Restricting access using generic sessions

d30jeff commented 7 years ago

Hi,

I'm having trouble restricting access using generic sessions. I've attached my configuration file. Basically, I'd expect it to allow anyone to access anything within the /everyone directory. And for only admin to be able to access whatever's inside /needadmin. What I'm seeing instead is that anyone can access anything in both /everyone and /needadmin (without logging in). I can't seem to find the error in my configuration. Please help :)

{
    "vhosts": [{
        "name": "eth0",
        "port": "8080",
        "interface": "lo",
        "access-log": "/var/log/lwsws/test-access-log",
        "mounts": [{
            "mountpoint": "/everyone",
            "origin": "file:///home/deojeff/lwsgs-html",
            "origin": "callback://protocol-lws-messageboard",
            "default": "index.html",
            "auth-mask": "0",
            "interpret": {".js": "protocol-lws-messageboard"}
        },
        {
            "mountpoint": "/needadmin",
            "origin": "file:///home/deojeff/lwsgs-html-needadmin",
            "origin": "callback://protocol-lws-messageboard",
            "default": "index.html",
            "auth-mask": "7",
            "interpret": {".js": "protocol-lws-messageboard"}
        }],
        "ws-protocols": [{
            "protocol-generic-sessions": {
                "status": "ok",
                "admin-user": "admin",
                "admin-password-sha1": "a3d51aec1c28478e18bcc292086eb908efc18d61",
                "session-db": "/var/www/sessions/lws.sqlite3",
                "timeout-idle-secs": "600",
                "timeout-anon-idle-secs": "1200",
                "timeout-absolute-secs": "6000",
                "confounder": "ni12i3mi912moqwmi9eqwemqwie9wqeok12"
            },
            "protocol-lws-messageboard": {
                "status": "ok",
                "message-db": "/var/www/sessions/messageboard.sqlite3"
           }
        }]
    }]
}

Thanks!

lws-team commented 7 years ago

Yeah something is broken there... it used to work. I'll look at it in the next day or two.

d30jeff commented 7 years ago

Ok awesome thanks! :)

lws-team commented 7 years ago

The fix (hopefully) is pushed on master and v2.1-stable.

lws-team commented 7 years ago

Well, I assume it solved it... closing.

d30jeff commented 7 years ago

Oops, sorry. Just saw your reply. Yes it's solved.

Thanks a bunch :smile:

warmcat / libwebsockets

Restricting access using generic sessions #691