ylhan/whoami
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth: 从 Caddy basic_auth 迁移为应用内表单登录(cookie会话)兼容微信内置浏览器

Browse Source
This commit is contained in:
ylhan
2026-09-21 21:54:52 +08:00
parent 7e7e7d10e5
commit 3733045341
3 changed files with 172 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Caddyfile
-3
View File
@@ -17,9 +17,6 @@ hyonglin.top {
path /xinquandashboard/*
}
handle @dq {
basic_auth {
xqzk $2a$14$GrTqs4WiYHepvOq/0CnOU.Zq2.cA4B2FcilgGIv/6Jbi9BZX/8rNK
}
uri strip_prefix /xinquandashboard
reverse_proxy xinquan:8000
}
docker-compose.yml
+4
View File
@@ -13,6 +13,10 @@ services:
build: ./xinquan
container_name: xinquan
restart: unless-stopped
environment:
- XQ_USER=xqzk
- XQ_PASS=66668888
- XQ_SECRET=bb8335b291300ea338373feea74af915e3346aedd52d7ac2fb66721a16b394e8
volumes:
- ./xinquan_data:/data
expose:
xinquan/app.py
+168 -13
View File
@@ -16,6 +16,8 @@
鉴权：由 Caddy basic_auth 在网关卡负责，本应用不鉴权。
"""
import base64
import hashlib
import hmac
import json
import os
import re
@@ -35,6 +37,33 @@ ALLOWED_IMG_EXT = {".png": "image/png", ".jpg": "image/jpeg",
".jpeg": "image/jpeg", ".gif": "image/gif",
".webp": "image/webp", ".svg": "image/svg+xml"}
# ---- 应用内表单登录（替代 Caddy basic_auth，兼容微信内置浏览器）----
AUTH_USER = os.environ.get("XQ_USER", "xqzk")
AUTH_PASS = os.environ.get("XQ_PASS", "66668888")
AUTH_SECRET = os.environ.get("XQ_SECRET", "xinquan-session-secret-change-me")
SESSION_DAYS = 7
RE_AUTH = re.compile(r"__AUTH__")
def _sign_token(user, exp):
payload = f"{user}|{exp}".encode()
sig = hmac.new(AUTH_SECRET.encode(), payload, hashlib.sha256).hexdigest()
return base64.urlsafe_b64encode(payload + b"|" + sig.encode()).decode()
def _verify_token(token):
try:
raw = base64.urlsafe_b64decode(token.encode()).decode()
user, exp, sig = raw.split("|")
if int(exp) < int(time.time()):
return None
expect = hmac.new(AUTH_SECRET.encode(), f"{user}|{exp}".encode(),
hashlib.sha256).hexdigest()
return user if hmac.compare_digest(expect, sig) else None
except Exception:
return None
def _ensure_dirs():
os.makedirs(DATA_DIR, exist_ok=True)
@@ -110,6 +139,17 @@ INDEX_HTML = r"""<!DOCTYPE html>
display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical;overflow:hidden}
.tile time{display:block;margin-top:10px;font-size:12px;color:var(--muted)}
.empty{text-align:center;color:var(--muted);padding:60px 0;line-height:2}
.login{max-width:380px;margin:10vh auto 0;background:var(--card);border:1px solid var(--border);
border-radius:20px;padding:32px 30px;box-shadow:0 10px 30px rgba(20,30,70,.08)}
.login .lg{width:52px;height:52px;border-radius:14px;background:var(--grad);display:grid;place-items:center;
color:#fff;font-weight:800;font-size:24px;margin:0 auto 16px}
.login h2{text-align:center;font-size:20px;margin-bottom:22px}
.login input{width:100%;padding:11px 12px;margin-bottom:12px;border-radius:10px;
border:1px solid var(--border);background:var(--bg);color:var(--text);font-size:15px;outline:none}
.login input:focus{border-color:var(--brand)}
.login button{width:100%;padding:11px;border:none;border-radius:10px;background:var(--grad);
color:#fff;font-size:15px;font-weight:600;cursor:pointer}
.login .err{color:#ef4444;font-size:13px;text-align:center;height:18px;margin-bottom:8px}
.page{padding-top:8px}
.page .title{font-size:26px;font-weight:800;letter-spacing:-.02em;margin-bottom:4px}
.page .meta{color:var(--muted);font-size:13px;margin-bottom:18px}
@@ -148,6 +188,7 @@ INDEX_HTML = r"""<!DOCTYPE html>
const BASE = (()=>{const p=location.pathname;const i=p.indexOf('/xinquandashboard');
return i>=0?p.slice(0,i+'/xinquandashboard'.length):'';})();
const $ = s => document.querySelector(s);
const AUTH = __AUTH__;
function api(path, opts){
return fetch(BASE+path, opts).then(async r=>{
@@ -171,7 +212,8 @@ async function loadPages(){
renderList();
}
function renderList(){
$('#topActions').innerHTML = `<button class="primary" onclick="newPage()">＋ 新建页面</button>`;
$('#topActions').innerHTML = `<button class="primary" onclick="newPage()">＋ 新建页面</button>
<button onclick="logout()">👤 退出</button>`;
const a=$('#app');
if(!state.pages.length){ a.innerHTML=`<div class="empty">还没有内容。<br><button class="primary" onclick="newPage()">创建第一个页面</button></div>`; return; }
a.innerHTML = `<div class="grid">${state.pages.map(p=>`
@@ -253,8 +295,45 @@ async function delPage(id){
}
function cancelEdit(){ loadPages(); }
async function login(u,p){
try{
const r = await fetch(BASE+'/login',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({username:u,password:p})});
if(!r.ok){ const j=await r.json().catch(()=>({})); return j.error||'登录失败'; }
return null;
}catch(e){ return '网络错误'; }
}
function renderLogin(){
