@@ -19,6 +19,12 @@ type digestClient struct {
19
19
lastSeen int64
20
20
}
21
21
22
+ // DigestAuth is an authenticator implementation for 'Digest' HTTP Authentication scheme (RFC 7616).
23
+ //
24
+ // Note: this implementation was written following now deprecated RFC
25
+ // 2617, and supports only MD5 algorithm.
26
+ //
27
+ // TODO: Add support for SHA-256 and SHA-512/256 algorithms.
22
28
type DigestAuth struct {
23
29
Realm string
24
30
Opaque string
@@ -64,9 +70,7 @@ func (c digestCache) Swap(i, j int) {
64
70
c [i ], c [j ] = c [j ], c [i ]
65
71
}
66
72
67
- /*
68
- Purge removes count oldest entries from DigestAuth.clients
69
- */
73
+ // Purge removes count oldest entries from DigestAuth.clients
70
74
func (da * DigestAuth ) Purge (count int ) {
71
75
da .mutex .Lock ()
72
76
defer da .mutex .Unlock ()
@@ -81,10 +85,8 @@ func (da *DigestAuth) Purge(count int) {
81
85
}
82
86
}
83
87
84
- /*
85
- http.Handler for DigestAuth which initiates the authentication process
86
- (or requires reauthentication).
87
- */
88
+ // RequireAuth is an http.HandlerFunc which initiates the
89
+ // authentication process (or requires reauthentication).
88
90
func (da * DigestAuth ) RequireAuth (w http.ResponseWriter , r * http.Request ) {
89
91
da .mutex .RLock ()
90
92
clientsLen := len (da .clients )
@@ -109,11 +111,9 @@ func (da *DigestAuth) RequireAuth(w http.ResponseWriter, r *http.Request) {
109
111
da .mutex .RUnlock ()
110
112
}
111
113
112
- /*
113
- Parse Authorization header from the http.Request. Returns a map of
114
- auth parameters or nil if the header is not a valid parsable Digest
115
- auth header.
116
- */
114
+ // DigestAuthParams parses Authorization header from the
115
+ // http.Request. Returns a map of auth parameters or nil if the header
116
+ // is not a valid parsable Digest auth header.
117
117
func DigestAuthParams (authorization string ) map [string ]string {
118
118
s := strings .SplitN (authorization , " " , 2 )
119
119
if len (s ) != 2 || s [0 ] != "Digest" {
@@ -123,12 +123,10 @@ func DigestAuthParams(authorization string) map[string]string {
123
123
return ParsePairs (s [1 ])
124
124
}
125
125
126
- /*
127
- Check if request contains valid authentication data. Returns a pair
128
- of username, authinfo where username is the name of the authenticated
129
- user or an empty string and authinfo is the contents for the optional
130
- Authentication-Info response header.
131
- */
126
+ // CheckAuth checks whether the request contains valid authentication
127
+ // data. Returns a pair of username, authinfo, where username is the
128
+ // name of the authenticated user or an empty string and authinfo is
129
+ // the contents for the optional Authentication-Info response header.
132
130
func (da * DigestAuth ) CheckAuth (r * http.Request ) (username string , authinfo * string ) {
133
131
da .mutex .RLock ()
134
132
defer da .mutex .RUnlock ()
@@ -211,21 +209,18 @@ func (da *DigestAuth) CheckAuth(r *http.Request) (username string, authinfo *str
211
209
return auth ["username" ], & info
212
210
}
213
211
214
- /*
215
- Default values for ClientCacheSize and ClientCacheTolerance for DigestAuth
216
- */
217
- const DefaultClientCacheSize = 1000
218
- const DefaultClientCacheTolerance = 100
219
-
220
- /*
221
- Wrap returns an Authenticator which uses HTTP Digest
222
- authentication. Arguments:
223
-
224
- realm: The authentication realm.
212
+ // Default values for ClientCacheSize and ClientCacheTolerance for DigestAuth
213
+ const (
214
+ DefaultClientCacheSize = 1000
215
+ DefaultClientCacheTolerance = 100
216
+ )
225
217
226
- secrets: SecretProvider which must return HA1 digests for the same
227
- realm as above.
228
- */
218
+ // Wrap returns an http.HandlerFunc wraps AuthenticatedHandlerFunc
219
+ // with this DigestAuth authentication checks. Once the request
220
+ // contains valid credentials, it calls wrapped
221
+ // AuthenticatedHandlerFunc.
222
+ //
223
+ // Deprecated: new code should use NewContext instead.
229
224
func (da * DigestAuth ) Wrap (wrapped AuthenticatedHandlerFunc ) http.HandlerFunc {
230
225
return func (w http.ResponseWriter , r * http.Request ) {
231
226
if username , authinfo := da .CheckAuth (r ); username == "" {
@@ -240,11 +235,12 @@ func (da *DigestAuth) Wrap(wrapped AuthenticatedHandlerFunc) http.HandlerFunc {
240
235
}
241
236
}
242
237
243
- /*
244
- JustCheck returns function which converts an http.HandlerFunc into a
245
- http.HandlerFunc which requires authentication. Username is passed as
246
- an extra X-Authenticated-Username header.
247
- */
238
+ // JustCheck returns a new http.HandlerFunc, which requires
239
+ // DigestAuth to successfully authenticate a user before calling
240
+ // wrapped http.HandlerFunc.
241
+ //
242
+ // Authenticated Username is passed as an extra
243
+ // X-Authenticated-Username header to the wrapped HandlerFunc.
248
244
func (da * DigestAuth ) JustCheck (wrapped http.HandlerFunc ) http.HandlerFunc {
249
245
return da .Wrap (func (w http.ResponseWriter , ar * AuthenticatedRequest ) {
250
246
ar .Header .Set (AuthUsernameHeader , ar .Username )
0 commit comments