2020-03-29 14:36:01 +02:00
|
|
|
use actix_redis::RedisSession;
|
|
|
|
use actix_session::Session;
|
|
|
|
use actix_web::{
|
2021-06-27 08:02:38 +02:00
|
|
|
cookie, error::InternalError, middleware, web, App, Error, HttpResponse, HttpServer,
|
|
|
|
Responder,
|
2020-03-29 14:36:01 +02:00
|
|
|
};
|
2020-07-14 12:20:42 +02:00
|
|
|
use serde::{Deserialize, Serialize};
|
2020-03-29 14:36:01 +02:00
|
|
|
|
|
|
|
#[derive(Deserialize)]
|
|
|
|
struct Credentials {
|
|
|
|
username: String,
|
|
|
|
password: String,
|
|
|
|
}
|
|
|
|
|
|
|
|
#[derive(Serialize)]
|
|
|
|
struct User {
|
|
|
|
id: i64,
|
|
|
|
username: String,
|
|
|
|
password: String,
|
|
|
|
}
|
|
|
|
|
|
|
|
impl User {
|
2021-03-21 23:50:26 +01:00
|
|
|
fn authenticate(credentials: Credentials) -> Result<Self, HttpResponse> {
|
2020-03-29 14:36:01 +02:00
|
|
|
// TODO: figure out why I keep getting hacked
|
|
|
|
if &credentials.password != "hunter2" {
|
|
|
|
return Err(HttpResponse::Unauthorized().json("Unauthorized"));
|
|
|
|
}
|
|
|
|
|
|
|
|
Ok(User {
|
|
|
|
id: 42,
|
|
|
|
username: credentials.username,
|
|
|
|
password: credentials.password,
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-03-21 23:50:26 +01:00
|
|
|
pub fn validate_session(session: &Session) -> Result<i64, HttpResponse> {
|
2020-03-29 14:36:01 +02:00
|
|
|
let user_id: Option<i64> = session.get("user_id").unwrap_or(None);
|
|
|
|
|
|
|
|
match user_id {
|
|
|
|
Some(id) => {
|
|
|
|
// keep the user's session alive
|
|
|
|
session.renew();
|
|
|
|
Ok(id)
|
|
|
|
}
|
|
|
|
None => Err(HttpResponse::Unauthorized().json("Unauthorized")),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
async fn login(
|
|
|
|
credentials: web::Json<Credentials>,
|
|
|
|
session: Session,
|
2021-06-27 08:02:38 +02:00
|
|
|
) -> Result<impl Responder, Error> {
|
2020-03-29 14:36:01 +02:00
|
|
|
let credentials = credentials.into_inner();
|
|
|
|
|
|
|
|
match User::authenticate(credentials) {
|
2021-03-23 23:35:27 +01:00
|
|
|
Ok(user) => session.insert("user_id", user.id).unwrap(),
|
2021-06-27 08:02:38 +02:00
|
|
|
Err(err) => return Err(InternalError::from_response("", err).into()),
|
2020-03-29 14:36:01 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
Ok("Welcome!")
|
|
|
|
}
|
|
|
|
|
|
|
|
/// some protected resource
|
|
|
|
async fn secret(session: Session) -> Result<impl Responder, Error> {
|
|
|
|
// only allow access to this resource if the user has an active session
|
2021-06-27 08:02:38 +02:00
|
|
|
validate_session(&session).map_err(|err| InternalError::from_response("", err))?;
|
2020-03-29 14:36:01 +02:00
|
|
|
|
|
|
|
Ok("secret revealed")
|
|
|
|
}
|
|
|
|
|
|
|
|
#[actix_rt::main]
|
|
|
|
async fn main() -> std::io::Result<()> {
|
|
|
|
std::env::set_var("RUST_LOG", "actix_web=info,actix_redis=info");
|
|
|
|
env_logger::init();
|
|
|
|
|
|
|
|
HttpServer::new(|| {
|
|
|
|
App::new()
|
|
|
|
// enable logger
|
|
|
|
.wrap(middleware::Logger::default())
|
|
|
|
// cookie session middleware
|
|
|
|
.wrap(
|
|
|
|
RedisSession::new("127.0.0.1:6379", &[0; 32])
|
|
|
|
// allow the cookie to be accessed from javascript
|
|
|
|
.cookie_http_only(false)
|
|
|
|
// allow the cookie only from the current domain
|
|
|
|
.cookie_same_site(cookie::SameSite::Strict),
|
|
|
|
)
|
|
|
|
.route("/login", web::post().to(login))
|
|
|
|
.route("/secret", web::get().to(secret))
|
|
|
|
})
|
|
|
|
.bind("0.0.0.0:8080")?
|
|
|
|
.run()
|
|
|
|
.await
|
|
|
|
}
|