Skip to content

Commit 8f39e48

Browse files
hvthvt
authored
Do not respond with a "Location" header when redirects are disabled (TeslaGov#74)
* In the default nginx config (used in the Docker container), nginx listens on port 80 * Do not respond with a "Location" header when redirects are disabled
1 parent aa024c5 commit 8f39e48

File tree

2 files changed

+73
-74
lines changed

2 files changed

+73
-74
lines changed

‎Makefile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ stop-nginx:
4646

4747
.PHONY: start-nginx
4848
start-nginx:
49-
docker run --rm --name "${DOCKER_IMAGE_NAME}" -d -p 8000:8000 ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}
49+
docker run --rm --name "${DOCKER_IMAGE_NAME}" -d -p 8000:80 ${DOCKER_ORG_NAME}/${DOCKER_IMAGE_NAME}
5050

5151
.PHONY: cp-bin
5252
cp-bin: start-nginx
@@ -70,4 +70,4 @@ test:
7070
IMAGE_VERSION=${NGINX_VERSION} docker compose -f ./docker-compose-test.yml up --no-start
7171
docker start ${COMPOSE_PROJECT_NAME}-nginx-1
7272
docker start -a ${COMPOSE_PROJECT_NAME}-runner-1
73-
docker compose -f ./docker-compose-test.yml down
73+
docker compose -f ./docker-compose-test.yml down

‎src/ngx_http_auth_jwt_module.c

Lines changed: 71 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,7 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
227227

228228
if (jwtParseReturnCode != 0)
229229
{
230-
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse jwt");
230+
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "failed to parse jwt, error code %d", jwtParseReturnCode);
231231
goto redirect;
232232
}
233233

@@ -293,88 +293,87 @@ static ngx_int_t ngx_http_auth_jwt_handler(ngx_http_request_t *r)
293293
jwt_free(jwt);
294294
}
295295

296-
r->headers_out.___location = ngx_list_push(&r->headers_out.headers);
297-
298-
if (r->headers_out.___location == NULL)
296+
if (jwtcf->auth_jwt_redirect)
299297
{
300-
ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
301-
}
298+
r->headers_out.___location = ngx_list_push(&r->headers_out.headers);
302299

303-
r->headers_out.___location->hash = 1;
304-
r->headers_out.___location->key.len = sizeof("Location") - 1;
305-
r->headers_out.___location->key.data = (u_char *) "Location";
300+
if (r->headers_out.___location == NULL)
301+
{
302+
ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
303+
}
306304

307-
if (r->method == NGX_HTTP_GET)
308-
{
309-
int loginlen;
310-
char * scheme;
311-
ngx_str_t server;
312-
ngx_str_t uri_variable_name = ngx_string("request_uri");
313-
ngx_int_t uri_variable_hash;
314-
ngx_http_variable_value_t * request_uri_var;
315-
ngx_str_t uri;
316-
ngx_str_t uri_escaped;
317-
uintptr_t escaped_len;
318-
319-
loginlen = jwtcf->auth_jwt_loginurl.len;
320-
scheme = (r->connection->ssl) ? "https" : "http";
321-
server = r->headers_in.server;
322-
323-
// get the URI
324-
uri_variable_hash = ngx_hash_key(uri_variable_name.data, uri_variable_name.len);
325-
request_uri_var = ngx_http_get_variable(r, &uri_variable_name, uri_variable_hash);
326-
327-
// get the URI
328-
if(request_uri_var && !request_uri_var->not_found && request_uri_var->valid)
305+
r->headers_out.___location->hash = 1;
306+
r->headers_out.___location->key.len = sizeof("Location") - 1;
307+
r->headers_out.___location->key.data = (u_char *) "Location";
308+
309+
if (r->method == NGX_HTTP_GET)
329310
{
330-
// ideally we would like the uri with the querystring parameters
331-
uri.data = ngx_palloc(r->pool, request_uri_var->len);
332-
uri.len = request_uri_var->len;
333-
ngx_memcpy(uri.data, request_uri_var->data, request_uri_var->len);
311+
int loginlen;
312+
char * scheme;
313+
ngx_str_t server;
314+
ngx_str_t uri_variable_name = ngx_string("request_uri");
315+
ngx_int_t uri_variable_hash;
316+
ngx_http_variable_value_t * request_uri_var;
317+
ngx_str_t uri;
318+
ngx_str_t uri_escaped;
319+
uintptr_t escaped_len;
320+
321+
loginlen = jwtcf->auth_jwt_loginurl.len;
322+
scheme = (r->connection->ssl) ? "https" : "http";
323+
server = r->headers_in.server;
324+
325+
// get the URI
326+
uri_variable_hash = ngx_hash_key(uri_variable_name.data, uri_variable_name.len);
327+
request_uri_var = ngx_http_get_variable(r, &uri_variable_name, uri_variable_hash);
328+
329+
// get the URI
330+
if(request_uri_var && !request_uri_var->not_found && request_uri_var->valid)
331+
{
332+
// ideally we would like the uri with the querystring parameters
333+
uri.data = ngx_palloc(r->pool, request_uri_var->len);
334+
uri.len = request_uri_var->len;
335+
ngx_memcpy(uri.data, request_uri_var->data, request_uri_var->len);
336+
}
337+
else
338+
{
339+
// fallback to the querystring without params
340+
uri = r->uri;
341+
}
342+
343+
// escape the URI
344+
escaped_len = 2 * ngx_escape_uri(NULL, uri.data, uri.len, NGX_ESCAPE_ARGS) + uri.len;
345+
uri_escaped.data = ngx_palloc(r->pool, escaped_len);
346+
uri_escaped.len = escaped_len;
347+
ngx_escape_uri(uri_escaped.data, uri.data, uri.len, NGX_ESCAPE_ARGS);
348+
349+
r->headers_out.___location->value.len = loginlen + sizeof("?return_url=") - 1 + strlen(scheme) + sizeof("://") - 1 + server.len + uri_escaped.len;
350+
return_url = ngx_palloc(r->pool, r->headers_out.___location->value.len);
351+
ngx_memcpy(return_url, jwtcf->auth_jwt_loginurl.data, jwtcf->auth_jwt_loginurl.len);
352+
int return_url_idx = jwtcf->auth_jwt_loginurl.len;
353+
ngx_memcpy(return_url+return_url_idx, "?return_url=", sizeof("?return_url=") - 1);
354+
return_url_idx += sizeof("?return_url=") - 1;
355+
ngx_memcpy(return_url+return_url_idx, scheme, strlen(scheme));
356+
return_url_idx += strlen(scheme);
357+
ngx_memcpy(return_url+return_url_idx, "://", sizeof("://") - 1);
358+
return_url_idx += sizeof("://") - 1;
359+
ngx_memcpy(return_url+return_url_idx, server.data, server.len);
360+
return_url_idx += server.len;
361+
ngx_memcpy(return_url+return_url_idx, uri_escaped.data, uri_escaped.len);
362+
return_url_idx += uri_escaped.len;
363+
r->headers_out.___location->value.data = (u_char *)return_url;
334364
}
335365
else
336366
{
337-
// fallback to the querystring without params
338-
uri = r->uri;
367+
// for non-get requests, redirect to the login page without a return URL
368+
r->headers_out.___location->value.len = jwtcf->auth_jwt_loginurl.len;
369+
r->headers_out.___location->value.data = jwtcf->auth_jwt_loginurl.data;
339370
}
340371

