auth

Documentation

Overview

Package auth covers auth for reaching injection points behind login gates: basic, digest, NTLM, bearer, cookie/form login, and CSRF extraction.

Index

• type AuthType
• type Config
• type Handler
  • func New(cfg Config, client *httpclient.Client) *Handler
  • func (h *Handler) Apply(req *Request) error
  • func (h *Handler) FetchCSRFToken(ctx context.Context) (string, error)
  • func (h *Handler) LastCSRFToken() string
  • func (h *Handler) Prepare(ctx context.Context) error
  • func (h *Handler) VerifyStillAuthenticated(ctx context.Context) (bool, error)
• type Request

Types

type AuthType

type AuthType string

AuthType enumerates the supported authentication methods.

const (
	AuthNone   AuthType = "none"
	AuthBasic  AuthType = "basic"
	AuthDigest AuthType = "digest"
	AuthNTLM   AuthType = "ntlm"
	AuthBearer AuthType = "bearer"
	AuthForm   AuthType = "form"
)

type Config

type Config struct {
	Type          AuthType
	Credentials   string // format depends on type
	LoginURL      string // form auth
	LoginData     string // form auth
	CheckURL      string // verify login success
	CheckString   string // text proving success
	CSRFTokenName string
	CSRFURL       string
}

Config configures the authentication handler.

type Handler

type Handler struct {
	// contains filtered or unexported fields
}

Handler tracks auth state: logins, cookies, CSRF tokens, and re-auth.

func New

func New(cfg Config, client *httpclient.Client) *Handler

New builds a Handler from a config and an httpclient.

func (*Handler) Apply

func (h *Handler) Apply(req *Request) error

Apply adds the appropriate authentication to an outgoing request. For header-based auth it injects the Authorization header; for form auth it injects session cookies; for digest/NTLM it performs the challenge dance.

func (*Handler) FetchCSRFToken

func (h *Handler) FetchCSRFToken(ctx context.Context) (string, error)

FetchCSRFToken retrieves a fresh CSRF token from the configured CSRF URL. It supports token extraction from HTML form hidden inputs, HTML meta tags, or JSON responses (by name lookup in a JSON object).

func (*Handler) LastCSRFToken

func (h *Handler) LastCSRFToken() string

LastCSRFToken returns the most recently extracted token, if any.

func (*Handler) Prepare

func (h *Handler) Prepare(ctx context.Context) error

Prepare performs the initial authentication. For form login it performs the login sequence and captures cookies. For header-based auth it builds the headers. It is safe to call before any scan.

func (*Handler) VerifyStillAuthenticated

func (h *Handler) VerifyStillAuthenticated(ctx context.Context) (bool, error)

VerifyStillAuthenticated checks the form session against the configured check URL. Header-based auth never expires mid-run, so it always returns true.

type Request

type Request struct {
	Method  string
	URL     string
	Headers map[string]string
	Body    []byte
}

Request is an outgoing HTTP request Apply can decorate with auth headers and cookies.