lywsvip/server
1
0
Fork 0
mirror of https://github.com/gotify/server.git synced 2026-09-06 15:57:32 +08:00
Code Issues Packages Projects Releases Wiki Activity
924 Commits 21 Branches 71 Tags
bcrypt-errors
Commit Graph

52 Commits

Author SHA1 Message Date
Yumechi
75bc19c111 fix: remove panic() and relay password hashing errors to UI 2026-08-06 12:32:23 +08:00
Jannis Mattheis
d832b1a41d fix: prevent csrf for cookie requests 
Prevously, the token was passed as X-Gotify-Key by the UI, so there was
no csrf because no cookie was added by the browser to the request.

The cookie is saved by SameSite=strict, this provides some protection
against csrf. But an subdomain takeover could still allow for csrf. E.g.
evil.gotify.net could send authenticated requests to gotify.net.

This uses the go builtin cross origin protection, listed on the owasp
page: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#built-in-or-existing-csrf-implementations
 2026-07-17 14:09:48 +02:00
饺子w (Yumechi)
ad977d3d9c feat: EdDSA token for database leakage/index mitigation (#971) 
* feat: EdDSA token for database leakage/index mitigation

* [skip ci]: remove token from api output

* fix: e2e tests

* fixup! fix: e2e tests

* doc: document tokens are now optional fields for app and aclient

* fixup(doc): swagger version again

* address review comments

* address review comments
 2026-06-28 14:58:20 +00:00
Jannis Mattheis
c5fc8b7f8c fix: don't ignore cors requests in dev mode 
This will make testing easier, as it's more similar to the actual prod
deployment. We don't have to rewrite anything in vite, as the host and
origin is the same.
 2026-06-14 12:32:55 +02:00
Jannis Mattheis
be509766d8 feat: allow sending message with client/basic path 2026-05-25 18:32:05 +02:00
Jannis Mattheis
67d87f1b50 feat: clean up expired devices 2026-05-18 17:16:08 +02:00
Jannis Mattheis
e9ca916396 fixup! fix: enforce elevated authentication 2026-04-22 20:10:43 +02:00
Jannis Mattheis
3c5115812e fix: use auth functions instead of booleans 2026-04-22 20:10:43 +02:00
Jannis Mattheis
a8744482c6 fix: enforce elevated authentication 2026-04-19 19:24:18 +02:00
Jannis Mattheis
410571dd18 fix: prevent duplicate requests for apps / clients 2026-04-19 19:22:30 +02:00
Jannis Mattheis
681b9e2d90 fix: unify authentication context 
This uses a single struct for the authentication. This prevents further
re-requesting of the already requested data.
 2026-04-19 19:22:03 +02:00
Jannis Mattheis
57878e0574 fix: make secure cookie configurable 2026-04-11 18:53:48 +02:00
Jannis Mattheis
50d0572584 feat: implement /auth/local/{login,logout} 2026-04-11 18:53:48 +02:00
Jannis Mattheis
387da44883 fix: read token from cookie 2026-04-11 18:53:48 +02:00
Jannis Mattheis
39357c67d9 fix: simplify authentication handling 2026-04-11 18:53:48 +02:00
饺子w (Yumechi)
143438055d enhance: bump token keyspace to >128 bits (#939) 2026-03-29 07:10:13 +00:00
饺子w (Yumechi)
496c166981 chore: Migrate github.com/jinzhu/gorm to gorm.io/gorm (#863) 
* chore: Migrate github.com/jinzhu/gorm to gorm.io/gorm

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* chore: drop singleton connection limit on sqlite3 backend

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* enhance: database logging

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* Revert "chore: drop singleton connection limit on sqlite3 backend"

This reverts commit b494a3bd1f.

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* typo

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* rename unique_index -> uniqueIndex

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* drop uniqueIndex on primary key

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* migrate fully to new gorm tag format

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* specify unique index name

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* remove pluginConf duplicate index

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* disable auto migrate FK

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

---------

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>
 2025-10-29 22:23:10 +00:00
Eng Zer Jun
0bfa5ca4d9 perf: avoid allocations with (*regexp.Regexp).MatchString (#604) 
We should use `(*regexp.Regexp).MatchString` instead of
`(*regexp.Regexp).Match([]byte(...))` when matching string to avoid
unnecessary `[]byte` conversions and reduce allocations.

