Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a0b3d9a

Browse files
yp05327wxiaoguang
yp05327
and
wxiaoguang
authored
Support disable passkey auth (#33348)
Fix #33314 --------- Co-authored-by: wxiaoguang <[email protected]>
1 parent d64c849 commit a0b3d9a

File tree

7 files changed

+43
-5
lines changed

7 files changed

+43
-5
lines changed

‎custom/conf/app.example.ini‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -790,10 +790,13 @@ LEVEL = Info
790790
;; Please note that setting this to false will not disable OAuth Basic or Basic authentication using a token
791791
;ENABLE_BASIC_AUTHENTICATION = true
792792
;;
793-
;; Show the password sign-in form (for password-based login), otherwise, only show OAuth2 login methods.
793+
;; Show the password sign-in form (for password-based login), otherwise, only show OAuth2 or passkey login methods if they are enabled.
794794
;; If you set it to false, maybe it also needs to set ENABLE_BASIC_AUTHENTICATION to false to completely disable password-based authentication.
795795
;ENABLE_PASSWORD_SIGNIN_FORM = true
796796
;;
797+
;; Allow users to sign-in with a passkey
798+
;ENABLE_PASSKEY_AUTHENTICATION = true
799+
;;
797800
;; More detail: https://github.com/gogits/gogs/issues/165
798801
;ENABLE_REVERSE_PROXY_AUTHENTICATION = false
799802
; Enable this to allow reverse proxy authentication for API requests, the reverse proxy is responsible for ensuring that no CSRF is possible.

‎modules/setting/service.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ var Service = struct {
4646
RequireSignInView bool
4747
EnableNotifyMail bool
4848
EnableBasicAuth bool
49+
EnablePasskeyAuth bool
4950
EnableReverseProxyAuth bool
5051
EnableReverseProxyAuthAPI bool
5152
EnableReverseProxyAutoRegister bool
@@ -161,6 +162,7 @@ func loadServiceFrom(rootCfg ConfigProvider) {
161162
Service.RequireSignInView = sec.Key("REQUIRE_SIGNIN_VIEW").MustBool()
162163
Service.EnableBasicAuth = sec.Key("ENABLE_BASIC_AUTHENTICATION").MustBool(true)
163164
Service.EnablePasswordSignInForm = sec.Key("ENABLE_PASSWORD_SIGNIN_FORM").MustBool(true)
165+
Service.EnablePasskeyAuth = sec.Key("ENABLE_PASSKEY_AUTHENTICATION").MustBool(true)
164166
Service.EnableReverseProxyAuth = sec.Key("ENABLE_REVERSE_PROXY_AUTHENTICATION").MustBool()
165167
Service.EnableReverseProxyAuthAPI = sec.Key("ENABLE_REVERSE_PROXY_AUTHENTICATION_API").MustBool()
166168
Service.EnableReverseProxyAutoRegister = sec.Key("ENABLE_REVERSE_PROXY_AUTO_REGISTRATION").MustBool()

‎routers/web/auth/auth.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ func prepareSignInPageData(ctx *context.Context) {
169169
ctx.Data["PageIsLogin"] = true
170170
ctx.Data["EnableSSPI"] = auth.IsSSPIEnabled(ctx)
171171
ctx.Data["EnablePasswordSignInForm"] = setting.Service.EnablePasswordSignInForm
172+
ctx.Data["EnablePasskeyAuth"] = setting.Service.EnablePasskeyAuth
172173

173174
if setting.Service.EnableCaptcha && setting.Service.RequireCaptchaForLogin {
174175
context.SetCaptchaData(ctx)

‎routers/web/auth/linkaccount.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ func LinkAccount(ctx *context.Context) {
4646
ctx.Data["AllowOnlyInternalRegistration"] = setting.Service.AllowOnlyInternalRegistration
4747
ctx.Data["EnablePasswordSignInForm"] = setting.Service.EnablePasswordSignInForm
4848
ctx.Data["ShowRegistrationButton"] = false
49+
ctx.Data["EnablePasskeyAuth"] = setting.Service.EnablePasskeyAuth
4950

5051
// use this to set the right link into the signIn and signUp templates in the link_account template
5152
ctx.Data["SignInLink"] = setting.AppSubURL + "/user/link_account_signin"
@@ -145,6 +146,7 @@ func LinkAccountPostSignIn(ctx *context.Context) {
145146
ctx.Data["AllowOnlyInternalRegistration"] = setting.Service.AllowOnlyInternalRegistration
146147
ctx.Data["EnablePasswordSignInForm"] = setting.Service.EnablePasswordSignInForm
147148
ctx.Data["ShowRegistrationButton"] = false
149+
ctx.Data["EnablePasskeyAuth"] = setting.Service.EnablePasskeyAuth
148150

