diff options
author | Jakob Borg <jakob@kastelo.net> | 2023-11-14 11:57:39 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-11-14 11:57:39 +0100 |
commit | 439c6c5b7c64eb8f06d2cd4d8f66e27d0e277d2d (patch) | |
tree | 355e712079d49f8233ca0396cdda9a89a4f242d4 /test | |
parent | aaee0c126b8aef480489f157eab34bdacaf92499 (diff) | |
download | syncthing-439c6c5b7c64eb8f06d2cd4d8f66e27d0e277d2d.tar.gz syncthing-439c6c5b7c64eb8f06d2cd4d8f66e27d0e277d2d.zip |
lib/api: Add cache busting for basic auth (ref #9208) (#9215)v1.27.0-rc.1
This adds our short device ID to the basic auth realm. This has at least
two consequences:
- It is different from what's presented by another device on the same
address (e.g., if I use SSH forwards to different dives on the same
local address), preventing credentials for one from being sent to
another.
- It is different from what we did previously, meaning we avoid cached
credentials from old versions interfering with the new login flow.
I don't *think* there should be things that depend on our precise realm
string, so this shouldn't break any existing setups...
Sneakily this also changes the session cookie and CSRF name, because I
think `id.Short().String()` is nicer than `id.String()[:5]` and the
short ID is two characters longer. That's also not a problem...
Diffstat (limited to 'test')
-rw-r--r-- | test/http_test.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/test/http_test.go b/test/http_test.go index 4541c75b4..3dd9cf751 100644 --- a/test/http_test.go +++ b/test/http_test.go @@ -173,7 +173,7 @@ func TestHTTPPOSTWithoutCSRF(t *testing.T) { } res.Body.Close() hdr := res.Header.Get("Set-Cookie") - id := res.Header.Get("X-Syncthing-ID")[:5] + id := res.Header.Get("X-Syncthing-ID")[:protocol.ShortIDStringLength] if !strings.Contains(hdr, "CSRF-Token") { t.Error("Missing CSRF-Token in", hdr) } |