search

opendata-stuttgart / sensors-software

sourcecode for reading sensor data
575 stars 313 forks source link

BasicAuth cannot login #168

Open azrdev opened 7 years ago

azrdev commented 7 years ago

I assembled a nodemcu v3-sensor, a friend who already did so multiple times flashed the firmware onto it, now I started to configure it. logged into the "Feinstaubsensor-ID" wifi, went to the config page, and first set BasicAuth for the admin page (since the sensor should run in freifunk). Clicked Save which triggered a reboot

Now, if I (re)start the sensor, its wifi AP comes up, and the (config) website asks for username + password, but I cannot log in with my configured credentials. Both have 24 chars in a-zA-Z0-9 (generated by my password manager), which should not hit a length limit looking at the code.

any other idea what might be wrong here (on my side or in the firmware)?

ricki-z commented 7 years ago

Could you please try the default values?

dokape commented 7 years ago

If the login is not possible, there is a way do delete the configuration.

https://github.com/opendata-stuttgart/meta/wiki/Konfiguration-der-Sensoren#l%C3%B6schen-der-konfiguration

You need the Arduino IDE.

azrdev commented 7 years ago

@ricki-z admin:feinstaub does not login, neither do admin:$mypw nor $myuser:feinstaub @dokape yes, I feared that :)

dokape commented 7 years ago

NRZ-2017-100-B9

Setting a short username/Password works.

Setting a 30 chars Username/Passwort: Same problem as @azrdev reported. (I used 123456789012345678901234567890 as PWD and Username....)

And now I can check how to delete the config.

ricki-z commented 7 years ago

Could someone look at the code (airrohr-firmware AND ESP8266WebServer) if there is any limit beside the 64 chars I've found?

dokape commented 6 years ago

I don't unterstand the code in that deep.

dokape commented 6 years ago

Next step for testing would be to enlage one by one the user/pwd length until it stops working. The try the one smaller user/pwd if it is a problem with storing the PWD...

dokape commented 6 years ago

NRZ-2017-100-B11

Testing today: enlarge Username from 8 to 25 works. (12345678 to 1234567890123456789012345) Then enlage PWD from 8 to 26 (12345678 to 12345678901234567890123456) also worked.

There there any changes done?

edith: User with 30 chars works (User 10 chars) PWD with also same 30 chars does not work. Reducing one by one does also not work. So it does not seam to cutof the last chars by PWD. So actually it seems to be a max length of PWD by about 25 to 30 chars.

perhaps we should limit the max entry length user/pwd by about 20 chars? Should be enough secure?

The interesting thing is that I could have entered more chars than @azrdev but got finally same problem. More testing has to be done.