Example benchmark:

var allowedOrigin = regexp.MustCompile(".*.example.com")

func BenchmarkMatch(b *testing.B) {
	for i := 0; i < b.N; i++ {
		if match := allowedOrigin.Match([]byte("www.example.com")); !match {
			b.Fail()
		}
	}
}

func BenchmarkMatchString(b *testing.B) {
	for i := 0; i < b.N; i++ {
		if match := allowedOrigin.MatchString("wwww.example.com"); !match {
			b.Fail()
		}
	}
}

goos: linux
goarch: amd64
pkg: github.com/gotify/server/v2/api/stream
cpu: AMD Ryzen 7 PRO 4750U with Radeon Graphics
BenchmarkMatch-16          	 2076819	       647.7 ns/op	      16 B/op	       1 allocs/op
BenchmarkMatchString-16    	 2536326	       442.0 ns/op	       0 B/op	       0 allocs/op
PASS
ok  	github.com/gotify/server/v2/api/stream	3.552s

Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
 2023-10-23 15:57:15 +00:00
Jannis Mattheis
a2b2f856e0 test: don't run tests twice 2023-09-17 09:05:15 +02:00
eternal-flame-AD
7bf80ee6f1 Add last used to client & application 2023-08-06 12:30:22 +02:00
mateuscelio
0fb584d7f7 Update docs 2022-12-03 10:45:07 +01:00
mateuscelio
70e1fd1863 Add authorization bearer token auth method 2022-12-03 10:45:07 +01:00
Jannis Mattheis
59b2ed17a6 Update linter 2022-05-29 19:45:45 +02:00
pigpig
c172590b92 Add registration 
Can be enabled via the registration config flag. (disabled per default)

Fixes gotify/server#395

Co-authored-by: pigpig <pigpig@pig.pig>
Co-authored-by: Karmanyaah Malhotra <32671690+karmanyaahm@users.noreply.github.com>
Co-authored-by: Jannis Mattheis <contact@jmattheis.de>
 2021-08-04 19:39:43 +02:00
Jannis Mattheis
3454dcd602 Use golangci-lint 2020-11-01 10:47:02 +01:00
Stewart Thomson
93b30c5c44 Allows browser extensions in cors (#317) 2020-05-10 06:32:27 +00:00
Jannis Mattheis
7523ad0d2e Use response header if cors config is empty 
The cors middleware of gin denies the request with 403 forbidden if
the origin differs.
 2020-05-09 16:41:53 +02:00
Jannis Mattheis
7b90b8a8f5 Use v2 in package path 2020-05-08 10:43:17 +02:00
Stewart Thomson
3f04d50088 Allow multiple CORS origins 2020-04-26 11:27:24 +00:00
饺子w
67493c643e Return 500 server error on database failures (#191) 2019-05-25 08:37:24 +02:00
饺子w
efcf4ad13d Use crypto/rand for token generation (#161) 2019-03-16 11:10:28 +01:00
eternal-flame-AD
e5b24f4c92 Add plugin feature 
Fixed database migration
Added a plugin system based on the go plugin package
 2019-02-09 12:52:01 +01:00
Jannis Mattheis
61d5fc59a7 Add UploadApplicationImage API 2018-03-31 18:44:49 +02:00
Jannis Mattheis
0f2e7cf5e2 Use gofmt -s 2018-03-25 19:33:29 +02:00
Jannis Mattheis
6e488e612b Remove mock & Use database util in authentication handler 2018-03-25 19:33:29 +02:00
Jannis Mattheis
203791c63b Move password into own package to prevent package cycle 2018-03-25 19:33:29 +02:00
Jannis Mattheis
9e49849039 Use mode in all tests 2018-03-18 17:29:15 +01:00
Jannis Mattheis
433a83823b Use *ByToken methods in auth 2018-03-11 17:58:44 +01:00
Jannis Mattheis
cda4127551 Make password strength configurable 2018-02-23 19:39:34 +01:00
Jannis Mattheis
6a5357f9b3 Format & reorder imports 2018-02-18 12:56:42 +01:00
Jannis Mattheis
a5acb20d0e Use custom header for authentication 2018-02-18 12:56:42 +01:00
Jannis Mattheis
1e7e1a71f7 Rename to gotify 2018-02-12 16:48:01 +01:00
Jannis Mattheis
08dbacd71b Adjust authentication to also send 403 2018-02-11 14:33:59 +01:00
Jannis Mattheis
082b054f4c Improve build time 
The bcrypt hashing is really slow with enabled race condition checker,
therefore we exlcude it.
 2018-02-11 12:09:12 +01:00
Jannis Mattheis
4e3d00ea98 Reorder imports 2018-02-08 19:52:58 +01:00
Jannis Mattheis
8e8705c6e5 Add tokenkey to the gin context 2018-02-01 18:49:12 +01:00
Jannis Mattheis
8dfb5c7a69 Add token api (app and client) 2018-01-30 18:59:42 +01:00
Jannis Mattheis
fadf989158 Rename auth.Database methods 2018-01-28 15:56:28 +01:00
Jannis Mattheis
6770e6b654 Enable golint and fix golint-errors like adding documentation 2018-01-28 15:56:28 +01:00
Jannis Mattheis
aa66e9792b Add auth util for saving the user in the ctx 2018-01-27 20:31:56 +01:00