$('#topActions').innerHTML='';
$('#app').innerHTML=`<div class="login">
<div class="lg">XQ</div>
<h2>Xinquan Dashboard</h2>
<div class="err" id="err"></div>
<input id="u" type="text" placeholder="用户名" autocomplete="username">
<input id="p" type="password" placeholder="密码" autocomplete="current-password">
<button id="go">登 录</button></div>`;
const doIt=async ()=>{
const err=$('#err'); err.textContent='';
const msg=await login($('#u').value.trim(), $('#p').value);
if(msg){ err.textContent=msg; return; }
$('#topActions').innerHTML='<button onclick="logout()">👤 退出登录</button>';
loadPages();
};
$('#go').onclick=doIt;
$('#p').onkeydown=e=>{ if(e.key==='Enter') doIt(); };
$('#u').focus();
}
async function logout(){
await fetch(BASE+'/logout',{method:'POST'});
location.reload();
}
if(!AUTH){ renderLogin(); }
else { onAuth(); }
function onAuth(){
$('#topActions').innerHTML='<button onclick="logout()">👤 退出登录</button>';
loadPages();
}
if(umarked){ document.addEventListener('DOMContentLoaded',()=>toast('Markdown 渲染库加载失败，回退为纯文本')); }
loadPages();
</script>
</body>
</html>
@@ -306,33 +385,107 @@ class Handler(BaseHTTPRequestHandler):
path = "/" + path
return path
# ---- 会话 ----
def _user(self):
cookies = self.headers.get("Cookie") or ""
tok = None
for pair in cookies.split(";"):
if not pair:
continue
kv = pair.strip().split("=", 1)
if len(kv) == 2 and kv[0] == "xq_auth":
tok = kv[1]
return _verify_token(tok) if tok else None
def _secure_cookie(self):
return (self.headers.get("X-Forwarded-Proto", "") == "https")
def _unauthed(self):
"""返回 True 表示未登录（调用方应返回 401）。"""
return True
def _login_ok(self, user):
# 生成 7 天会话
exp = int(time.time()) + SESSION_DAYS * 86400
tok = _sign_token(user, exp)
cookie = f"xq_auth={tok}; Path=/; HttpOnly; SameSite=Lax; Max-Age={SESSION_DAYS*86400}"
if self._secure_cookie():
cookie += "; Secure"
self._send(200, b'{"ok":true}', extra={"Set-Cookie": cookie})
def _login_fail(self):
self._json({"error": "用户名或密码错误"}, 401)
def _auth_denied(self):
if self.path.startswith("/media"):
return self._send(401, b"unauthorized", "text/plain; charset=utf-8")
return self._json({"error": "unauthorized"}, 401)
# ---- 路由 ----
def _split(self):
path = self.path.split("?", 1)[0]
for pre in _PREFIXES:
if path.startswith(pre):
path = path[len(pre):] or "/"
break
if not path.startswith("/"):
path = "/" + path
return path
def do_GET(self):
path = self._split()
if path == "/media/health":
if path == "/health":
return self._json({"ok": True})
user = self._user()
if path.startswith("/api/"):
if not user:
return self._auth_denied()
if path.startswith("/api/pages/"):
pid = path[len("/api/pages/"):]
return self._get_page(pid) if pid else self._json({"error": "missing id"}, 400)
if path == "/api/pages":
return self._list_pages()
return self._json({"error": "not found"}, 404)
if path.startswith("/media/"):
if not user:
return self._auth_denied()
return self._media(path[len("/media/"):])
if path.startswith("/api/pages/"):
pid = path[len("/api/pages/"):]
if pid:
return self._get_page(pid)
return self._json({"error": "missing id"}, 400)
if path == "/api/pages":
return self._list_pages()
return self._send(200, self._index_html(), "text/html; charset=utf-8")
# 其余(/, /login, SPA 内部路由)：总是渲染外壳；未登录则显示登录表单
return self._send(200, self._index_html(bool(user)),
"text/html; charset=utf-8")
def _index_html(self):
return INDEX_HTML.replace("__MARKED__", BOOTSTRAP).encode("utf-8")
def _index_html(self, authed=True):
flag = "true" if authed else "false"
html = INDEX_HTML.replace("__MARKED__", BOOTSTRAP)
# 注入登录态，避免未授权时闪出内容
result = RE_AUTH.sub(flag, html, count=1)
return result.encode("utf-8")
def do_POST(self):
path = self._split()
if path == "/login":
data = self._read_json()
if data and data.get("username") == AUTH_USER and \
data.get("password") == AUTH_PASS:
return self._login_ok(AUTH_USER)
return self._login_fail()
if path == "/logout":
return self._logout()
if not self._user():
return self._auth_denied()
if path == "/api/pages":
return self._create_page()
if path == "/api/upload":
return self._upload()
self._json({"error": "not found"}, 404)
def _logout(self):
cookie = "xq_auth=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0"
self._send(200, b'{"ok":true}', extra={"Set-Cookie": cookie})
def do_PUT(self):
if not self._user():
return self._auth_denied()
path = self._split()
if path.startswith("/api/pages/"):
pid = path[len("/api/pages/"):]
@@ -341,6 +494,8 @@ class Handler(BaseHTTPRequestHandler):
self._json({"error": "not found"}, 404)
def do_DELETE(self):
if not self._user():
return self._auth_denied()
path = self._split()
if path.startswith("/api/pages/"):
pid = path[len("/api/pages/"):]