yacy/htroot/User.java, branch master

moved all remaining servlet classes to new location

2022-10-02T21:22:12Z

Make it possible to set an empty password disabling the authentication

2021-01-25T10:49:21Z

protocol completely If you set now an empty password, then the http server will not ask to authentify. This is required for environment where we attach an outside authentification service like keycloak or similar using authentication in an ingress proxy. This change is part of the approach to run YaCy inside of a kubernetes cluster where we do not want individual authentication of peers and want to apply a ingress authentication.

Enable HTTP Digest authentication for non admin users.

2017-10-26T05:51:18Z

Also ensure authentication is not lost by Digest timeout when navigating between index.html and search results page. This way, running searches with extended features on a remote peer or a password protected peer works with a regular user (with "Extended search" rights). When authenticating on the search page with a user without "Extended search" rights, it appears as authenticated, but has just its usual access to the public search features.

Complete harmonization RequestHeader getCookie with std ServletRequest

2017-01-02T02:04:21Z

to use javax.servlet.http.Cookie parameters. Depreciate now obsolete getHeaderCookies. Adjust setting of MaxAge to spec if >= 0 otherwise keep default.

remove login cookie generation for static admin ind User servlet

2016-11-26T22:28:30Z

cookieAuth is never successful for static admin, leaving the creation and handling for login cookies for static admin obsolete.

let User servlet detect static admin with (newer) md5 encoded pwd

2016-11-19T00:02:05Z

(complete a old todo)

remove login request directly after logout,

2016-11-18T01:39:53Z

and add logout from servlet container make logout button red

Make ServletRequest implement the standardized HttpServletRequest interface,

2016-11-14T00:37:16Z

to make all readily available information from the original ServletRequest available to YaCy servlets (without converting data to internal structures). The implementation of the common interface allows easier integration of YaCy servlets with the servlet standard (e.g. shared login service with the servlet container etc.)

implemented DIGEST authentication, which is for remote login more secure

2014-01-16T23:02:23Z

as BASIC were pwd is transmitted near clear text (B64enc). This has some implication as RFC 2617 requires and recommends a password hash MD5(user:realm:pwd) for DIGEST. !!! before activating DIGEST you have to reassign all passwords !!! to allow new calculation of the hash - default authentication is still BASIC - configuration at this time only manually in (DATA/settings) or defaults/web.xml ( - the realmname is in defaults/yacy.init adminRealm=YaCy-AdminUI - fyi: the realmname is shown on login screen - changing the realm name invalidates all passwords - but for security you are encouraged to do so (as localhostadmin) - implemented to support both, old hashes for BASIC and new hashes for BASIC and DIGEST - to differentiate old / new hash the in Jetty used hash-prefix "MD5:" is used for new pwd-hashes ( "MD5:hash" )

fixed some XSS bugs reported by Marius from http://ctf365.com/

2013-11-16T19:34:31Z