Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a new setting to redirect unknown URLs to either the SSO portal or a 404 page #212

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

Add a new setting to redirect unknown URLs to either the SSO portal or a 404 page #212

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,12 @@ Whether authentication should use secure connection or not (**default**: `https`

---------------

### err404_to_portal

Wether to redirect unknown URLs to the portal or to a 404 page (**default**: `true`).

---------------

### domains

List of handled domains (**default**: similar to `portal_domain`).
Expand Down
10 changes: 8 additions & 2 deletions access.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,9 +315,15 @@ for permission_name, permission_infos in pairs(conf["permissions"]) do
end
end

---
--- 5. REDIRECT TO 404 PAGE IF UNKNOWN URL -> PORTAL IS DISABLED
---
if not conf["err404_to_portal"] and longest_url_match == "" then
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah that's interesting because URL which do match a permission in the SSOwat conf will still redirect to the portal

Dunno if that was the intent but to me that's indeed the behavior we want ;)

Copy link
Author

@Salamandar Salamandar Mar 10, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmmmm.
Yeah, I think that is. Although… That could very well be configurable too. Do you want the public to know you have a mydomain.tld/very_secret_app_with_a_well_known_name_in_the_url ?

For now, an existing app and a non-existing one will have the same behaviour. Maybe some people will want to keep that.
There would be 2 settings :

  • Redirect unknown urls to 404 -> default should be true
  • Redirect known URLs to 404 instead of login page -> default should be false

return ngx.exit(ngx.HTTP_NOT_FOUND)
end

---
--- 5. CHECK CLIENT-PROVIDED AUTH HEADER (should almost never happen?)
--- 6. CHECK CLIENT-PROVIDED AUTH HEADER (should almost never happen?)
---

if permission ~= nil then
Expand All @@ -336,7 +342,7 @@ end

--
--
-- 6. APPLY PERMISSION
-- 7. APPLY PERMISSION
--
--

Expand Down
3 changes: 2 additions & 1 deletion conf.json.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,8 +62,9 @@
},
"portal_domain": "example.tld",
"portal_path": "/yunohost/sso/",
"err404_to_portal": true,
"redirected_regex": {
"example.tld/yunohost[\\/]?$": "https://example.tld/yunohost/sso/"
},
"redirected_urls": {}
}
}
3 changes: 2 additions & 1 deletion config.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ function get_config()
-- If the timestamp of the modification or the size is different, reload the configuration.
config_attributes = new_config_attributes
config_persistent_attributes = new_config_persistent_attributes

local conf_file = assert(io.open(conf_path, "r"), "Configuration file is missing")
conf = json.decode(conf_file:read("*all"))
conf_file:close()
Expand Down Expand Up @@ -83,6 +83,7 @@ function get_config()
default_conf = {
portal_scheme = "https",
portal_path = "/ssowat/",
err404_to_portal = true,
local_portal_domain = "yunohost.local",
domains = { conf["portal_domain"], "yunohost.local" },
session_timeout = 60 * 60 * 24, -- one day
Expand Down