feat: add http post generic auth #276

sebastiansterk · 2025-07-24T22:05:00Z

Implements #104

Copilot

Pull Request Overview

This PR implements a new HTTP authentication backend that allows users to authenticate against a generic HTTP endpoint via POST requests. The implementation adds support for configurable password hashing and access key authentication.

Key changes:

Adds a new HTTP authentication class that sends POST requests to validate credentials
Includes comprehensive test coverage for the new authentication method
Updates documentation to describe the HTTP authentication configuration and usage

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
lib/HTTP.php	Implements the core HTTP authentication backend with POST request handling
tests/http.php	Adds unit tests for the HTTP authentication functionality
tests/config.php	Extends test configuration to include HTTP backend settings
appinfo/info.xml	Updates app summary to include HTTP Generic authentication method
README.md	Adds comprehensive documentation for HTTP authentication configuration

lib/HTTP.php

tests/config.php

[skip-ci] Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Sebastian Sterk <7263970+sebastiansterk@users.noreply.github.com>

Bumps [symfony/process](https://github.com/symfony/process) from 5.4.7 to 5.4.46. - [Release notes](https://github.com/symfony/process/releases) - [Changelog](https://github.com/symfony/process/blob/7.1/CHANGELOG.md) - [Commits](symfony/process@v5.4.7...v5.4.46) --- updated-dependencies: - dependency-name: symfony/process dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Sebastian Sterk <7263970+sebastiansterk@users.noreply.github.com>

Make the app compatible with Nextcloud 30 Signed-off-by: Ralf <ervee@moskovic.org> Signed-off-by: Sebastian Sterk <7263970+sebastiansterk@users.noreply.github.com>

Signed-off-by: Sebastian Sterk <7263970+sebastiansterk@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Sebastian Sterk <7263970+sebastiansterk@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 9 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-03T20:02:13Z

tests/http.php

+
+class Test_User_HTTP extends \Test\TestCase {
+	/**
+	 * @var OC_User_HTTP $instance


The PHPDoc type should be \OCA\UserExternal\HTTP instead of OC_User_HTTP. The OC_User_* naming appears to be used only in tests for backward compatibility, but the actual class uses the namespaced format.

Suggested change

* @var OC_User_HTTP $instance

* @var \OCA\UserExternal\HTTP $instance

Copilot · 2025-12-03T20:02:14Z

lib/HTTP.php

+			if ($statusCode === 202) {
+				return true;
+			} else {
+				return false;
+			}


[nitpick] This if-else block can be simplified to return $statusCode === 202; for better readability and conciseness.

Suggested change

if ($statusCode === 202) {

return true;

} else {

return false;

}

return $statusCode === 202;

Copilot · 2025-12-03T20:02:14Z

lib/HTTP.php

+			$response = $client->post($this->authenticationEndpoint, [
+				'form_params' => [
+					'accessKey' => $this->accessKey,
+					'user' => $user,
+					'password' => $password
+				],


[nitpick] The accessKey parameter is always included in the POST request even when it's empty (default value is ''). Consider only including it in the form_params when it's non-empty to avoid sending unnecessary data. This would make the integration cleaner for endpoints that don't require an access key.

Suggested change

$response = $client->post($this->authenticationEndpoint, [

'form_params' => [

'accessKey' => $this->accessKey,

'user' => $user,

'password' => $password

],

$formParams = [

'user' => $user,

'password' => $password

];

if ($this->accessKey !== '') {

$formParams['accessKey'] = $this->accessKey;

}

$response = $client->post($this->authenticationEndpoint, [

'form_params' => $formParams,

Copilot · 2025-12-03T20:02:15Z

lib/HTTP.php

+	private function hashPassword($password) {
+		return hash($this->hashAlgo, $password);


The hash() function should be validated to ensure $this->hashAlgo is a valid algorithm. Consider adding validation in the constructor (e.g., in_array($hashAlgo, hash_algos())) to fail early with a clear error message if an invalid algorithm is provided.

Copilot · 2025-12-03T20:02:15Z

lib/HTTP.php

+
+		try {
+			$client = $this->httpClientService->newClient();
+


Remove trailing whitespace on this line.

