3diy
/
moonraker
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

authorization: improve error message for invalid auth headers 

Signed-off-by:  Eric Callahan <arksine.code@gmail.com>
This commit is contained in:
Eric Callahan 2021-08-27 06:11:55 -04:00
parent b040640813
commit dfb8da6e3e
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
moonraker/components/authorization.py
View File

@ -526,17 +526,22 @@ class Authorization:
auth_token: Optional[str] = request.headers.get("Authorization") auth_token: Optional[str] = request.headers.get("Authorization")
if auth_token is None: if auth_token is None:
auth_token = request.headers.get("X-Access-Token") auth_token = request.headers.get("X-Access-Token")
if auth_token and auth_token.startswith("Bearer "): if auth_token is None:
auth_token = auth_token[7:] qtoken = request.query_arguments.get('access_token', None)
if qtoken is not None:
auth_token = qtoken[-1].decode()
else: else:
qtoken = request.query_arguments.get('access_token', None) if auth_token.startswith("Bearer "):
if qtoken is not None: auth_token = auth_token[7:]
auth_token = qtoken[-1].decode() else:
raise HTTPError(
401, f"Invalid Authorization Header: {auth_token}")
if auth_token: if auth_token:
try: try:
return self._decode_jwt(auth_token) return self._decode_jwt(auth_token)
except Exception as e: except Exception:
raise HTTPError(401, str(e)) logging.exception(f"JWT Decode Error {auth_token}")
raise HTTPError(401, f"Error decoding JWT: {auth_token}")
return None return None
def _check_authorized_ip(self, ip: IPAddr) -> bool: def _check_authorized_ip(self, ip: IPAddr) -> bool: