diff options
Diffstat (limited to 'src/api/auth.rs')
| -rw-r--r-- | src/api/auth.rs | 19 |
1 files changed, 4 insertions, 15 deletions
diff --git a/src/api/auth.rs b/src/api/auth.rs index abb8c1a..fb03ea1 100644 --- a/src/api/auth.rs +++ b/src/api/auth.rs @@ -308,21 +308,10 @@ pub(crate) async fn basic_auth( .map(|user| (user, Via("htpasswd"))), }; let Some((user, via)) = user else { - sleep(Duration::from_millis(1500)).await; - // A browser opening the dashboard: to the page to log in on. - if cfg!(feature = "dashboard") - && request.method() == axum::http::Method::GET - && request.uri().path() == "/admin/dashboard" - && headers - .get(axum::http::header::ACCEPT) - .and_then(|accept| accept.to_str().ok()) - .is_some_and(|accept| accept.contains("text/html")) - { - return ( - StatusCode::SEE_OTHER, - [(axum::http::header::LOCATION, "../login")], - ) - .into_response(); + // Slowing down guessing: only where credentials came (none: nothing guessed, and + // a page without a session goes to the login page at once). + if headers.contains_key(AUTHORIZATION) { + sleep(Duration::from_millis(1500)).await; } // A challenge only where basic authentication can answer it, for the API (curl, // which sends the password unasked with `-u` anyway), never to a browser: it would |