diff --git a/app/Exceptions/Handler.php b/app/Exceptions/Handler.php index 50df03b9..bbf04ead 100644 --- a/app/Exceptions/Handler.php +++ b/app/Exceptions/Handler.php @@ -59,10 +59,5 @@ public function register() return response()->json([ 'message' => $exception->getMessage()], 400); }); - - $this->renderable(function (UnsupportedWithReverseProxyException $exception, $request) { - return response()->json([ - 'message' => __('errors.unsupported_with_reverseproxy')], 400); - }); } } \ No newline at end of file diff --git a/app/Exceptions/UnsupportedWithReverseProxyException.php b/app/Exceptions/UnsupportedWithReverseProxyException.php deleted file mode 100644 index 1753d594..00000000 --- a/app/Exceptions/UnsupportedWithReverseProxyException.php +++ /dev/null @@ -1,14 +0,0 @@ -json([ - 'message' => 'no personal access token with reverse proxy'], 202); - } - - parent::forUser($request); - } - -} \ No newline at end of file diff --git a/app/Http/Controllers/Auth/RegisterController.php b/app/Http/Controllers/Auth/RegisterController.php index 83b01d94..c1634b4b 100644 --- a/app/Http/Controllers/Auth/RegisterController.php +++ b/app/Http/Controllers/Auth/RegisterController.php @@ -8,7 +8,6 @@ use Illuminate\Support\Facades\Hash; use Illuminate\Auth\Events\Registered; use Illuminate\Foundation\Auth\RegistersUsers; -use App\Exceptions\UnsupportedWithReverseProxyException; class RegisterController extends Controller { @@ -26,19 +25,6 @@ class RegisterController extends Controller use RegistersUsers; - /** - * Create a new controller instance. - */ - public function __construct() - { - $authGuard = config('auth.defaults.guard'); - - if ($authGuard === 'reverse-proxy-guard') { - throw new UnsupportedWithReverseProxyException(); - } - } - - /** * Handle a registration request for the application. * diff --git a/app/Http/Controllers/Auth/ResetPasswordController.php b/app/Http/Controllers/Auth/ResetPasswordController.php index cff8c6fe..8aee96a4 100644 --- a/app/Http/Controllers/Auth/ResetPasswordController.php +++ b/app/Http/Controllers/Auth/ResetPasswordController.php @@ -4,7 +4,6 @@ use App\Http\Controllers\Controller; use Illuminate\Foundation\Auth\ResetsPasswords; -use App\Exceptions\UnsupportedWithReverseProxyException; class ResetPasswordController extends Controller { @@ -21,17 +20,4 @@ class ResetPasswordController extends Controller use ResetsPasswords; - - /** - * Create a new controller instance. - */ - public function __construct() - { - $authGuard = config('auth.defaults.guard'); - - if ($authGuard === 'reverse-proxy-guard') { - throw new UnsupportedWithReverseProxyException(); - } - } - } diff --git a/app/Http/Controllers/Auth/UserController.php b/app/Http/Controllers/Auth/UserController.php index 5e6b0f37..a1054650 100644 --- a/app/Http/Controllers/Auth/UserController.php +++ b/app/Http/Controllers/Auth/UserController.php @@ -12,7 +12,6 @@ use Illuminate\Support\Facades\Hash; use Illuminate\Support\Facades\DB; use Illuminate\Support\Facades\Artisan; -use App\Exceptions\UnsupportedWithReverseProxyException; use Exception; class UserController extends Controller @@ -32,11 +31,6 @@ class UserController extends Controller public function __construct(TwoFAccountService $twofaccountService) { $this->twofaccountService = $twofaccountService; - $authGuard = config('auth.defaults.guard'); - - if ($authGuard === 'reverse-proxy-guard') { - throw new UnsupportedWithReverseProxyException(); - } } diff --git a/app/Http/Controllers/Auth/WebAuthnConfirmController.php b/app/Http/Controllers/Auth/WebAuthnConfirmController.php index 37763def..b1e585e9 100644 --- a/app/Http/Controllers/Auth/WebAuthnConfirmController.php +++ b/app/Http/Controllers/Auth/WebAuthnConfirmController.php @@ -5,7 +5,6 @@ use App\Http\Controllers\Controller; use App\Providers\RouteServiceProvider; use DarkGhostHunter\Larapass\Http\ConfirmsWebAuthn; -use App\Exceptions\UnsupportedWithReverseProxyException; class