fix: improvements for login and oidc (#227)

* add csrf * caching * caching * caching * caching * security headers * csp and security headers * error handler csp * select user with display name * csp * user selection styling * username to loginname * regenerate grpc * regenerate * change to login name
2025-10-26 19:48:15 +00:00 · 2020-06-17 08:06:40 +02:00
parent dfe6d0deb4
commit 1c59d18fee
108 changed files with 19226 additions and 19220 deletions
--- a/internal/login/static/templates/change_password.html
+++ b/internal/login/static/templates/change_password.html
@@ -6,6 +6,8 @@

 <form action="{{ changePasswordUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />

    <div class="fields">
--- a/internal/login/static/templates/change_password_done.html
+++ b/internal/login/static/templates/change_password_done.html
@@ -6,6 +6,8 @@

 <form action="{{ loginUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />


--- a/internal/login/static/templates/init_password.html
+++ b/internal/login/static/templates/init_password.html
@@ -6,6 +6,8 @@

 <form action="{{ initPasswordUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />
    <input type="hidden" name="userID" value="{{ .UserID }}" />

--- a/internal/login/static/templates/init_password_done.html
+++ b/internal/login/static/templates/init_password_done.html
@@ -5,6 +5,8 @@
 <p>{{t "PasswordSetDone.Description"}}</p>
 <form action="{{ loginUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />

    <div class="actions">
--- a/internal/login/static/templates/init_user.html
+++ b/internal/login/static/templates/init_user.html
@@ -6,6 +6,8 @@

 <form action="{{ initUserUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />
    <input type="hidden" name="userID" value="{{ .UserID }}" />

--- a/internal/login/static/templates/init_user_done.html
+++ b/internal/login/static/templates/init_user_done.html
@@ -5,6 +5,8 @@
 <p>{{t "InitUserDone.Description"}}</p>
 <form action="{{ loginUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />

    <div class="actions">
--- a/internal/login/static/templates/login.html
+++ b/internal/login/static/templates/login.html
@@ -4,14 +4,16 @@
 <h1>{{t "Login.Title"}}</h1>
 <p>{{t "Login.Description"}}</p>

-<form action="{{ usernameUrl }}" method="POST">
+<form action="{{ loginNameUrl }}" method="POST">
+
+    {{ .CSRF }}

    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />

    <div class="fields">
        <div class="field">
-            <label class="label" for="username">{{t "Login.Loginname"}}</label>
-            <input class="input" type="text" id="username" name="username" placeholder="{{t "Login.LoginnamePlaceHolder"}}" value="{{ .UserName }}" autocomplete="username" autofocus required>
+            <label class="label" for="loginName">{{t "Login.Loginname"}}</label>
+            <input class="input" type="text" id="loginName" name="loginName" placeholder="{{t "Login.LoginnamePlaceHolder"}}" value="{{ .LoginName }}" autocomplete="username" autofocus required>
        </div>
    </div>

--- a/internal/login/static/templates/logout_done.html
+++ b/internal/login/static/templates/logout_done.html
@@ -5,6 +5,8 @@
 <p>{{t "LogoutDone.Description"}}</p>
 <form action="{{ loginUrl }}" method="POST">

+    {{ .CSRF }}
+
    <div class="actions">
        <button class="primary right" type="submit">{{t "Actions.Login"}}</button>
    </div>
--- a/internal/login/static/templates/mail_verification.html
+++ b/internal/login/static/templates/mail_verification.html
@@ -6,6 +6,8 @@

 <form action="{{ mailVerificationUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />
    <input type="hidden" name="userID" value="{{ .UserID }}" />

--- a/internal/login/static/templates/mail_verified.html
+++ b/internal/login/static/templates/mail_verified.html
@@ -6,6 +6,8 @@

 <form action="{{ loginUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />


--- a/internal/login/static/templates/mfa_init_done.html
+++ b/internal/login/static/templates/mfa_init_done.html
@@ -6,6 +6,8 @@

 <form action="{{ loginUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />
    <input type="hidden" name="mfaType" value="{{ .MfaType }}" />

--- a/internal/login/static/templates/mfa_init_verify.html
+++ b/internal/login/static/templates/mfa_init_verify.html
@@ -6,6 +6,8 @@

