[WIP] Allow users to escape 'Not authorized' when their email address is not found on the allow-list #392
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
LennardSchwarz
changed the title
LennardSchwarz
force-pushed
the
allow-401-escape-option
branch
from
f7f2c67 to
f6e61ba
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes the small bug in #286 and adds a test.
The original PR tries to set a default value for the config option, which makes the config parser fail. Removing it still results in
falsedefault behaviour.I do not know what the behaviour would be with a provider other than google. This probably should not be merged as-is.
Testing
You can find the binaries of this change here and ghrc.io docker images here.
Original PR (#286)
Hi, love the project and thanks for maintaining @thomseddon
Okay so, I've run into an issue where a user will authenticate with an erroneous email address and then be stuck on 'Not authorized', I don't think it's anything new, and the issue seems well documented with #147 and #103
The current workflow for remedying the issue currently seems to be to clear your auth cookie manually which is a little bit awkward for end-users.
My goal with this pull request was to create a more user-friendly workflow for allowing the user to retry with a new email address, without degrading any security features of the project.
My intention was as follows:
Find the point where a user's email address is checked against the allow list
Clear the auth cookie with as much pre-existing code as possible (using the existing ClearCookie function)
Give the user feedback, prompting them to try again
Set up a config flag that allows for this feature to be turned on or off
Default this feature to off as to not affect existing workflows
This is my first time touching Go, so definitely check over my changes.
Thanks again,
Luis