WebAuthnConfirmController extends Controller { @@ -28,18 +27,4 @@ class WebAuthnConfirmController extends Controller * @var string */ protected $redirectTo = RouteServiceProvider::HOME; - - /** - * Create a new controller instance. - * - * @return void - */ - public function __construct() - { - $authGuard = config('auth.defaults.guard'); - - if ($authGuard === 'reverse-proxy-guard') { - throw new UnsupportedWithReverseProxyException(); - } - } } \ No newline at end of file diff --git a/app/Http/Controllers/Auth/WebAuthnDeviceLostController.php b/app/Http/Controllers/Auth/WebAuthnDeviceLostController.php index 80f86076..bf1c22fb 100644 --- a/app/Http/Controllers/Auth/WebAuthnDeviceLostController.php +++ b/app/Http/Controllers/Auth/WebAuthnDeviceLostController.php @@ -6,7 +6,6 @@ use DarkGhostHunter\Larapass\Http\SendsWebAuthnRecoveryEmail; use Illuminate\Http\Request; use Illuminate\Validation\ValidationException; -use App\Exceptions\UnsupportedWithReverseProxyException; class WebAuthnDeviceLostController extends Controller { @@ -23,19 +22,6 @@ class WebAuthnDeviceLostController extends Controller | */ - /** - * Create a new controller instance. - */ - public function __construct() - { - $authGuard = config('auth.defaults.guard'); - - if ($authGuard === 'reverse-proxy-guard') { - throw new UnsupportedWithReverseProxyException(); - } - } - - /** * The recovery credentials to retrieve through validation rules. * diff --git a/app/Http/Controllers/Auth/WebAuthnLoginController.php b/app/Http/Controllers/Auth/WebAuthnLoginController.php index 91bf258d..b8fca144 100644 --- a/app/Http/Controllers/Auth/WebAuthnLoginController.php +++ b/app/Http/Controllers/Auth/WebAuthnLoginController.php @@ -6,7 +6,6 @@ use Illuminate\Http\Request; use App\Http\Controllers\Controller; use DarkGhostHunter\Larapass\Http\AuthenticatesWebAuthn; -use App\Exceptions\UnsupportedWithReverseProxyException; class WebAuthnLoginController extends Controller { @@ -27,18 +26,6 @@ class WebAuthnLoginController extends Controller | */ - /** - * Create a new controller instance. - */ - public function __construct() - { - $authGuard = config('auth.defaults.guard'); - - if ($authGuard === 'reverse-proxy-guard') { - throw new UnsupportedWithReverseProxyException(); - } - } - public function options(Request $request) { diff --git a/app/Http/Controllers/Auth/WebAuthnManageController.php b/app/Http/Controllers/Auth/WebAuthnManageController.php index 8cf20606..99dafa30 100644 --- a/app/Http/Controllers/Auth/WebAuthnManageController.php +++ b/app/Http/Controllers/Auth/WebAuthnManageController.php @@ -6,12 +6,9 @@ use Illuminate\Http\Request; use App\Http\Requests\WebauthnRenameRequest; use DarkGhostHunter\Larapass\Eloquent\WebAuthnCredential; -use App\Exceptions\UnsupportedWithReverseProxyException; class WebAuthnManageController extends Controller { - // use RecoversWebAuthn; - /* |-------------------------------------------------------------------------- | WebAuthn Manage Controller @@ -33,14 +30,6 @@ public function __construct() */ public function index(Request $request) { - // WebAuthn is useless when authentication is handle by - // a reverse proxy so we return a 202 response to tell the - // client nothing more will happen - if (config('auth.defaults.guard') === 'reverse-proxy-guard') { - return response()->json([ - 'message' => 'no webauthn with reverse proxy'], 202); - } - $user = $request->user(); $allUserCredentials = $user->webAuthnCredentials() ->enabled() @@ -72,6 +61,9 @@ public function rename(WebauthnRenameRequest $request, string $credential) /** * Remove the specified credential from storage. + * + * @param \Illuminate\Http\Request $request + * @param string|array $credential * * @return \Illuminate\Http\JsonResponse */ diff --git a/app/Http/Controllers/Auth/WebAuthnRecoveryController.php b/app/Http/Controllers/Auth/WebAuthnRecoveryController.php index 0c84c314..b5d9bce0 