
--header "Sec-WebSocket-Version: 13" \
--user "DZbfoUie8sjap7CSDR9y6cgJCojV+xUITTIFbgtAgqk="
http://127.0.0.1:7000/v1/ws
The headers are only required when testing with curl.
Your websocket client will most likely add these headers automatically.
```javascript
var token = "DZbfoUie8sjap7CSDR9y6cgJCojV+xUITTIFbgtAgqk=";
var socket = new WebSocket("ws://localhost:7000/v1/ws");
socket.onopen = function(event) { socket.send(token); };
socket.onmessage = function(event) { console.log(event.data); }
```
### Receiving new private messages

15
briar-headless/src/main/java/org/briarproject/briar/headless/Router.kt
View File

@@ -9,7 +9,6 @@ import io.javalin.JavalinEvent.SERVER_START_FAILED
import io.javalin.JavalinEvent.SERVER_STOPPED
import io.javalin.NotFoundResponse
import io.javalin.apibuilder.ApiBuilder.*
import io.javalin.core.util.ContextUtil
import io.javalin.core.util.Header.AUTHORIZATION
import org.briarproject.bramble.api.contact.ContactId
import org.briarproject.briar.headless.blogs.BlogController
@@ -20,6 +19,7 @@ import org.briarproject.briar.headless.messaging.MessagingController
import java.lang.Runtime.getRuntime
import java.lang.System.exit
import java.util.concurrent.atomic.AtomicBoolean
import java.util.logging.Level
import java.util.logging.Logger.getLogger
import javax.annotation.concurrent.Immutable
import javax.inject.Inject
@@ -85,13 +85,16 @@ constructor(
}
}
app.ws("/v1/ws") { ws ->
ws.onConnect { session ->
val authHeader = session.header(AUTHORIZATION)
val token = ContextUtil.getBasicAuthCredentials(authHeader)?.username
if (authToken == token) {
logger.info("Adding websocket session with ${session.remoteAddress}")
if (logger.isLoggable(Level.INFO)) ws.onConnect { session ->
logger.info("Received websocket connection from ${session.remoteAddress}")
logger.info("Waiting for authentication")
}
ws.onMessage { session, msg ->
if (msg == authToken && !webSocketController.sessions.contains(session)) {
logger.info("Authenticated websocket session with ${session.remoteAddress}")
webSocketController.sessions.add(session)
} else {
logger.info("Invalid message received: $msg")
logger.info("Closing websocket connection with ${session.remoteAddress}")
session.close(1008, "Invalid Authentication Token")
}