mirror of
https://github.com/caddyserver/caddy.git
synced 2026-09-15 07:11:10 -04:00
SillyZir
e096ca9503
* caddyauth: isolate provider responses to prevent cross-provider clobbering When multiple authentication providers are configured, each was handed the real ResponseWriter, so a failing provider that wrote to the response (a 401 challenge or a login redirect) could clobber the response of another provider or of the successful handler chain. Because provider map iteration order is randomized, which provider's side effects won was nondeterministic. A single provider now receives the real ResponseWriter unchanged — no buffering, and Flusher/Hijacker/Pusher/ReaderFrom preserved exactly as before. Only with multiple providers does each get its own buffered writer; those writers embed caddyhttp.ResponseWriterWrapper so the underlying capabilities remain type-assertable via http.ResponseController (Flush is suppressed while buffering so a provider cannot prematurely commit the response), and the buffered body is size-capped to avoid unbounded memory. On success the winning provider's headers (e.g. a Set-Cookie) are copied to the real writer and the chain proceeds. On total failure one provider's challenge headers are applied (a redirect is sent as a full response), otherwise the auth error is returned so handle_errors runs and a header-only challenge (like basic auth) still returns 401. Fixes #5190 * caddyauth: return total consumed bytes and drain error from ReadFrom ReadFrom drained a source that exceeded the buffer cap but reported only the bytes retained in the buffer and dropped any error from the drain, violating the io.ReaderFrom contract: a caller such as io.Copy would see fewer bytes than were actually consumed from the source, and a read failure during the drain was silently swallowed. Return the retained-plus-drained total and propagate the drain error. * caddyauth: preserve Flusher and Hijacker on the buffered writer The buffered writer used for multi-provider isolation embeds caddyhttp.ResponseWriterWrapper, which promotes only Header, Write and WriteHeader from the wrapped ResponseWriter and adds Push, ReadFrom and Unwrap. Flush and Hijack were therefore reachable only through http.ResponseController; a provider doing a plain w.(http.Flusher) or w.(http.Hijacker) assertion silently lost them once a second provider was configured. Declare both on bufferedResponseWriter. Flush is a no-op so a provider cannot prematurely commit a buffered response, and FlushError keeps the same suppression for ResponseController, which prefers it over Flush. Hijack delegates through the embedded wrapper, mirroring responseRecorder.Hijack in the caddyhttp package. The existing capability test only probed via http.ResponseController, which is why this went unnoticed. It now asserts each capability both by direct type assertion and through the controller, and uses two non-authenticating providers so the probe is guaranteed to run — map iteration order previously allowed a succeeding provider to break out of the loop before the probe executed. Also replace two header copy loops with maps.Copy, fixing the mapsloop lint failures.