go_httpauth/http_basic_auth.go at master · SunRunAway/go_httpauth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
package go_httpauth

import (
	"encoding/base64"
	"fmt"
	"net/http"
	"strings"
)

type BasicServer Server

func NewBasic(realm string, authfun func(user, realm string) string) *BasicServer {
	return (*BasicServer)(newServer(realm, authfun))
}

func encodeB64(msg string) string {
	encoding := base64.StdEncoding
	buf := make([]byte, encoding.EncodedLen(len(msg)))
	encoding.Encode(buf, []byte(msg))
	return fmt.Sprintf("%s", buf)
}

func decodeB64(msg64 string) string {
	encoding := base64.StdEncoding
	buf := make([]byte, encoding.DecodedLen(len(msg64)))
	encoding.Decode(buf, []byte(msg64))
	// Fix bug where buf is padded with zero bytes
	for i, c := range buf {
		//fmt.Printf("DC -> i: %d c: %c (as x: %x, as d:%d) \n", i, c, c, c)
		if int(c) == 0 {
			return fmt.Sprintf("%s", buf[0:i])
		}
	}
	return fmt.Sprintf("%s", buf)
}

func parseBasicAuthHeader(r *http.Request) (string, string) {
	// Check whether we are basic authenticating
	ad := strings.SplitN(strings.Trim(fmt.Sprintf("%s", r.Header["Authorization"]), "[]"), " ", 2)

	if len(ad) != 2 || ad[0] != "Basic" {
		return "", ""
	}

	// Split username, password as kv
	u_p := strings.SplitN(decodeB64(ad[1]), ":", 2)
	if len(u_p) != 2 {
		return "", ""
	}
	return u_p[0], u_p[1]
}

// Authenticates
func (s *BasicServer) Auth(w http.ResponseWriter, r *http.Request) bool {
	var pass string
	username, password := parseBasicAuthHeader(r)
	if username == "" || password == "" {
		goto NeedAuth
	}

	// Call username lookup and test username/password combo
	pass = s.AuthFun(username, s.Realm)

	if pass != password {
		goto NeedAuth
	}

	return true

NeedAuth:
	w.Header().Set("WWW-Authenticate", "Basic")
	w.WriteHeader(401)
	w.Write([]byte(`<!DOCTYPE html><title>Unauthorized</title><h1>401 Unauthorized</h1></html>`))

	return false
}