github
/
portainer
mirror of https://github.com/portainer/portainer
1
0
Fork 0
Code Issues Releases Wiki Activity

fix(docker-desktop): support auth cookies [BE-11134] (#12108)

pull/12119/head
Ali 2024-08-21 18:21:51 +12:00 committed by GitHub
parent 8cd53a4b7a
commit f016b31388
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
8 changed files with 70 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
api/http/csrf/csrf.go
View File

@ -4,6 +4,7 @@ import (
"crypto/rand"
"fmt"
"net/http"
"os"
"github.com/portainer/portainer/api/http/security"
httperror "github.com/portainer/portainer/pkg/libhttp/error"
@ -13,6 +14,13 @@ import (
)
func WithProtect(handler http.Handler) (http.Handler, error) {
// IsDockerDesktopExtension is used to check if we should skip csrf checks in the request bouncer (ShouldSkipCSRFCheck)
// DOCKER_EXTENSION is set to '1' in build/docker-extension/docker-compose.yml
isDockerDesktopExtension := false
if val, ok := os.LookupEnv("DOCKER_EXTENSION"); ok && val == "1" {
isDockerDesktopExtension = true
}
handler = withSendCSRFToken(handler)
token := make([]byte, 32)
@ -26,7 +34,7 @@ func WithProtect(handler http.Handler) (http.Handler, error) {
gorillacsrf.Secure(false),
)(handler)
return withSkipCSRF(handler), nil
return withSkipCSRF(handler, isDockerDesktopExtension), nil
}
func withSendCSRFToken(handler http.Handler) http.Handler {
@ -45,9 +53,9 @@ func withSendCSRFToken(handler http.Handler) http.Handler {
})
}
func withSkipCSRF(handler http.Handler) http.Handler {
func withSkipCSRF(handler http.Handler, isDockerDesktopExtension bool) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
skip, err := security.ShouldSkipCSRFCheck(r)
skip, err := security.ShouldSkipCSRFCheck(r, isDockerDesktopExtension)
if err != nil {
httperror.WriteError(w, http.StatusForbidden, err.Error(), err)

7
api/http/security/bouncer.go
View File

@ -528,7 +528,12 @@ func (bouncer *RequestBouncer) EdgeComputeOperation(next http.Handler) http.Hand
// - public routes
// - kubectl - a bearer token is needed, and no csrf token can be sent
// - api token
func ShouldSkipCSRFCheck(r *http.Request) (bool, error) {
// - docker desktop extension
func ShouldSkipCSRFCheck(r *http.Request, isDockerDesktopExtension bool) (bool, error) {
if isDockerDesktopExtension {
return true, nil
}
cookie, _ := r.Cookie(portainer.AuthCookieKey)
hasCookie := cookie != nil && cookie.Value != ""

