TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-04-16 03:31:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

client/web: skip authorization checks for static assets

Browse Source 
Updates tailscale/corp#13775

Signed-off-by: Will Norris <will@tailscale.com>
This commit is contained in:
Will Norris 2023-08-24 14:40:17 -07:00 committed by Will Norris
parent 18d9c92342
commit be5bd1e619
1 changed files with 24 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
client/web/web.go
View File

@ -183,19 +183,6 @@ func (s *Server) updateSelf(self tailcfg.NodeView) {
// ServeHTTP processes all requests for the Tailscale web client. // ServeHTTP processes all requests for the Tailscale web client.
func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
// some platforms where the client runs have their own authentication
// and authorization mechanisms we need to work with. Do those checks first.
switch distro.Get() {
case distro.Synology:
if authorizeSynology(w, r) {
return
}
case distro.QNAP:
if authorizeQNAP(w, r) {
return
}
}
handler := s.serve handler := s.serve
// if running in cgi mode, strip the cgi path prefix // if running in cgi mode, strip the cgi path prefix
@ -217,7 +204,30 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
handler(w, r) handler(w, r)
} }
// authorize checks if the request is authorized to access the web client for those platforms that support it.
func authorize(w http.ResponseWriter, r *http.Request) (handled bool) {
if strings.HasPrefix(r.URL.Path, "/assets/") {
// don't require authorization for static assets
return false
}
switch distro.Get() {
case distro.Synology:
return authorizeSynology(w, r)
case distro.QNAP:
return authorizeQNAP(w, r)
}
return false
}
func (s *Server) serve(w http.ResponseWriter, r *http.Request) { func (s *Server) serve(w http.ResponseWriter, r *http.Request) {
// Authenticate and authorize the request for platforms that support it.
// Return if the request was processed.
if authorize(w, r) {
return
}
if s.devMode { if s.devMode {
if strings.HasPrefix(r.URL.Path, "/api/") { if strings.HasPrefix(r.URL.Path, "/api/") {
// Pass through to other handlers via CSRF protection. // Pass through to other handlers via CSRF protection.
@ -524,6 +534,7 @@ func enforcePrefix(prefix string, h http.HandlerFunc) http.HandlerFunc {
http.Redirect(w, r, prefix, http.StatusFound) http.Redirect(w, r, prefix, http.StatusFound)
return return
} }
prefix = strings.TrimSuffix(prefix, "/")
http.StripPrefix(prefix, h).ServeHTTP(w, r) http.StripPrefix(prefix, h).ServeHTTP(w, r)
} }
} }