| 272 | } |
| 273 | |
| 274 | void THttpServer::headersDone() { |
| 275 | if (!header_x_request_id_.empty() || !header_x_session_id_.empty() || |
| 276 | !header_x_query_id_.empty()) { |
| 277 | VLOG_RPC << "HTTP Connection Tracing Headers" |
| 278 | << (header_x_request_id_.empty() ? "" : " x-request-id=" + header_x_request_id_) |
| 279 | << (header_x_session_id_.empty() ? "" : " x-session-id=" + header_x_session_id_) |
| 280 | << (header_x_query_id_.empty() ? "" : " x-query-id=" + header_x_query_id_); |
| 281 | } |
| 282 | |
| 283 | // Trim and truncate the value of the 'X-Forwarded-For' header. |
| 284 | string origin; |
| 285 | std::swap(origin, origin_); |
| 286 | StripWhiteSpace(&origin); |
| 287 | if (origin.length() > MAX_X_FORWARDED_HEADER_LENGTH) { |
| 288 | origin = origin.substr(0, MAX_X_FORWARDED_HEADER_LENGTH); |
| 289 | } |
| 290 | // Store the truncated value of the 'X-Forwarded-For' header in the Connection Context. |
| 291 | callbacks_.set_http_origin_fn(origin); |
| 292 | |
| 293 | // Store the value of the 'X-Request-Id' header in the Connection Context. |
| 294 | string request_id; |
| 295 | std::swap(request_id, header_x_request_id_); |
| 296 | callbacks_.set_http_request_id_fn(request_id); |
| 297 | |
| 298 | if (!has_ldap_ && !has_kerberos_ && !has_saml_ && !has_jwt_ && !has_oauth_) { |
| 299 | // We don't need to authenticate. |
| 300 | resetAuthState(); |
| 301 | return; |
| 302 | } |
| 303 | |
| 304 | if (readWholeBodyForAuth_) { |
| 305 | DCHECK(has_saml_); |
| 306 | // 2nd SAML message in browser mode, get authNResponse from IP. |
| 307 | // Will be handled in bodyDone. Must return before processing |
| 308 | // cookies, as the cookies from the IdP server can confuse our |
| 309 | // logic. |
| 310 | return; |
| 311 | } |
| 312 | |
| 313 | bool authorized = false; |
| 314 | // Try authenticating with cookies first. |
| 315 | if (use_cookies_ && !cookie_value_.empty()) { |
| 316 | StripWhiteSpace(&cookie_value_); |
| 317 | // If a 'Cookie' header was provided with an empty value, we ignore it rather than |
| 318 | // counting it as a failed cookie attempt. |
| 319 | if (!cookie_value_.empty()) { |
| 320 | if (callbacks_.cookie_auth_fn(cookie_value_)) { |
| 321 | authorized = true; |
| 322 | if (metrics_enabled_) http_metrics_->total_cookie_auth_success_->Increment(1); |
| 323 | } else if (metrics_enabled_) { |
| 324 | http_metrics_->total_cookie_auth_failure_->Increment(1); |
| 325 | } |
| 326 | } |
| 327 | } |
| 328 | |
| 329 | if (!authorized && (has_jwt_ || has_oauth_) && !auth_value_.empty() |
| 330 | && auth_value_.find('.') != string::npos) { |
| 331 | // Check Authorization header with the Bearer authentication scheme as: |
nothing calls this directly
no test coverage detected