Allow Basic Auth on Public Page

sebastiank · October 15, 2023, 5:50pm

Hi Everyone,

I am working on a app to feed contacts data to devices like SIP phones, so far everything is working pretty well.

But I am now trying to add a layer of security using basic auth. Yes, I know basic auth is very insecure, but I have no choice in this, as most SIP devices only support basic auth.

The problem I am coming across is that when I send a request to NC with a full basic auth header (username:password), NC returns a 401 and dose not trigger my function. But if I send a partial header (:password) the the function triggers as expected. This would work, but the problem is that my test devices require a username to send basic auth.

So is there a way to stop NC from processing the basic auth on my apps route? Or a way of intercepting the request before NC does its check?

Here is the controller code:

github.com

ksainc/data/blob/c0eb3ced81130a361b09c636a6fcf173a1af99eb/lib/Controller/DataController.php#L165-L186


      
          	public function grandstream(string $id) {
          
          		
          		if (empty($this->request->__get('server')['HTTP_AUTHORIZATION']) ||
          			str_starts_with($this->request->__get('server')['HTTP_AUTHORIZATION'], 'Basic ') === false) {
          			return null;
          		}
          
          		// decode token
          		$token = substr($this->request->__get('server')['HTTP_AUTHORIZATION'], 6);
          		$token = explode(':', base64_decode($token), 2)[1];
          
          		// collect meta data
          		$meta = [];
          		$meta['token'] = $token;
          		$meta['address'] = $this->request->__get('server')['REMOTE_ADDR'];
          		$meta['agent'] = $this->request->__get('server')['HTTP_USER_AGENT'];
          		$meta['mac'] = \OCA\Data\Utile\Extractor::mac($meta['agent'], true);
          
          		return $this->device($id, $token, $meta, 'text/xml; charset=UTF-8');

This file has been truncated. show original

Thanks in advance.
Sebastian

sebastiank · October 16, 2023, 12:54am

So after many hours of trying things, from every example I could find to writing middleware and nothing working. I decided to try a NC users credentials, in the Basic auth heaader and to my surprise the method fired. So I guess basic auth in not blocked, but being intercepted.

The question now is how to disable NC auth mechanism on these requests.

bb77 · October 16, 2023, 8:17am

DELETED - Message to myself: Read the original post before replying