authentik.root.middleware

  1"""Dynamically set SameSite depending if the upstream connection is TLS or not"""
  2
  3from collections.abc import Callable
  4from hashlib import sha512
  5from ipaddress import ip_address
  6from time import perf_counter, time
  7from typing import Any
  8
  9from channels.exceptions import DenyConnection
 10from django.conf import settings
 11from django.contrib.sessions.backends.base import UpdateError
 12from django.contrib.sessions.exceptions import SessionInterrupted
 13from django.contrib.sessions.middleware import SessionMiddleware as UpstreamSessionMiddleware
 14from django.http.request import HttpRequest
 15from django.http.response import HttpResponse, HttpResponseServerError
 16from django.middleware.csrf import CSRF_SESSION_KEY
 17from django.middleware.csrf import CsrfViewMiddleware as UpstreamCsrfViewMiddleware
 18from django.utils.cache import patch_vary_headers
 19from django.utils.http import http_date
 20from jwt import PyJWTError, decode, encode
 21from sentry_sdk import Scope
 22from structlog.stdlib import get_logger
 23
 24from authentik.core.models import Token, TokenIntents, User, UserTypes
 25from authentik.lib.config import CONFIG
 26
 27LOGGER = get_logger("authentik.asgi")
 28ACR_AUTHENTIK_SESSION = "goauthentik.io/core/default"
 29SIGNING_HASH = sha512(settings.SECRET_KEY.encode()).hexdigest()
 30
 31
 32class SessionMiddleware(UpstreamSessionMiddleware):
 33    """Dynamically set SameSite depending if the upstream connection is TLS or not"""
 34
 35    @staticmethod
 36    def is_secure(request: HttpRequest) -> bool:
 37        """Check if request is TLS'd or localhost"""
 38        if request.is_secure():
 39            return True
 40        host, _, _ = request.get_host().partition(":")
 41        if host == "localhost" and settings.DEBUG:
 42            # Since go does not consider localhost with http a secure origin
 43            # we can't set the secure flag.
 44            user_agent = request.META.get("HTTP_USER_AGENT", "")
 45            if user_agent.startswith("goauthentik.io/outpost/") or (
 46                "safari" in user_agent.lower() and "chrome" not in user_agent.lower()
 47            ):
 48                return False
 49            return True
 50        return False
 51
 52    @staticmethod
 53    def decode_session_key(key: str | None) -> str | None:
 54        """Decode raw session cookie, and parse JWT"""
 55        # We need to support the standard django format of just a session key
 56        # for testing setups, where the session is directly set
 57        session_key = key if settings.TEST else None
 58        try:
 59            session_payload = decode(key, SIGNING_HASH, algorithms=["HS256"])
 60            session_key = session_payload["sid"]
 61        except KeyError, PyJWTError:
 62            pass
 63        return session_key
 64
 65    @staticmethod
 66    def encode_session(session_key: str, user: User):
 67        payload = {
 68            "sid": session_key,
 69            "iss": "authentik",
 70            "sub": "anonymous",
 71            "authenticated": user.is_authenticated,
 72            "acr": ACR_AUTHENTIK_SESSION,
 73        }
 74        if user.is_authenticated:
 75            payload["sub"] = user.uid
 76        value = encode(payload=payload, key=SIGNING_HASH)
 77        if settings.TEST:
 78            value = session_key
 79        return value
 80
 81    def process_request(self, request: HttpRequest):
 82        raw_session = request.COOKIES.get(settings.SESSION_COOKIE_NAME)
 83        session_key = SessionMiddleware.decode_session_key(raw_session)
 84        request.session = self.SessionStore(
 85            session_key,
 86            last_ip=ClientIPMiddleware.get_client_ip(request),
 87            last_user_agent=request.META.get("HTTP_USER_AGENT", ""),
 88        )
 89
 90    def process_response(self, request: HttpRequest, response: HttpResponse) -> HttpResponse:
 91        """
 92        If request.session was modified, or if the configuration is to save the
 93        session every time, save the changes and set a session cookie or delete
 94        the session cookie if the session has been emptied.
 95        """
 96        try:
 97            accessed = request.session.accessed
 98            modified = request.session.modified
 99            empty = request.session.is_empty()
100        except AttributeError:
101            return response
102        # Set SameSite based on whether or not the request is secure
103        secure = SessionMiddleware.is_secure(request)
104        same_site = "None" if secure else "Lax"
105        # First check if we need to delete this cookie.
106        # The session should be deleted only if the session is entirely empty.
