Allow requiring basic HTTP authentication

ordinals · casey · Feb 20, 2024 · Feb 15, 2024 · Feb 15, 2024 · Feb 19, 2024
commit e2120a721de50198fc0c6237a4d03c7a0f95da74
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -65,7 +65,7 @@ tempfile = "3.2.0"
 tokio = { version = "1.17.0", features = ["rt-multi-thread"] }
 tokio-stream = "0.1.9"
 tokio-util = {version = "0.7.3", features = ["compat"] }
-tower-http = { version = "0.4.0", features = ["compression-br", "compression-gzip", "cors", "set-header"] }
+tower-http = { version = "0.4.0", features = ["auth", "compression-br", "compression-gzip", "cors", "set-header"] }
 
 [dev-dependencies]
 criterion = "0.5.1"

diff --git a/src/subcommand/server.rs b/src/subcommand/server.rs
@@ -41,6 +41,7 @@ use {
     compression::CompressionLayer,
     cors::{Any, CorsLayer},
     set_header::SetResponseHeaderLayer,
+    validate_request::ValidateRequestHeaderLayer,
   },
 };
 
@@ -180,6 +181,18 @@ pub struct Server {
   pub(crate) decompress: bool,
   #[arg(long, alias = "nosync", help = "Do not update the index.")]
   pub(crate) no_sync: bool,
+  #[arg(
+    long,
+    requires = "username",
+    help = "Require basic HTTP authentication with <PASSWORD>. Credentials are sent in cleartext. Consider using authentication in conjunction with HTTPS."
+  )]
+  pub(crate) password: Option<String>,
+  #[arg(
+    long,
+    requires = "password",
+    help = "Require basic HTTP authentication with <USERNAME>. Credentials are sent in cleartext. Consider using authentication in conjunction with HTTPS."
+  )]
+  pub(crate) username: Option<String>,
 }
 
 impl Server {
@@ -310,6 +323,13 @@ impl Server {
         .layer(CompressionLayer::new())
         .with_state(server_config);
 
+      let router =
+        if let Some((username, password)) = self.username.as_ref().zip(self.password.as_ref()) {
+          router.layer(ValidateRequestHeaderLayer::basic(&username, &password))
+        } else {
+          router
+        };
+
       match (self.http_port(), self.https_port()) {
         (Some(http_port), None) => {
           self
@@ -5299,4 +5319,14 @@ next
       },
     )
   }
+
+  #[test]
+  fn authentication_requires_username_and_password_are() {
+    assert!(Arguments::try_parse_from(["ord", "server", "--username", "foo"]).is_err());
+    assert!(Arguments::try_parse_from(["ord", "server", "--password", "bar"]).is_err());
+    assert!(
+      Arguments::try_parse_from(["ord", "server", "--username", "foo", "--password", "bar"])
+        .is_ok()
+    );
+  }
 }
diff --git a/tests/server.rs b/tests/server.rs
@@ -584,3 +584,39 @@ fn run_no_sync() {
 
   child.kill().unwrap();
 }
+
+#[test]
+fn authentication() {
+  let rpc_server = test_bitcoincore_rpc::spawn();
+
+  let port = TcpListener::bind("127.0.0.1:0")
+    .unwrap()
+    .local_addr()
+    .unwrap()
+    .port();
+
+  let builder = CommandBuilder::new(format!(
+    "server --address 127.0.0.1 --http-port {port} --username foo --password bar"
+  ))
+  .bitcoin_rpc_server(&rpc_server);
+
+  let mut command = builder.command();
+
+  let mut child = command.spawn().unwrap();
+
+  for attempt in 0.. {
+    if let Ok(response) = reqwest::blocking::get(format!("http://localhost:{port}")) {
+      if response.status() == 401 {
+        break;
+      }
+    }
+
+    if attempt == 100 {
+      panic!("Server did not respond");
+    }
+
+    thread::sleep(Duration::from_millis(50));
+  }
+
+  child.kill().unwrap();
+}