 <form action="{{ mfaInitVerifyUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />
    <input type="hidden" name="mfaType" value="{{ .MfaType }}" />
    <input type="hidden" name="url" value="{{ .Url }}" />
@@ -21,7 +23,7 @@
                <span class="label" for="secret">{{t "MfaInitVerify.Secret"}}</span>
                <span class="input" id="secret">
                    {{.Secret}}
-                    <span class="copy material-icons" onclick="copyToClipboard('{{ .Secret }}')">content_copy</span>
+                    <span class="copy material-icons" data-copy="{{ .Secret }}" >content_copy</span>
                </span>
            </div>
            <div class="field">
@@ -36,12 +38,7 @@
    </div>
 </form>

-<script>
-    const copyToClipboard = str => {
-        navigator.clipboard.writeText(str);
-    }
-</script>
-
+<script src="{{ resourceUrl "scripts/copy_to_clipboard.js" }}"></script>

 {{template "main-bottom" .}}
 
--- a/internal/login/static/templates/mfa_prompt.html
+++ b/internal/login/static/templates/mfa_prompt.html
@@ -5,6 +5,8 @@

 <form action="{{ mfaPromptUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />
    
    <div class="fields">
--- a/internal/login/static/templates/mfa_verify.html
+++ b/internal/login/static/templates/mfa_verify.html
@@ -6,6 +6,8 @@

 <form action="{{ mfaVerifyUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />
    <input type="hidden" name="mfaType" value="{{ .SelectedMfaProvider }}" />

--- a/internal/login/static/templates/password.html
+++ b/internal/login/static/templates/password.html
@@ -5,8 +5,10 @@

 <form action="{{ passwordUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />
-    <input type="hidden" name="username" value="{{ .UserName }}" />
+    <input type="hidden" name="loginName" value="{{ .LoginName }}" />

    <div class="fields">
        <div class="field">
@@ -19,7 +21,7 @@

    <div class="actions">
        <button class="primary right" type="submit">{{t "Actions.Next"}}</button>
-        <a href="{{ usernameChangeUrl .AuthReqID }}">
+        <a href="{{ loginNameChangeUrl .AuthReqID }}">
            <button class="secondary" type="button">{{t "Actions.Back"}}</button>
        </a>
        <a href="{{ passwordResetUrl .AuthReqID }}">
--- a/internal/login/static/templates/password_reset_done.html
+++ b/internal/login/static/templates/password_reset_done.html
@@ -5,6 +5,8 @@
 <p>{{t "PasswordResetDone.Description"}}</p>
 <form action="{{ loginUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />

    <div class="actions">
--- a/internal/login/static/templates/register.html
+++ b/internal/login/static/templates/register.html
@@ -5,6 +5,8 @@

 <form action="{{ registrationUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />

    <div class="fields">
--- a/internal/login/static/templates/select_user.html
+++ b/internal/login/static/templates/select_user.html
@@ -6,17 +6,32 @@

 <form action="{{ userSelectionUrl }}" method="POST">

+    {{ .CSRF }}
+
    <input type="hidden" name="authRequestID" value="{{ .AuthReqID }}" />

    <div class="actions">
-        {{ range $user := .Users }}
-        {{ $sessionState := (t (printf "UserSelection.SessionState%v" $user.UserSessionState)) }}
-        <button type="submit" name="userID" value="{{$user.UserID}}" class="primary">
-            <span class="username">{{$user.UserName}}</span>
-            <span class="sessionstate">({{$sessionState}})</span>
-        </button>
+        {{ if .Users }}
+        <div class="user-selection-list">
+            {{ range $user := .Users }}
+            {{ $sessionState := (printf "sessionstate-%v" $user.UserSessionState) }}
+            <button type="submit" name="userID" value="{{$user.UserID}}" class="clean user-selection">
+                <div>
+                    <div class="profile-image"></div>
+                    <div class="sessionstate {{$sessionState}}"></div>
+                </div>
+                <div class="names">
+                    <div class="displayname">{{$user.DisplayName}}</div>
+                    <div class="loginname">{{$user.LoginName}}</div>
+                </div>
+            </button>
+            {{ end }}
+        </div>
        {{ end }}
-        <button type="submit" name="userID" value="0" class="primary">{{t "UserSelection.OtherUser"}}</button>
+        <button type="submit" name="userID" value="0" class="clean other-user">
+            <div class="other-user-image"></div>
+            <div>{{t "UserSelection.OtherUser"}}</div>
+        </button>
    </div>
 </form>