From 7aa981ba4987aa389396b4096b7a9fa990cdab1a Mon Sep 17 00:00:00 2001 From: Sonia Appasamy Date: Wed, 29 Nov 2023 13:16:32 -0500 Subject: [PATCH] client/web: remove duplicate WhoIs call Fixes a TODO in web.authorizeRequest. `getSession` calls `WhoIs` already. Call `getSession` earlier in `authorizeRequest` so we can avoid the duplicate `WhoIs` check on the same request. Updates #10261 Signed-off-by: Sonia Appasamy --- client/web/web.go | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/client/web/web.go b/client/web/web.go index 8929580c2..f009c0f6b 100644 --- a/client/web/web.go +++ b/client/web/web.go @@ -327,22 +327,17 @@ func (s *Server) requireTailscaleIP(w http.ResponseWriter, r *http.Request) (han // errors to the ResponseWriter itself. func (s *Server) authorizeRequest(w http.ResponseWriter, r *http.Request) (ok bool) { if s.mode == ManageServerMode { // client using tailscale auth - _, err := s.lc.WhoIs(r.Context(), r.RemoteAddr) + session, _, err := s.getSession(r) switch { - case err != nil: + case errors.Is(err, errNotUsingTailscale): // All requests must be made over tailscale. http.Error(w, "must access over tailscale", http.StatusUnauthorized) return false case r.URL.Path == "/api/data" && r.Method == httpm.GET: - // Readonly endpoint allowed without browser session. + // Readonly endpoint allowed without valid browser session. return true case strings.HasPrefix(r.URL.Path, "/api/"): // All other /api/ endpoints require a valid browser session. - // - // TODO(sonia): s.getSession calls whois again, - // should try and use the above call instead of running another - // localapi request. - session, _, err := s.getSession(r) if err != nil || !session.isAuthorized(s.timeNow()) { http.Error(w, "no valid session", http.StatusUnauthorized) return false