diff options
author | Jakob Borg <jakob@nym.se> | 2014-06-04 22:00:55 +0200 |
---|---|---|
committer | Jakob Borg <jakob@nym.se> | 2014-06-04 22:00:55 +0200 |
commit | 20a018db2e4add32c400cfced3ec6d23e98f95e5 (patch) | |
tree | 847d9bab7ffbaed1876b090b348c0af2703f8d76 /cmd | |
parent | 80c2b32b92be3d9dff93e40ecba29aa47411b9b8 (diff) |
Implement API keys
Diffstat (limited to 'cmd')
-rw-r--r-- | cmd/syncthing/gui.go | 8 | ||||
-rw-r--r-- | cmd/syncthing/gui_csrf.go | 3 |
2 files changed, 11 insertions, 0 deletions
diff --git a/cmd/syncthing/gui.go b/cmd/syncthing/gui.go index d98e16a98f..0f866fd76c 100644 --- a/cmd/syncthing/gui.go +++ b/cmd/syncthing/gui.go @@ -321,6 +321,10 @@ func getQR(w http.ResponseWriter, params martini.Params) { func basic(username string, passhash string) http.HandlerFunc { return func(res http.ResponseWriter, req *http.Request) { + if validAPIKey(req.Header.Get("X-API-Key")) { + return + } + error := func() { time.Sleep(time.Duration(rand.Intn(100)+100) * time.Millisecond) res.Header().Set("WWW-Authenticate", "Basic realm=\"Authorization Required\"") @@ -358,6 +362,10 @@ func basic(username string, passhash string) http.HandlerFunc { } } +func validAPIKey(k string) bool { + return len(cfg.GUI.APIKey) > 0 && k == cfg.GUI.APIKey +} + func embeddedStatic() func(http.ResponseWriter, *http.Request, *log.Logger) { var modt = time.Now().UTC().Format(http.TimeFormat) diff --git a/cmd/syncthing/gui_csrf.go b/cmd/syncthing/gui_csrf.go index f7a39f5a1c..7fb67e19cf 100644 --- a/cmd/syncthing/gui_csrf.go +++ b/cmd/syncthing/gui_csrf.go @@ -22,6 +22,9 @@ var csrfMut sync.Mutex // the request with 403. For / and /index.html, set a new CSRF cookie if none // is currently set. func csrfMiddleware(w http.ResponseWriter, r *http.Request) { + if validAPIKey(r.Header.Get("X-API-Key")) { + return + } if strings.HasPrefix(r.URL.Path, "/rest/") { token := r.Header.Get("X-CSRF-Token") if !validCsrfToken(token) { |