341-
// escape the URI
342-
escaped_len = 2 * ngx_escape_uri(NULL, uri.data, uri.len, NGX_ESCAPE_ARGS) + uri.len;
343-
uri_escaped.data = ngx_palloc(r->pool, escaped_len);
344-
uri_escaped.len = escaped_len;
345-
ngx_escape_uri(uri_escaped.data, uri.data, uri.len, NGX_ESCAPE_ARGS);
346-
347-
r->headers_out.___location->value.len = loginlen + sizeof("?return_url=") - 1 + strlen(scheme) + sizeof("://") - 1 + server.len + uri_escaped.len;
348-
return_url = ngx_palloc(r->pool, r->headers_out.___location->value.len);
349-
ngx_memcpy(return_url, jwtcf->auth_jwt_loginurl.data, jwtcf->auth_jwt_loginurl.len);
350-
int return_url_idx = jwtcf->auth_jwt_loginurl.len;
351-
ngx_memcpy(return_url+return_url_idx, "?return_url=", sizeof("?return_url=") - 1);
352-
return_url_idx += sizeof("?return_url=") - 1;
353-
ngx_memcpy(return_url+return_url_idx, scheme, strlen(scheme));
354-
return_url_idx += strlen(scheme);
355-
ngx_memcpy(return_url+return_url_idx, "://", sizeof("://") - 1);
356-
return_url_idx += sizeof("://") - 1;
357-
ngx_memcpy(return_url+return_url_idx, server.data, server.len);
358-
return_url_idx += server.len;
359-
ngx_memcpy(return_url+return_url_idx, uri_escaped.data, uri_escaped.len);
360-
return_url_idx += uri_escaped.len;
361-
r->headers_out.___location->value.data = (u_char *)return_url;
362-
}
363-
else
364-
{
365-
// for non-get requests, redirect to the login page without a return URL
366-
r->headers_out.___location->value.len = jwtcf->auth_jwt_loginurl.len;
367-
r->headers_out.___location->value.data = jwtcf->auth_jwt_loginurl.data;
368-
}
369-
370-
if (jwtcf->auth_jwt_redirect)
371-
{
372372
return NGX_HTTP_MOVED_TEMPORARILY;
373373
}
374-
else
375-
{
376-
return NGX_HTTP_UNAUTHORIZED;
377-
}
374+
375+
// When no redirect is needed, no "Location" header construction is needed, and we can respond with a 401
376+
return NGX_HTTP_UNAUTHORIZED;
378377
}
379378

380379

0 commit comments

Comments
 (0)