107        if settings.SESSION_COOKIE_NAME in request.COOKIES and empty:
108            response.delete_cookie(
109                settings.SESSION_COOKIE_NAME,
110                path=settings.SESSION_COOKIE_PATH,
111                domain=settings.SESSION_COOKIE_DOMAIN,
112                samesite=same_site,
113            )
114            patch_vary_headers(response, ("Cookie",))
115        else:
116            if accessed:
117                patch_vary_headers(response, ("Cookie",))
118            if (modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty:
119                if request.session.get_expire_at_browser_close():
120                    max_age = None
121                    expires = None
122                else:
123                    max_age = request.session.get_expiry_age()
124                    expires_time = time() + max_age
125                    expires = http_date(expires_time)
126                # Save the session data and refresh the client cookie.
127                # Skip session save for 500 responses, refs #3881.
128                if response.status_code != HttpResponseServerError.status_code:
129                    try:
130                        request.session.save()
131                    except UpdateError:
132                        raise SessionInterrupted(
133                            "The request's session was deleted before the "
134                            "request completed. The user may have logged "
135                            "out in a concurrent request, for example."
136                        ) from None
137                    response.set_cookie(
138                        settings.SESSION_COOKIE_NAME,
139                        SessionMiddleware.encode_session(request.session.session_key, request.user),
140                        max_age=max_age,
141                        expires=expires,
142                        domain=settings.SESSION_COOKIE_DOMAIN,
143                        path=settings.SESSION_COOKIE_PATH,
144                        secure=secure,
145                        httponly=settings.SESSION_COOKIE_HTTPONLY or None,
146                        samesite=same_site,
147                    )
148        return response
149
150
151class CsrfViewMiddleware(UpstreamCsrfViewMiddleware):
152    """Dynamically set secure depending if the upstream connection is TLS or not"""
153
154    def _set_csrf_cookie(self, request: HttpRequest, response: HttpResponse):
155        if settings.CSRF_USE_SESSIONS:
156            if request.session.get(CSRF_SESSION_KEY) != request.META["CSRF_COOKIE"]:
157                request.session[CSRF_SESSION_KEY] = request.META["CSRF_COOKIE"]
158        else:
159            secure = SessionMiddleware.is_secure(request)
160            response.set_cookie(
161                settings.CSRF_COOKIE_NAME,
162                request.META["CSRF_COOKIE"],
163                max_age=settings.CSRF_COOKIE_AGE,
164                domain=settings.CSRF_COOKIE_DOMAIN,
165                path=settings.CSRF_COOKIE_PATH,
166                secure=secure,
167                httponly=settings.CSRF_COOKIE_HTTPONLY,
168                samesite=settings.CSRF_COOKIE_SAMESITE,
169            )
170            # Set the Vary header since content varies with the CSRF cookie.
171            patch_vary_headers(response, ("Cookie",))
172
173
174class ClientIPMiddleware:
175    """Set a "known-good" client IP on the request, by default based off of x-forwarded-for
176    which is set by the go proxy, but also allowing the remote IP to be overridden by an outpost
177    for protocols like LDAP"""
178
179    get_response: Callable[[HttpRequest], HttpResponse]
180    outpost_remote_ip_header = "HTTP_X_AUTHENTIK_REMOTE_IP"
181    outpost_token_header = "HTTP_X_AUTHENTIK_OUTPOST_TOKEN"  # nosec
182    default_ip = "255.255.255.255"
183
184    request_attr_client_ip = "client_ip"
185    request_attr_outpost_user = "outpost_user"
186
187    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
188        self.get_response = get_response
189        self.logger = get_logger().bind()
190
191    def _get_client_ip_from_meta(self, meta: dict[str, Any]) -> str:
192        """Attempt to get the client's IP by checking common HTTP Headers.
