proxmox-mirrors/proxmox
1
0
Fork 1
mirror of https://git.proxmox.com/git/proxmox synced 2025-08-10 20:07:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

auth-api: add logout method

Browse Source 
adds a new endpoint that is useful when dealing with HttpOnly cookies
that cannot be removed by client-side javascript (and by extension
wasm) code. the logout handle simply removes the cookie that is used
for storing the current ticket. this works the same way as it does in
the front-end: by setting an expired cookie with the same name.

as cookies are now prefixed with `__Host-` by default, the cookie here
also needs to be `Secure` and have the same `Path` to not be rejected
by the browser before it can remove the old cookie.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
This commit is contained in:
Shannon Sterz 2025-03-04 15:42:35 +01:00 committed by Wolfgang Bumiller
parent 6a7f631709
commit 1b9def4736
2 changed files with 29 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
proxmox-auth-api/src/api/access.rs
View File

@ -11,7 +11,7 @@ use proxmox_rest_server::{extract_cookie, RestEnvironment};
use proxmox_router::{
http_err, ApiHandler, ApiMethod, ApiResponseFuture, Permission, RpcEnvironment,
};
use proxmox_schema::{api, AllOfSchema, ApiType, ParameterSchema, ReturnType};
use proxmox_schema::{api, AllOfSchema, ApiType, ObjectSchema, ParameterSchema, ReturnType};
use proxmox_tfa::api::TfaChallenge;
use super::ApiTicket;
@ -63,6 +63,33 @@ pub async fn create_ticket(
handle_ticket_creation(create_params, env).await
}
pub const API_METHOD_LOGOUT: ApiMethod = ApiMethod::new(
&ApiHandler::AsyncHttpBodyParameters(&logout_handler),
&ObjectSchema::new("", &[]),
)
.protected(true)
.access(None, &Permission::World);
fn logout_handler(
_parts: Parts,
_param: Value,
_info: &ApiMethod,
_rpcenv: Box<dyn RpcEnvironment>,
) -> ApiResponseFuture {
Box::pin(async move {
// unset authentication cookie by setting an invalid one. needs the same `Path` and
// `Secure` parameter to not be rejected by some browsers. also use the same `HttpOnly` and
// `SameSite` parameters just in case.
let host_cookie = format!(
"{}=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure; SameSite=Lax; HttpOnly; Path=/;",
auth_context()?.prefixed_auth_cookie_name()
);
Ok(Response::builder()
.header(hyper::header::SET_COOKIE, host_cookie)
.body(Body::empty())?)
})
}
pub const API_METHOD_CREATE_TICKET_HTTP_ONLY: ApiMethod = ApiMethod::new_full(
&ApiHandler::AsyncHttpBodyParameters(&create_ticket_http_only),

2
proxmox-auth-api/src/api/mod.rs
View File

@ -20,7 +20,7 @@ use access::verify_csrf_prevention_token;
pub use access::{
assemble_csrf_prevention_token, create_ticket, API_METHOD_CREATE_TICKET,
API_METHOD_CREATE_TICKET_HTTP_ONLY,
API_METHOD_CREATE_TICKET_HTTP_ONLY, API_METHOD_LOGOUT,
};
pub use ticket::{ApiTicket, PartialTicket};