# README
GFA - go-forward-auth
Lightweight GO server acting as a "forward-auth" middleware (in Traefik for instance).
Inspired by sohamkamani's tuto many thanks to him.
Use at your own risk, not yet secured. Feel free to PR/Issue if you detect security issues :)
Endpoints
- / for html rendering and forward-auth url
- return 401 and a "Login page" if no valid JWT and invalid credentials supplied
- return 300 if no valid JWT and valid credentials supplied (means you logged-in succesfully)
- return 300 and extend JWT if valid JWT near expiration date
- return 200 and a "Welcome page" if valid JWT
- /logout to logout
- return 302 (means you logged-out succesfully)
- /verify to valid claims
- return 200 if valid JWT
- return 403 otherwise
To log-in, credentials are supplied via Header "Auth-Form" (POST is not forwarded to middlewares by Traefik) GFA check if the website is allowed for the user (cf. configuration file and Aud. in JWT)
WIP
jwt instead of cookie and sessionpassword saved as hash using bcryptssl with selfsigned certchoose config file from flagautomatic image push on docker hub (quentinb69/go-forward-auth)pass header value such as username when valid JWTautomatic testautomatic lint (gofmt, etc...)use CSRF ? (not sure if needed)help tool for bcrypt- real documentation
- reacto for cleaner code
Screenshot
The following screenshot shows the default login page.
Release
Available as a docker image : quentinb69/go-forward-auth
Devonline
License
The source code and binaries of GFA are subject to the MIT License.
# Functions
compare domain from url with domains list.
compare a hash with a hashed string.
Create claims from User return an error if critic parameters are nil.
Generate FormData.
generate private and public keys, return if file exists, panic if impossible to finish.
generate random bytes.
extract domain from url.
Extract FormData from request HEADER.
return bcrypted hash of string, 12 iterations panic in case of error.
get host from request.
get user ip from request.
return sanitized value.
find user from configuration.
Get claims from request return nil if claims is invalid.
Return valid user password and ip.
Validate FormData and user.
health handler.
initialize global configuration and logging.
set handler for and start listening.
load template and return http code and html.
remove cookie and redirect to home.
default handler.
check if claims is legit.
remove cookie and redirect to home.