Method isAuthorized

Source/Http/HttpServer.cpp:498–565

}

bool HttpServer::isAuthorized(const httplib::Request& req) {
	if (!_authRequired) {
		return true;
	}
	if (_authToken.empty()) {
		return false;
	}
	if (_authTokenHasExpiry && std::chrono::steady_clock::now() > _authTokenExpiry) {
		_authToken.clear();
		_authSessionId.clear();
		_authSessionSecret.clear();
		_authTokenHasExpiry = false;
		return false;
	}
	if (!_authSessionId.empty()) {
		auto sessionIt = req.headers.find("X-Dora-Session"s);
		auto timestampIt = req.headers.find("X-Dora-Timestamp"s);
		auto nonceIt = req.headers.find("X-Dora-Nonce"s);
		auto signatureIt = req.headers.find("X-Dora-Signature"s);
		if (sessionIt == req.headers.end() || timestampIt == req.headers.end() || nonceIt == req.headers.end() || signatureIt == req.headers.end()) {
			return false;
		}
		const auto& sessionId = sessionIt->second;
		if (sessionId != _authSessionId) {
			return false;
		}
		long long timestamp = 0;
		try {
			timestamp = std::stoll(timestampIt->second);
		} catch (...) {
			return false;
		}
		auto now = std::chrono::system_clock::now();
		auto nowSeconds = std::chrono::duration_cast<std::chrono::seconds>(now.time_since_epoch()).count();
		if (std::llabs(nowSeconds - timestamp) > AuthSignatureTTLSeconds) {
			return false;
		}
		const auto& nonce = nonceIt->second;
		auto path = canonicalize_path(req.path, req.params);
		auto bodyHash = sha256_hex(req.body);
		auto payload = fmt::format("{}\n{}\n{}\n{}\n{}\n{}", sessionId, req.method, path, timestampIt->second, nonce, bodyHash);
		auto expected = hmac_sha256_hex(_authSessionSecret, payload);
		if (expected != signatureIt->second) {
			return false;
		}
		{
			std::lock_guard<std::mutex> lock(_authNonceMutex);
			auto cutoff = std::chrono::steady_clock::now() - std::chrono::seconds(AuthSignatureTTLSeconds);
			for (auto it = _authNonces.begin(); it != _authNonces.end();) {
				if (it->second < cutoff) {
					it = _authNonces.erase(it);
				} else {
					++it;
				}
			}
			if (_authNonces.find(nonce) != _authNonces.end()) {
				return false;
			}