149151
// use this to set the right link into the signIn and signUp templates in the link_account template
150152
ctx.Data["SignInLink"] = setting.AppSubURL + "/user/link_account_signin"
@@ -235,6 +237,7 @@ func LinkAccountPostRegister(ctx *context.Context) {
235237
ctx.Data["AllowOnlyInternalRegistration"] = setting.Service.AllowOnlyInternalRegistration
236238
ctx.Data["EnablePasswordSignInForm"] = setting.Service.EnablePasswordSignInForm
237239
ctx.Data["ShowRegistrationButton"] = false
240+
ctx.Data["EnablePasskeyAuth"] = setting.Service.EnablePasskeyAuth
238241

239242
// use this to set the right link into the signIn and signUp templates in the link_account template
240243
ctx.Data["SignInLink"] = setting.AppSubURL + "/user/link_account_signin"

‎routers/web/auth/webauthn.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,11 @@ func WebAuthn(ctx *context.Context) {
5050

5151
// WebAuthnPasskeyAssertion submits a WebAuthn challenge for the passkey login to the browser
5252
func WebAuthnPasskeyAssertion(ctx *context.Context) {
53+
if !setting.Service.EnablePasskeyAuth {
54+
ctx.Error(http.StatusForbidden)
55+
return
56+
}
57+
5358
assertion, sessionData, err := wa.WebAuthn.BeginDiscoverableLogin()
5459
if err != nil {
5560
ctx.ServerError("webauthn.BeginDiscoverableLogin", err)
@@ -66,6 +71,11 @@ func WebAuthnPasskeyAssertion(ctx *context.Context) {
6671

6772
// WebAuthnPasskeyLogin handles the WebAuthn login process using a Passkey
6873
func WebAuthnPasskeyLogin(ctx *context.Context) {
74+
if !setting.Service.EnablePasskeyAuth {
75+
ctx.Error(http.StatusForbidden)
76+
return
77+
}
78+
6979
sessionData, okData := ctx.Session.Get("webauthnPasskeyAssertion").(*webauthn.SessionData)
7080
if !okData || sessionData == nil {
7181
ctx.ServerError("ctx.Session.Get", errors.New("not in WebAuthn session"))

‎templates/user/auth/signin_inner.tmpl‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,10 +60,11 @@
6060
</div>
6161

6262
<div class="ui container fluid">
63-
{{template "user/auth/webauthn_error" .}}
64-
6563
<div class="ui attached segment header top tw-max-w-2xl tw-m-auto tw-flex tw-flex-col tw-items-center">
66-
<a class="signin-passkey">{{ctx.Locale.Tr "auth.signin_passkey"}}</a>
64+
{{if .EnablePasskeyAuth}}
65+
{{template "user/auth/webauthn_error" .}}
66+
<a class="signin-passkey">{{ctx.Locale.Tr "auth.signin_passkey"}}</a>
67+
{{end}}
6768

6869
{{if .ShowRegistrationButton}}
6970
<div class="field">

‎tests/integration/signin_test.go‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ func TestSigninWithRememberMe(t *testing.T) {
9898
session.MakeRequest(t, req, http.StatusOK)
9999
}
100100

101-
func TestEnablePasswordSignInForm(t *testing.T) {
101+
func TestEnablePasswordSignInFormAndEnablePasskeyAuth(t *testing.T) {
102102
defer tests.PrepareTestEnv(t)()
103103

104104
mockLinkAccount := func(ctx *context.Context) {
@@ -141,4 +141,22 @@ func TestEnablePasswordSignInForm(t *testing.T) {
141141
resp = MakeRequest(t, req, http.StatusOK)
142142
NewHTMLParser(t, resp.Body).AssertElement(t, "form[action='/user/link_account_signin']", true)
143143
})
144+
145+
t.Run("EnablePasskeyAuth=false", func(t *testing.T) {
146+
defer tests.PrintCurrentTest(t)()
147+
defer test.MockVariableValue(&setting.Service.EnablePasskeyAuth, false)()
148+
149+
req := NewRequest(t, "GET", "/user/login")
150+
resp := MakeRequest(t, req, http.StatusOK)
151+
NewHTMLParser(t, resp.Body).AssertElement(t, ".signin-passkey", false)
152+
})
153+
154+
t.Run("EnablePasskeyAuth=true", func(t *testing.T) {
155+
defer tests.PrintCurrentTest(t)()
156+
defer test.MockVariableValue(&setting.Service.EnablePasskeyAuth, true)()
157+
158+
req := NewRequest(t, "GET", "/user/login")
159+
resp := MakeRequest(t, req, http.StatusOK)
160+
NewHTMLParser(t, resp.Body).AssertElement(t, ".signin-passkey", true)
161+
})
144162
}

0 commit comments

Comments
 (0)