Upstream/bitwarden-server
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-01-22 21:51:22 +01:00
Code Issues Projects Releases Wiki Activity

commented code to validate auth-email header (#1361)

Browse Source 
* commented code to validate auth-email header

* format comment more
This commit is contained in:
Kyle Spearrin 2021-05-28 16:04:58 -04:00 committed by GitHub
parent 0e76371d0d
commit 52dea4c2a4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/Core/IdentityServer/ResourceOwnerPasswordValidator.cs
View File

@ -19,6 +19,7 @@ namespace Bit.Core.IdentityServer
{
private UserManager<User> _userManager;
private readonly IUserService _userService;
private readonly ICurrentContext _currentContext;
public ResourceOwnerPasswordValidator(
UserManager<User> userManager,
@ -41,6 +42,7 @@ namespace Bit.Core.IdentityServer
{
_userManager = userManager;
_userService = userService;
_currentContext = currentContext;
}
public async Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
@ -55,6 +57,14 @@ namespace Bit.Core.IdentityServer
return (null, false);
}
// Uncomment whenever we want to require the `auth-email` header
//
//if (!_currentContext.HttpContext.Request.Headers.ContainsKey("Auth-Email") ||
// _currentContext.HttpContext.Request.Headers["Auth-Email"] != context.UserName)
//{
// return (null, false);
//}
var user = await _userManager.FindByEmailAsync(context.UserName.ToLowerInvariant());
if (user == null || !await _userService.CheckPasswordAsync(user, context.Password))
{