193        Returns none if no IP Could be found
194
195        No additional validation is done here as requests are expected to only arrive here
196        via the go proxy, which deals with validating these headers for us"""
197        headers = (
198            "HTTP_X_FORWARDED_FOR",
199            "REMOTE_ADDR",
200        )
201        try:
202            for _header in headers:
203                if _header in meta:
204                    ips: list[str] = meta.get(_header).split(",")
205                    # Ensure the IP parses as a valid IP
206                    return str(ip_address(ips[0].strip()))
207            return self.default_ip
208        except ValueError as exc:
209            self.logger.debug("Invalid remote IP", exc=exc)
210            return self.default_ip
211
212    # FIXME: this should probably not be in `root` but rather in a middleware in `outposts`
213    # but for now it's fine
214    def _get_outpost_override_ip(self, request: HttpRequest) -> str | None:
215        """Get the actual remote IP when set by an outpost. Only
216        allowed when the request is authenticated, by an outpost internal service account"""
217        if (
218            self.outpost_remote_ip_header not in request.META
219            or self.outpost_token_header not in request.META
220        ):
221            return None
222        delegated_ip = request.META[self.outpost_remote_ip_header]
223        token = (
224            Token.objects.filter(
225                key=request.META.get(self.outpost_token_header), intent=TokenIntents.INTENT_API
226            )
227            .select_related("user")
228            .first()
229        )
230        if not token:
231            LOGGER.warning("Attempted remote-ip override without token", delegated_ip=delegated_ip)
232            return None
233        user: User = token.user
234        if user.type != UserTypes.INTERNAL_SERVICE_ACCOUNT:
235            LOGGER.warning(
236                "Remote-IP override: user doesn't have permission",
237                user=user,
238                delegated_ip=delegated_ip,
239            )
240            return None
241        # Update sentry scope to include correct IP
242        sentry_user = Scope.get_isolation_scope()._user or {}
243        sentry_user["ip_address"] = delegated_ip
244        Scope.get_isolation_scope().set_user(sentry_user)
245        # Set the outpost service account on the request
246        setattr(request, self.request_attr_outpost_user, user)
247        try:
248            return str(ip_address(delegated_ip))
249        except ValueError as exc:
250            self.logger.debug("Invalid remote IP from Outpost", exc=exc)
251            return None
252
253    def _get_client_ip(self, request: HttpRequest | None) -> str:
254        """Attempt to get the client's IP by checking common HTTP Headers.
255        Returns none if no IP Could be found"""
256        if not request:
257            return self.default_ip
258        override = self._get_outpost_override_ip(request)
259        if override:
260            return override
261        return self._get_client_ip_from_meta(request.META)
262
263    @staticmethod
264    def get_outpost_user(request: HttpRequest) -> User | None:
265        """Get outpost user that authenticated this request"""
266        return getattr(request, ClientIPMiddleware.request_attr_outpost_user, None)
267
268    @staticmethod
269    def get_client_ip(request: HttpRequest) -> str:
270        """Get correct client IP, including any overrides from outposts that
271        have the permission to do so"""
272        if request and not hasattr(request, ClientIPMiddleware.request_attr_client_ip):
273            ClientIPMiddleware(lambda request: request).set_ip(request)
274        return getattr(
275            request, ClientIPMiddleware.request_attr_client_ip, ClientIPMiddleware.default_ip
276        )
277
278    def set_ip(self, request: HttpRequest):
279        """Set the IP"""
280        setattr(request, self.request_attr_client_ip, self._get_client_ip(request))
281
282    def __call__(self, request: HttpRequest) -> HttpResponse:
283        self.set_ip(request)
284        return self.get_response(request)
285
286
287class ChannelsLoggingMiddleware:
288    """Logging middleware for channels"""
289
290    def __init__(self, inner):
291        self.inner = inner
292
293    async def __call__(self, scope, receive, send):
294        self.log(scope)
295        try:
296            return await self.inner(scope, receive, send)
297        except DenyConnection:
298            return await send({"type": "websocket.close"})
299        except Exception as exc:
300            if settings.DEBUG or settings.TEST:
301                raise exc
302            LOGGER.warning("Exception in ASGI application", exc=exc)
303            return await send({"type": "websocket.close"})
304
305    def log(self, scope: dict, **kwargs):
306        """Log request"""
307        headers = dict(scope.get("headers", {}))
308        LOGGER.info(
309            scope["path"],
310            scheme="ws",
311            remote=headers.get(b"x-forwarded-for", b"").decode(),
312            user_agent=headers.get(b"user-agent", b"").decode(),
313            **kwargs,
314        )
315
316
317class LoggingMiddleware:
318    """Logger middleware"""
319
320    get_response: Callable[[HttpRequest], HttpResponse]
321
322    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
323        self.get_response = get_response
324        headers = CONFIG.get("log.http_headers", [])
325        if isinstance(headers, str):
326            headers = headers.split(",")
327        self.headers_to_log = headers
328
329    def __call__(self, request: HttpRequest) -> HttpResponse:
330        start = perf_counter()
331        response = self.get_response(request)
332        status_code = response.status_code
333        kwargs = {
334            "request_id": getattr(request, "request_id", None),
335        }
336        kwargs.update(getattr(response, "ak_context", {}))
337        self.log(request, status_code, int((perf_counter() - start) * 1000), **kwargs)
338        return response
339
340    def log(self, request: HttpRequest, status_code: int, runtime: int, **kwargs):
341        """Log request"""
342        for header in self.headers_to_log:
343            header_value = request.headers.get(header)
344            if not header_value:
345                continue
346            kwargs[header.lower().replace("-", "_")] = header_value
347        LOGGER.info(
348            request.get_full_path(),
349            remote=ClientIPMiddleware.get_client_ip(request),
350            method=request.method,
351            scheme=request.scheme,
352            status=status_code,
353            runtime=runtime,
354            **kwargs,
355        )