MM-42714: Trim token sizes to 50 characters (#20412)
https://mattermost.atlassian.net/browse/MM-42714 ```release-note NONE ```
Этот коммит содержится в:
коммит произвёл
GitHub
родитель
c6f80dfe0a
Коммит
dce96046dd
@@ -282,7 +282,15 @@ func (a *App) authenticateUser(c *request.Context, user *model.User, password, m
|
||||
return user, nil
|
||||
}
|
||||
|
||||
func ParseAuthTokenFromRequest(r *http.Request) (string, TokenLocation) {
|
||||
func ParseAuthTokenFromRequest(r *http.Request) (token string, loc TokenLocation) {
|
||||
defer func() {
|
||||
// Stripping off tokens of large sizes
|
||||
// to prevent logging a large string.
|
||||
if len(token) > 50 {
|
||||
token = token[:50]
|
||||
}
|
||||
}()
|
||||
|
||||
authHeader := r.Header.Get(model.HeaderAuth)
|
||||
|
||||
// Attempt to parse the token from the cookie
|
||||
|
||||
@@ -26,6 +26,7 @@ func TestParseAuthTokenFromRequest(t *testing.T) {
|
||||
{"token mytoken", "", "", "mytoken", TokenLocationHeader},
|
||||
{"BEARER mytoken", "", "", "mytoken", TokenLocationHeader},
|
||||
{"", "mytoken", "", "mytoken", TokenLocationCookie},
|
||||
{"", "a very large token to test out tokentokentokentokentokentokentokentokentokentokentokentokentoken", "", "a very large token to test out tokentokentokentoke", TokenLocationCookie},
|
||||
{"", "", "mytoken", "mytoken", TokenLocationQueryString},
|
||||
{"mytoken", "", "", "mytoken", TokenLocationCloudHeader},
|
||||
}
|
||||
|
||||
Ссылка в новой задаче
Block a user