100644 --- a/app/Http/Controllers/Auth/WebAuthnRecoveryController.php +++ b/app/Http/Controllers/Auth/WebAuthnRecoveryController.php @@ -9,7 +9,6 @@ use Illuminate\Http\JsonResponse; use Illuminate\Http\Request; use Illuminate\Validation\ValidationException; -use App\Exceptions\UnsupportedWithReverseProxyException; class WebAuthnRecoveryController extends Controller { @@ -32,19 +31,7 @@ class WebAuthnRecoveryController extends Controller * @var string */ protected $redirectTo = RouteServiceProvider::HOME; - - /** - * Create a new controller instance. - */ - public function __construct() - { - $authGuard = config('auth.defaults.guard'); - - if ($authGuard === 'reverse-proxy-guard') { - throw new UnsupportedWithReverseProxyException(); - } - } /** * Returns the credential creation options to the user. diff --git a/app/Http/Controllers/Auth/WebAuthnRegisterController.php b/app/Http/Controllers/Auth/WebAuthnRegisterController.php index 19807dda..bfc0d2e7 100644 --- a/app/Http/Controllers/Auth/WebAuthnRegisterController.php +++ b/app/Http/Controllers/Auth/WebAuthnRegisterController.php @@ -4,7 +4,6 @@ use App\Http\Controllers\Controller; use DarkGhostHunter\Larapass\Http\RegistersWebAuthn; -use App\Exceptions\UnsupportedWithReverseProxyException; class WebAuthnRegisterController extends Controller { @@ -20,16 +19,4 @@ class WebAuthnRegisterController extends Controller | persisted into the application, otherwise it will signal failure. | */ - - /** - * Create a new controller instance. - */ - public function __construct() - { - $authGuard = config('auth.defaults.guard'); - - if ($authGuard === 'reverse-proxy-guard') { - throw new UnsupportedWithReverseProxyException(); - } - } } \ No newline at end of file diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php index 1d7f0b09..fc8da10a 100644 --- a/app/Http/Kernel.php +++ b/app/Http/Kernel.php @@ -71,7 +71,9 @@ class Kernel extends HttpKernel 'auth' => \App\Http\Middleware\Authenticate::class, 'guest' => \App\Http\Middleware\RejectIfAuthenticated::class, 'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class, - 'disableInDemoMode' => \App\Http\Middleware\DisableInDemoMode::class, + 'rejectIfDemoMode' => \App\Http\Middleware\RejectIfDemoMode::class, + 'rejectIfReverseProxy' => \App\Http\Middleware\RejectIfReverseProxy::class, + ]; /** diff --git a/app/Http/Middleware/DisableInDemoMode.php b/app/Http/Middleware/RejectIfDemoMode.php similarity index 85% rename from app/Http/Middleware/DisableInDemoMode.php rename to app/Http/Middleware/RejectIfDemoMode.php index df1164df..6b6dcf47 100644 --- a/app/Http/Middleware/DisableInDemoMode.php +++ b/app/Http/Middleware/RejectIfDemoMode.php @@ -6,7 +6,7 @@ use Illuminate\Http\Response; use Illuminate\Support\Facades\Log; -class DisableInDemoMode +class RejectIfDemoMode { /** * Handle an incoming request. @@ -19,7 +19,7 @@ public function handle($request, Closure $next) { if( config('2fauth.config.isDemoApp') ) { - Log::notice('Cannot request a password reset in Demo mode'); + Log::notice('Cannot request this action in Demo mode'); return response()->json(['message' => __('auth.forms.disabled_in_demo')], Response::HTTP_UNAUTHORIZED); } diff --git a/app/Http/Middleware/RejectIfReverseProxy.php b/app/Http/Middleware/RejectIfReverseProxy.php new file mode 100644 index 00000000..0920c899 --- /dev/null +++ b/app/Http/Middleware/RejectIfReverseProxy.php @@ -0,0 +1,28 @@ +json([ + 'message' => __('errors.unsupported_with_reverseproxy')], 400); + } + + return $next($request); + } +} diff --git a/resources/js/views/settings/OAuth.vue b/resources/js/views/settings/OAuth.vue index c9db9de6..c7f6f7fc 100644 --- a/resources/js/views/settings/OAuth.vue +++ b/resources/js/views/settings/OAuth.vue @@ -84,12 +84,8 @@ this.isFetching = true - await this.axios.get('/oauth/personal-access-tokens').then(response => { - if (response.status === 202) { - this.isRemoteUser = true - return - } - + await this.axios.get('/oauth/personal-access-tokens') + .then(response => { const tokens = [] response.data.forEach((data) => { @@ -104,6 +100,16 @@ this.tokens = tokens }) + .catch(error => { + if( error.response.status === 400 ) { + + this.isRemoteUser = true + } + else { + + this.