mirror of
https://github.com/Airsonic-Pulse/airsonic-pulse.git
synced 2026-07-09 21:18:27 +00:00
f5aa50cc8e
* Add legacy-auth deprecation warning Closes the #145 apiKeyAuthentication bundle. PR-A shipped the storage, PR-B the auth wiring, PR-C the self-service UI; this last piece adds the operator nudge for legacy authentication and the user-facing release-notes Highlights for both apiKey availability and the legacy deprecation. A new LEGACY_AUTH_WARNING_CACHE (existing JCache/EhCache infrastructure, mirroring #228's ArtistByNameCache; bounded at 10000 entries, 24h TTL) backs a single throttled WARN log emitted from RESTRequestParameterProcessingFilter.successfulAuthentication on the first legacy authentication per (user, client) within the window. The hook distinguishes legacy auth by request parameters (u + (p OR (t AND s))) -- NOT by the authenticated token class -- because successfulAuthentication fires for any non-null Authentication result, including pre-authed apiKey and Basic requests. Request-param discrimination is the robust signal and naturally bypasses apiKey-only requests. The WARN line names the method (legacy username/password or legacy token+salt), points operators at the new Personal Settings -> API Keys page, and references #56 with soft timing. Inputs are sanitized (Character.isISOControl -> U+FFFD) before both log substitution and cache-key concatenation, which defeats CRLF log injection via the username and collision attacks via U+001F on the throttle separator; a MAX_FIELD_LENGTH = 256 early-reject prevents pathological-length keys from inflating the cache. The log line contains no password, token, salt, IP, or User-Agent. The existing RESTRequestParameterProcessingFilter.attemptAuthentication logic is byte-unchanged; only a setter, the maybeWarnLegacyAuth helper, and the static identifyLegacyAuthMethod were added. fixes #145 * CI: Update pm_ci workflow from self hosted to github hosted --------- Co-authored-by: litebito <litebito@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| scripts | ||
| workflows | ||
| CODE_OF_CONDUCT.md | ||
| CODEOWNERS | ||
| CONTRIBUTING.md | ||
| dependabot.yml | ||
| FUNDING.yml | ||
| PULL_REQUEST_TEMPLATE.md | ||
| SECURITY.md | ||