arch/udpt
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

check remote_addr is loopback

Browse source
This commit is contained in:
Naim A 2020-05-06 03:37:18 +03:00
parent d6577e555e
commit 7a7faf405e
1 changed files with 15 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
src/webserver.rs
View file

@ -59,18 +59,23 @@ fn authenticate(tokens: HashMap<String, String>) -> impl Filter<Extract = (), Er
warp::filters::any::any()
.map(move || tokens.clone())
.and(filters::query::query::<AuthToken>())
.and_then(|tokens: Arc<HashSet<String>>, token: AuthToken| {
async move {
if let Some(token) = token.token {
if tokens.contains(&token) {
return Ok(());
.and(filters::addr::remote())
.and_then(
|tokens: Arc<HashSet<String>>, token: AuthToken, peer_addr: Option<std::net::SocketAddr>| {
async move {
if let Some(addr) = peer_addr {
if let Some(token) = token.token {
if addr.ip().is_loopback() && tokens.contains(&token) {
return Ok(());
}
}
}
Err(warp::reject::custom(ActionStatus::Err {
reason: "Access Denied".into(),
}))
}
Err(warp::reject::custom(ActionStatus::Err {
reason: "Access Denied".into(),
}))
}
})
},
)
.untuple_one()
}