$router.push({ name: 'genericError', params: { err: error.response } }); + } + }) this.isFetching = false }, diff --git a/resources/js/views/settings/WebAuthn.vue b/resources/js/views/settings/WebAuthn.vue index 70aee0c8..ca70efd6 100644 --- a/resources/js/views/settings/WebAuthn.vue +++ b/resources/js/views/settings/WebAuthn.vue @@ -101,11 +101,19 @@ this.isFetching = true - await this.axios.get('/webauthn/credentials').then(response => { - if (response.status === 202) { + await this.axios.get('/webauthn/credentials', {returnError: true}) + .then(response => { + this.credentials = response.data + }) + .catch(error => { + if( error.response.status === 400 ) { + this.isRemoteUser = true } - else this.credentials = response.data + else { + + this.$router.push({ name: 'genericError', params: { err: error.response } }); + } }) this.isFetching = false diff --git a/routes/web.php b/routes/web.php index 8b4d6b18..00d5b362 100644 --- a/routes/web.php +++ b/routes/web.php @@ -16,7 +16,7 @@ /** * Routes that only work for unauthenticated user (return an error otherwise) */ -Route::group(['middleware' => ['guest', 'disableInDemoMode']], function () { +Route::group(['middleware' => ['guest', 'rejectIfDemoMode']], function () { Route::post('user', 'Auth\RegisterController@register')->name('user.register'); Route::post('user/password/lost', 'Auth\ForgotPasswordController@sendResetLinkEmail')->name('user.password.lost');; Route::post('user/password/reset', 'Auth\ResetPasswordController@reset')->name('user.password.reset'); @@ -36,17 +36,17 @@ }); /** - * Routes protected by an authentication guard + * Routes protected by an authentication guard but rejected when reverse-proxy guard is enabled */ -Route::group(['middleware' => 'behind-auth'], function () { +Route::group(['middleware' => ['behind-auth', 'rejectIfReverseProxy']], function () { Route::put('user', 'Auth\UserController@update')->name('user.update'); - Route::patch('user/password', 'Auth\PasswordController@update')->name('user.password.update')->middleware('disableInDemoMode'); + Route::patch('user/password', 'Auth\PasswordController@update')->name('user.password.update')->middleware('rejectIfDemoMode'); Route::get('user/logout', 'Auth\LoginController@logout')->name('user.logout'); - Route::delete('user', 'Auth\UserController@delete')->name('user.delete')->middleware('disableInDemoMode'); + Route::delete('user', 'Auth\UserController@delete')->name('user.delete')->middleware('rejectIfDemoMode'); - Route::get('oauth/personal-access-tokens', 'Auth\PersonalAccessTokenController@forUser')->name('passport.personal.tokens.index'); - Route::post('oauth/personal-access-tokens', 'Auth\PersonalAccessTokenController@store')->name('passport.personal.tokens.store'); - Route::delete('oauth/personal-access-tokens/{token_id}', 'Auth\PersonalAccessTokenController@destroy')->name('passport.personal.tokens.destroy'); + Route::get('oauth/personal-access-tokens', 'Laravel\Passport\Http\Controllers\PersonalAccessTokenController@forUser')->name('passport.personal.tokens.index'); + Route::post('oauth/personal-access-tokens', 'Laravel\Passport\Http\Controllers\PersonalAccessTokenController@store')->name('passport.personal.tokens.store'); + Route::delete('oauth/personal-access-tokens/{token_id}', 'Laravel\Passport\Http\Controllers\PersonalAccessTokenController@destroy')->name('passport.personal.tokens.destroy'); Route::post('webauthn/register/options', [WebAuthnRegisterController::class, 'options'])->name('webauthn.register.options'); Route::post('webauthn/register', [WebAuthnRegisterController::class, 'register'])->name('webauthn.register');