Stefan/evcc-io
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Auth: coexist with reverse proxy Authorization header (#30757)

Browse source
This commit is contained in:
Michael Geers 2026-06-12 17:29:32 +02:00 • committed by GitHub
parent 92478cf74e
commit dcdda5689d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 15 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

21
server/http_auth.go
View file

@ -66,9 +66,13 @@ func updatePasswordHandler(authObject auth.Auth) http.HandlerFunc {
}
}
// apiKeyFromRequest returns the API key from the Authorization: Bearer header, or "" if absent
// apiKeyFromRequest returns the API key from the Authorization: Bearer header, or "" if absent.
// A non-Bearer Authorization header (e.g. Basic auth injected by a reverse proxy) is ignored.
func apiKeyFromRequest(r *http.Request) string {
token, _ := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
token, found := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
if !found {
return ""
}
return token
}
@ -80,12 +84,17 @@ func jwtFromCookie(r *http.Request) string {
return ""
}
// validateAuth accepts a valid API key from the Authorization header, or a valid session JWT from the auth cookie
// validateAuth accepts a valid API key from the Authorization header, or a valid session JWT from the auth cookie.
// Any single valid credential grants access, so evcc coexists with a reverse proxy that injects its own
// Authorization header or with clients that forward an unrelated bearer token.
func validateAuth(authObject auth.Auth, r *http.Request) bool {
if key := apiKeyFromRequest(r); key != "" {
return authObject.ValidateApiKey(key)
if key := apiKeyFromRequest(r); key != "" && authObject.ValidateApiKey(key) {
return true
}
return authObject.ValidateJwtToken(jwtFromCookie(r))
if jwt := jwtFromCookie(r); jwt != "" && authObject.ValidateJwtToken(jwt) {
return true
}
return false
}
// requireAdminPassword passes when --disable-auth is set or the supplied password matches.