feat: Replace ad hoc auth header with internet standard bearer token auth header

Cargo.toml

@@ -83,6 +83,7 @@ actix-web = { version = "4.3.1", default-features = false, features = [
   "compress-gzip",
   "compress-zstd",
 ] }
+actix-web-httpauth = "0.8.1"
 tracing = "0.1.37"
 tracing-actix-web = { version = "0.7.5", default-features = false }
 tracing-error = "0.2.0"
@@ -168,4 +169,5 @@ prometheus = { version = "0.13.3", features = ["process"], optional = true }
 actix-web-prom = { version = "0.6.0", optional = true }
 serial_test = { workspace = true }
 clap = { version = "4.3.19", features = ["derive"] }
+actix-web-httpauth = { workspace = true }
 lemmy_federate = { version = "0.18.4", path = "crates/federate" }

crates/api_crud/Cargo.toml

@@ -18,6 +18,7 @@ activitypub_federation = { workspace = true }
 bcrypt = { workspace = true }
 serde = { workspace = true }
 actix-web = { workspace = true }
+actix-web-httpauth = { workspace = true }
 tracing = { workspace = true }
 url = { workspace = true }
 async-trait = { workspace = true }

docker/federation/docker-compose.yml

@@ -2,11 +2,11 @@ version: "3.7"
 
 x-ui-default: &ui-default
   init: true
-  image: dessalines/lemmy-ui:0.18.4
+  # image: dessalines/lemmy-ui:0.18.4
   # assuming lemmy-ui is cloned besides lemmy directory
-  # build:
-  #   context: ../../../lemmy-ui
-  #   dockerfile: dev.dockerfile
+  build:
+    context: ../../../lemmy-ui
+    dockerfile: dev.dockerfile
   environment:
     - LEMMY_UI_HTTPS=false
 

src/session_middleware.rs

@@ -2,10 +2,11 @@ use actix_web::{
   body::MessageBody,
   cookie::SameSite,
   dev::{forward_ready, Service, ServiceRequest, ServiceResponse, Transform},
-  http::header::CACHE_CONTROL,
+  http::header::{Header, CACHE_CONTROL},
   Error,
   HttpMessage,
 };
+use actix_web_httpauth::headers::authorization::{Authorization, Bearer};
 use chrono::{DateTime, Utc};
 use core::future::Ready;
 use futures_util::future::LocalBoxFuture;
@@ -76,13 +77,9 @@ where
     let context = self.context.clone();
 
     Box::pin(async move {
-      // Try reading jwt from auth header
-      let auth_header = req
-        .headers()
-        .get(AUTH_COOKIE_NAME)
-        .and_then(|h| h.to_str().ok());
+      let auth_header = Authorization::<Bearer>::parse(&req).ok();
       let jwt = if let Some(a) = auth_header {
-        Some(a.to_string())
+        Some(a.as_ref().token().to_string())
       }
       // If that fails, try auth cookie. Dont use the `jwt` cookie from lemmy-ui because
       // its not http-only.