62
api/http/security/bouncer_test.go
View File

@ -386,40 +386,52 @@ func Test_apiKeyLookup(t *testing.T) {
func Test_ShouldSkipCSRFCheck(t *testing.T) {
tt := []struct {
name string
cookieValue string
apiKey string
authHeader string
expectedResult bool
expectedError bool
name string
cookieValue string
apiKey string
authHeader string
isDockerDesktopExtension bool
expectedResult bool
expectedError bool
}{
{
name: "Should return false when cookie is present",
cookieValue: "test-cookie",
name: "Should return false (not skip) when cookie is present",
cookieValue: "test-cookie",
isDockerDesktopExtension: false,
},
{
name: "Should return true when cookie is not present",
cookieValue: "",
expectedResult: true,
name: "Should return true (skip) when cookie is present and docker desktop extension is true",
cookieValue: "test-cookie",
isDockerDesktopExtension: true,
expectedResult: true,
},
{
name: "Should return true when api key is present",
cookieValue: "",
apiKey: "test-api-key",
expectedResult: true,
name: "Should return true (skip) when cookie is not present",
cookieValue: "",
isDockerDesktopExtension: false,
expectedResult: true,
},
{
name: "Should return true when auth header is present",
cookieValue: "",
authHeader: "test-auth-header",
expectedResult: true,
name: "Should return true (skip) when api key is present",
cookieValue: "",
apiKey: "test-api-key",
isDockerDesktopExtension: false,
expectedResult: true,
},
{
name: "Should return false and error when both api key and auth header are present",
cookieValue: "",
apiKey: "test-api-key",
authHeader: "test-auth-header",
expectedError: true,
name: "Should return true (skip) when auth header is present",
cookieValue: "",
authHeader: "test-auth-header",
isDockerDesktopExtension: false,
expectedResult: true,
},
{
name: "Should return false (not skip) and error when both api key and auth header are present",
cookieValue: "",
apiKey: "test-api-key",
authHeader: "test-auth-header",
isDockerDesktopExtension: false,
expectedError: true,
},
}
@ -437,7 +449,7 @@ func Test_ShouldSkipCSRFCheck(t *testing.T) {
req.Header.Set(jwtTokenHeader, test.authHeader)
}
result, err := ShouldSkipCSRFCheck(req)
result, err := ShouldSkipCSRFCheck(req, test.isDockerDesktopExtension)
is.Equal(test.expectedResult, result)
if test.expectedError {
is.Error(err)

3
app/index.html
View File

@ -11,7 +11,8 @@
<meta name="robots" content="noindex" />
<base id="base" />
<script>
if (window.origin == 'file://') {
// http://localhost:49000 is a docker extension specific url (see /build/docker-extension/docker-compose.yml)
if (window.origin == 'http://localhost:49000') {
// we are loading the app from a local file as in docker extension
document.getElementById('base').href = 'http://localhost:49000/';

8
app/react/portainer/environments/wizard/HomeView/HomeView.tsx
View File

@ -47,8 +47,12 @@ export function HomeView() {
We could not connect your local environment to Portainer.
<br />
Please ensure your environment is correctly exposed. For
help with installation visit
<a href="https://documentation.portainer.io/quickstart/">
help with installation visit{' '}
<a
href="https://documentation.portainer.io/quickstart/"
target="_blank"
rel="noopener noreferrer"
>
https://documentation.portainer.io/quickstart
</a>
</p>

5
build/docker-extension/Makefile
View File

@ -20,7 +20,10 @@ build-remote:
docker buildx build -f build/linux/Dockerfile --push --builder=buildx-multi-arch --platform=windows/amd64,linux/amd64,linux/arm64 --build-arg TAG=$(VERSION) --build-arg PORTAINER_IMAGE_NAME=$(IMAGE_NAME) --tag=$(TAGGED_IMAGE_NAME) .
install:
docker extension install $(TAGGED_IMAGE_NAME)
docker extension install $(TAGGED_IMAGE_NAME) --force
dev:
docker extension dev debug $(IMAGE_NAME)
multiarch:
docker buildx create --name=buildx-multi-arch --driver=docker-container --driver-opt=network=host

7
build/docker-extension/README.md
View File

@ -20,10 +20,9 @@ Next you must install the CLI plugin to enable extension development. Please fol
### Build from local changes
1. Run `yarn` to install the project dependencies
2. Run `yarn dev:extension` to install the extension
3. Make your code changes
4. Re-run `yarn dev:extension` to rebuild and re-install with your latest changes
1. Run `make dev-extension` to install the project dependencies and start in development mode (note that this doesn't do live updates for frontend changes).
2. Make your code changes
3. Re-run `make dev-extension` to rebuild and re-install with your latest changes
## Accessing the Portainer extension

2
build/docker-extension/metadata.json
View File

@ -8,7 +8,7 @@
"dashboard-tab": {
"title": "Portainer",
"root": "/public",
"src": "index.html"
"src": "http://localhost:49000"
}
}
}