ltratt / pizauth

Command-line OAuth2 authentication daemon
https://tratt.net/laurie/src/pizauth/
Other
164 stars 5 forks source link

[ADD] Support for https redirect URIs (TLS) #41

Closed trembel closed 2 months ago

trembel commented 2 months ago

This commit adds support for TLS-encrypted redirect URIs. The commit adds a second server for https:

  1. Binding a new TCP socket
  2. Uses rcgen to generate a new TLS certificate (only in memory)
  3. Uses rustls to do the TLS handshake and convert the TCPStream into a TLS stream
  4. Generalizes the request function (and its dependent) to accept an object implementing Read + Write instead of just TCPStream
  5. Redirects all redirect_uri that contain https to the https server

This last point I think can be discussed: Should all redirect uri's containing https be redirected to the https server or only the redirect uri's containing localhost? IMO it should not make a difference, as all https URIs will support TLS.

Also: the self-signed certificate is not trusted per default (at least on Firefox), so one has to go "Advanced" -> "Accept Risk ..." in Firefox when being redirected. For me this is no issue, if it is one, we could save the TLS certificate to the apropriate location(s) (requiring sudo).

I have not tested this commit across a http URI, just because I have no OAuth provider except of Microsoft (for hotmail). This commit solves #40.

ltratt commented 2 months ago

Thanks for this -- this looks really good!

trembel commented 2 months ago

Thanks for review, I will take care later today.

ltratt commented 2 months ago

This is excellent, thanks! I need to think a bit about if/where we store certificates, and so on, but that's a luxury add on: this PR does the hard bit.

ltratt commented 2 months ago

If you force push a rustfmt, I'll merge this.

trembel commented 2 months ago

Sure, thanks a lot for the quick process! rustfmt is pushed.

ltratt commented 2 months ago

Thanks!