Skip to content

Commit f6c4434

Browse files
committed
Tweak proxy fallthrough behavior
It will now redirect all HTML requests. Also it avoids req.accepts since that's always truthy.
1 parent cb991a9 commit f6c4434

File tree

1 file changed

+20
-21
lines changed

1 file changed

+20
-21
lines changed

src/node/proxy.ts

Lines changed: 20 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import { Request, Router } from "express"
22
import proxyServer from "http-proxy"
33
import { HttpCode, HttpError } from "../common/http"
4-
import { authenticated, ensureAuthenticated } from "./http"
4+
import { authenticated, ensureAuthenticated, redirect } from "./http"
55
import { Router as WsRouter } from "./wsRouter"
66

77
export const proxy = proxyServer.createProxyServer({})
@@ -44,25 +44,6 @@ const maybeProxy = (req: Request): string | undefined => {
4444
return port
4545
}
4646

47-
/**
48-
* Determine if the user is browsing /, /login, or static assets and if so fall
49-
* through to allow the redirect and login flow.
50-
*/
51-
const shouldFallThrough = (req: Request): boolean => {
52-
// See if it looks like a request for the root or login HTML.
53-
if (req.accepts("text/html")) {
54-
if (
55-
(req.path === "/" && req.method === "GET") ||
56-
(/\/login\/?/.test(req.path) && (req.method === "GET" || req.method === "POST"))
57-
) {
58-
return true
59-
}
60-
}
61-
62-
// See if it looks like a request for a static asset.
63-
return req.path.startsWith("/static/") && req.method === "GET"
64-
}
65-
6647
router.all("*", (req, res, next) => {
6748
const port = maybeProxy(req)
6849
if (!port) {
@@ -71,9 +52,27 @@ router.all("*", (req, res, next) => {
7152

7253
// Must be authenticated to use the proxy.
7354
if (!authenticated(req)) {
74-
if (shouldFallThrough(req)) {
55+
// Let the assets through since they're used on the login page.
56+
if (req.path.startsWith("/static/") && req.method === "GET") {
7557
return next()
7658
}
59+
60+
// Assume anything that explicitly accepts text/html is a user browsing a
61+
// page (as opposed to an xhr request). Don't use `req.accepts()` since
62+
// *every* request that I've seen (in Firefox and Chromium at least)
63+
// includes `*/*` making it always truthy.
64+
if (typeof req.headers.accepts === "string" && req.headers.accepts.split(",").includes("text/html")) {
65+
// Let the login through.
66+
if (/\/login\/?/.test(req.path)) {
67+
return next()
68+
}
69+
// Redirect all other pages to the login.
70+
return redirect(req, res, "login", {
71+
to: req.path,
72+
})
73+
}
74+
75+
// Everything else gets an unauthorized message.
7776
throw new HttpError("Unauthorized", HttpCode.Unauthorized)
7877
}
7978

0 commit comments

Comments
 (0)