Skip to content

basic auth - potential security issue if wrongly configured #58

Description

@violoncelloCH

During reviewing #54 (and experimenting with it), I just remarked that a wrong configuration of OC_User_BasicAuth could lead to a potential security issue:

If an admin configures an URL to authenticate against, where no basic authentication happens at all but the server responds with a 200 response immediately on each request, everyone can login with any username/password combinations.
It's even possible to login with usernames registered under other backends (e.g. a username registered as a regular Nextcloud user; you can just use anything as password and get access to this user account as well).

It could even be the case, that something changes on the side of the requested web server over time and the admin wouldn't remark it at all (that his Nextcloud is open to anyone) until he/she explicitly tests wrong username/password combinations

I wonder, if we could somehow check, if the requested web server does an authentication at all and otherwise not allow access. If not, we should at least add a warning to the documentation.
What do you think @nerdmaennchen ?

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions