auth.go RawHistoryFolder

1package middleware
2
3import (
4	"crypto/subtle"
5	"net/http"
6
7	"github.com/rs/zerolog/log"
8)
9
10// RegistryAuth middleware provides Docker Registry authentication (optional)
11func RegistryAuth(username, password string) func(http.Handler) http.Handler {
12	return func(next http.Handler) http.Handler {
13		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
14			// Skip auth for registry info endpoint
15			if r.URL.Path == "/v2/" && r.Method == "GET" {
16				next.ServeHTTP(w, r)
17				return
18			}
19			
20			// Require auth for all other registry operations
21			if !isAuthenticated(r, username, password) {
22				w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`)
23				w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")
24				http.Error(w, "Unauthorized", http.StatusUnauthorized)
25				
26				log.Warn().
27					Str("method", r.Method).
28					Str("path", r.URL.Path).
29					Str("remote_addr", r.RemoteAddr).
30					Msg("Unauthorized registry access attempt")
31				return
32			}
33			
34			next.ServeHTTP(w, r)
35		})
36	}
37}
38
39// Helper functions
40
41func isAuthenticated(r *http.Request, expectedUsername, expectedPassword string) bool {
42	username, password, ok := r.BasicAuth()
43	if !ok {
44		return false
45	}
46	
47	// Use constant-time comparison to prevent timing attacks
48	usernameMatch := subtle.ConstantTimeCompare([]byte(username), []byte(expectedUsername)) == 1
49	passwordMatch := subtle.ConstantTimeCompare([]byte(password), []byte(expectedPassword)) == 1
50	
51	return usernameMatch && passwordMatch
52}