Implement user accounts and token based authentication with CSRF protection #202
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Add the three original files from https://code.jquery.com/ so the source code stays available, license is within the files itself. (This is followig the example of other third party source files in this repository.)
* 3.2.0 -> 3.4.1, changed navbar style so that both images in the brand align again.
The session store uses SQLite to store the data and provides methods to add user accounts, verify passwords and to start and verify session tokens.
The server now requires authentication: The client has login with the new login API function and then use the returned session token in subsequent requests. This commit implements the API part of this, using new reworked session store for the user accounts and token implementation. The client is modified to have a login button that uses a modal dialog to ask for username and password, fetches a token from the server and stores it in the browser's sessionStorage. The JS-initiated HTTP requests are now done through the new authenticatedGetJson function in static.js which retrieves the token and sends it in the Authorization header. The implementation is still a little rough, particularly the UI part. In particular, authentication is effectively optional in the sense that if no session store has been configured, no login is required. However the login button is always shown. Also the styling of login button and dialog could be improved and some of the behavior could be better (e.g. log out should return to the main page).
The command can be invoked like this: hug -m intelmq_manager.api -c add_user <username> The command asks for the password for the account. The implementation takes the filename of the configuration file from the environment variable INTELMQ_MANAGER_CONFIG, just like intelmq_manager.serve does.
Closed
* Switch to python from php for CI. * Chance version number to be python setuputils compatible and silence a CI warning. * Remove outdated auth section in docs/INSTALL.md, add TODO instead.
|
Some tasks left:
|
* remove php requirement, add python. Using explicit package name, until we change to using a requirements.txt file.
* Add X-Python3-Version to control and add more build-dependencies.
* Try bionic and using apt for getting pytho3 an packages.
* change travis config to have access to side packages
|
That looks like lots of efforts have been made to accomplish this! Many thanks! Is this intended to get merged or is it WIP? |
Both! ;) Because there are some things which would be better, and it is likely that we'll improve them. On the other hand, it already improves an important security property, so it is a lot better than before and should see production as soon as possible. |
This configuration reflects the command I've been using during development.
ghost
added this to the 
ghost
merged commit
|
Thanks @wagner-certat |
This pull request was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Implement user accounts and token based authentication
This pull request adds a store for user accounts and session data and
implements sessions on top of that as outlined in the discussion for
#111.
The UI part is a bit unpolished in the current version, but it's working
and can at least serve as a starting point for discussing how to merge
this.