Suggested change

Copilot · 2025-12-03T20:02:15Z

lib/HTTP.php

+			]);
+
+			$statusCode = $response->getStatusCode();
+


Remove trailing whitespace on this line.

Suggested change

Copilot · 2025-12-03T20:02:15Z

lib/HTTP.php

+				return false;
+			}
+		} catch (\Exception $e) {
+			\OC::$server->getLogger()->error(


Use $this->logger instead of \OC::$server->getLogger(). The Base class provides a logger property that should be used for consistency with other authentication backends in this codebase (e.g., FTP, BasicAuth, IMAP).

Suggested change

\OC::$server->getLogger()->error(

$this->logger->error(

Copilot · 2025-12-03T20:02:16Z

lib/HTTP.php

+		return hash($this->hashAlgo, $password);
+	}


Passwords are hashed client-side using hash($this->hashAlgo, $password) with user-provided algorithms (e.g., md5, sha1). Weak algorithms like MD5/SHA1 are unsuitable for password protection and enable credential disclosure if intercepted or reused, and client-side hashing lacks proper salting/work factors. Fix by removing client-side password hashing and rely on TLS to protect credentials in transit, or strictly enforce a strong algorithm (e.g., sha256) with HMAC and server-side verification; do not allow md5/sha1 for passwords.

Copilot · 2025-12-03T20:02:16Z

README.md

+            'arguments' => array('https://example.com/auth_endpoint', 'md5'),
+        ),


Documentation recommends using weak hash algorithms for passwords (e.g., md5, sha1) in arguments for the HTTP backend. This encourages insecure configurations and could lead to credential compromise. Fix by removing weak algorithms from examples and explicitly recommending no client-side hashing (rely on HTTPS), or only strong algorithms (e.g., sha256) with proper server-side handling.

sebastiansterk requested a review from Copilot July 24, 2025 22:05

Copilot AI reviewed Jul 24, 2025

View reviewed changes

lib/HTTP.php Show resolved Hide resolved

lib/HTTP.php Show resolved Hide resolved

lib/HTTP.php Show resolved Hide resolved

tests/config.php Outdated Show resolved Hide resolved

nickvergessen and others added 4 commits July 25, 2025 00:12

ci: Update workflows

33ec3ed

[skip-ci] Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Sebastian Sterk <7263970+sebastiansterk@users.noreply.github.com>

Make NC30 compatible

2aeb5a2

Make the app compatible with Nextcloud 30 Signed-off-by: Ralf <ervee@moskovic.org> Signed-off-by: Sebastian Sterk <7263970+sebastiansterk@users.noreply.github.com>

feat: add http post generic auth

6fca339

Signed-off-by: Sebastian Sterk <7263970+sebastiansterk@users.noreply.github.com>

sebastiansterk force-pushed the master branch from ab51bac to 6fca339 Compare July 24, 2025 22:12

sebastiansterk and others added 3 commits July 25, 2025 00:18

Merge branch 'master' into master

2bce515

chore: add protocoll for http_auth endpoint

06d086b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Sebastian Sterk <7263970+sebastiansterk@users.noreply.github.com>

Merge branch 'master' into master

9a755c5

sebastiansterk enabled auto-merge December 3, 2025 19:53

sebastiansterk requested a review from Copilot December 3, 2025 19:55

Copilot started reviewing on behalf of sebastiansterk December 3, 2025 19:55 View session

Copilot finished reviewing on behalf of sebastiansterk December 3, 2025 20:00

Copilot AI reviewed Dec 3, 2025

View reviewed changes

	* @var OC_User_HTTP $instance
	* @var \OCA\UserExternal\HTTP $instance

		private function hashPassword($password) {
		return hash($this->hashAlgo, $password);

		'arguments' => array('https://example.com/auth_endpoint', 'md5'),
		),

feat: add http post generic auth #276

Are you sure you want to change the base?

feat: add http post generic auth #276

Uh oh!

Conversation

sebastiansterk commented Jul 24, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants