diff options
Diffstat (limited to 'src/api')
| -rw-r--r-- | src/api/auth.rs | 11 | ||||
| -rw-r--r-- | src/api/dashboard/dashboard.html | 4 |
2 files changed, 10 insertions, 5 deletions
diff --git a/src/api/auth.rs b/src/api/auth.rs index f28aa22..acf9d46 100644 --- a/src/api/auth.rs +++ b/src/api/auth.rs @@ -316,15 +316,20 @@ pub(crate) async fn basic_auth( ) .into_response(); } - // A challenge only where basic authentication can answer it. + // A challenge only where basic authentication can answer it, and not to a page's + // own requests (`Sec-Fetch-Dest: empty`: fetch, EventSource): the browser would + // ask for a password over the page, which has its own login (`/login`). + let from_a_page = headers + .get("sec-fetch-dest") + .is_some_and(|dest| dest == "empty"); return match state.users { - Some(_) => ( + Some(_) if !from_a_page => ( StatusCode::UNAUTHORIZED, [(WWW_AUTHENTICATE, r#"Basic realm="Restricted""#)], "Unauthorized", ) .into_response(), - None => (StatusCode::UNAUTHORIZED, "Unauthorized").into_response(), + _ => (StatusCode::UNAUTHORIZED, "Unauthorized").into_response(), }; }; diff --git a/src/api/dashboard/dashboard.html b/src/api/dashboard/dashboard.html index b80e0d2..0f31d7c 100644 --- a/src/api/dashboard/dashboard.html +++ b/src/api/dashboard/dashboard.html @@ -2314,10 +2314,10 @@ async function obtainTokens() { clearTimeout(tokenTimer); try { // Refreshed as the session (`POST /auth/session`), whose cookie lets the page in; - // the first: by the browser's password or the proxy's, else by that cookie. + // the first: by that cookie, else by the browser's password or the proxy's. token = token && token.expiresAt > Date.now() + 60000 ? await tokenCall("../auth/session", token.token) - : await tokenCall("../auth/login").catch(() => tokenCall("../auth/session")); + : await tokenCall("../auth/session").catch(() => tokenCall("../auth/login")); narrowToken = await tokenCall("../auth/refresh", token.token, { limit: READ_MEMBERS }); tokenWhy = null; const life = Math.min(token.expiresAt, narrowToken.expiresAt) - Date.now(); |