TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-03-20 21:21:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

client/web: remove duplicate WhoIs call

Browse Source 
Fixes a TODO in web.authorizeRequest.

`getSession` calls `WhoIs` already. Call `getSession` earlier in
`authorizeRequest` so we can avoid the duplicate `WhoIs` check on
the same request.

Updates #10261

Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
This commit is contained in:
Sonia Appasamy 2023-11-29 13:16:32 -05:00 committed by Sonia Appasamy
parent bc4e303846
commit 7aa981ba49
1 changed files with 3 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
client/web/web.go
View File

@ -327,22 +327,17 @@ func (s *Server) requireTailscaleIP(w http.ResponseWriter, r *http.Request) (han
// errors to the ResponseWriter itself. // errors to the ResponseWriter itself.
func (s *Server) authorizeRequest(w http.ResponseWriter, r *http.Request) (ok bool) { func (s *Server) authorizeRequest(w http.ResponseWriter, r *http.Request) (ok bool) {
if s.mode == ManageServerMode { // client using tailscale auth if s.mode == ManageServerMode { // client using tailscale auth
_, err := s.lc.WhoIs(r.Context(), r.RemoteAddr) session, _, err := s.getSession(r)
switch { switch {
case err != nil: case errors.Is(err, errNotUsingTailscale):
// All requests must be made over tailscale. // All requests must be made over tailscale.
http.Error(w, "must access over tailscale", http.StatusUnauthorized) http.Error(w, "must access over tailscale", http.StatusUnauthorized)
return false return false
case r.URL.Path == "/api/data" && r.Method == httpm.GET: case r.URL.Path == "/api/data" && r.Method == httpm.GET:
// Readonly endpoint allowed without browser session. // Readonly endpoint allowed without valid browser session.
return true return true
case strings.HasPrefix(r.URL.Path, "/api/"): case strings.HasPrefix(r.URL.Path, "/api/"):
// All other /api/ endpoints require a valid browser session. // All other /api/ endpoints require a valid browser session.
//
// TODO(sonia): s.getSession calls whois again,
// should try and use the above call instead of running another
// localapi request.
session, _, err := s.getSession(r)
if err != nil || !session.isAuthorized(s.timeNow()) { if err != nil || !session.isAuthorized(s.timeNow()) {
http.Error(w, "no valid session", http.StatusUnauthorized) http.Error(w, "no valid session", http.StatusUnauthorized)
return false return false