5c4f0298a6
* fix(sharing): validate JWT expiration and share existence on stream endpoint
The public stream endpoint (/public/s/{token}) was using
TokenAuth.Decode() which only verifies the JWT signature but skips
exp claim validation. This allowed expired share stream URLs to remain
functional indefinitely. Additionally, deleting a share did not revoke
previously issued stream tokens since the handler never performed a
server-side share lookup.
Fixed by switching decodeStreamInfo() to use auth.Validate() which
properly checks the exp claim, and by embedding the share ID ("sid")
in stream tokens so the handler can verify the share still exists.
Old tokens without the sid claim remain backward compatible but still
benefit from expiration validation.
* fix(sharing): check share expiration on stream requests
Replace the lightweight Exists() check with Get() + expiration
validation, so that shares whose ExpiresAt was updated to an earlier
time after token issuance are also rejected (410 Gone). Reuses the
existing checkShareError handler for consistent error responses.
109 lines
3.1 KiB
Go
109 lines
3.1 KiB
Go
package public
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"net/http"
|
|
"path"
|
|
|
|
"github.com/navidrome/navidrome/conf"
|
|
"github.com/navidrome/navidrome/consts"
|
|
"github.com/navidrome/navidrome/core/auth"
|
|
"github.com/navidrome/navidrome/core/publicurl"
|
|
"github.com/navidrome/navidrome/log"
|
|
"github.com/navidrome/navidrome/model"
|
|
"github.com/navidrome/navidrome/server"
|
|
"github.com/navidrome/navidrome/ui"
|
|
. "github.com/navidrome/navidrome/utils/gg"
|
|
"github.com/navidrome/navidrome/utils/req"
|
|
)
|
|
|
|
func (pub *Router) handleShares(w http.ResponseWriter, r *http.Request) {
|
|
id, err := req.Params(r).String(":id")
|
|
if err != nil {
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
// If requested file is a UI asset, just serve it
|
|
_, err = ui.BuildAssets().Open(id)
|
|
if err == nil {
|
|
pub.assetsHandler.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
// If it is not, consider it a share ID
|
|
s, err := pub.share.Load(r.Context(), id)
|
|
if err != nil {
|
|
checkShareError(r.Context(), w, err, id)
|
|
return
|
|
}
|
|
|
|
s = pub.mapShareInfo(r, *s)
|
|
server.IndexWithShare(pub.ds, ui.BuildAssets(), s)(w, r)
|
|
}
|
|
|
|
func (pub *Router) handleM3U(w http.ResponseWriter, r *http.Request) {
|
|
id, err := req.Params(r).String(":id")
|
|
if err != nil {
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
// If it is not, consider it a share ID
|
|
s, err := pub.share.Load(r.Context(), id)
|
|
if err != nil {
|
|
checkShareError(r.Context(), w, err, id)
|
|
return
|
|
}
|
|
|
|
s = pub.mapShareToM3U(r, *s)
|
|
w.WriteHeader(http.StatusOK)
|
|
w.Header().Set("Content-Type", "audio/x-mpegurl")
|
|
_, _ = w.Write([]byte(s.ToM3U8())) //nolint:gosec
|
|
}
|
|
|
|
func checkShareError(ctx context.Context, w http.ResponseWriter, err error, id string) {
|
|
switch {
|
|
case errors.Is(err, model.ErrExpired):
|
|
log.Error(ctx, "Share expired", "id", id, err)
|
|
http.Error(w, "Share not available anymore", http.StatusGone)
|
|
case errors.Is(err, model.ErrNotFound):
|
|
log.Error(ctx, "Share not found", "id", id, err)
|
|
http.Error(w, "Share not found", http.StatusNotFound)
|
|
case errors.Is(err, model.ErrNotAuthorized):
|
|
log.Error(ctx, "Share is not downloadable", "id", id, err)
|
|
http.Error(w, "This share is not downloadable", http.StatusForbidden)
|
|
case err != nil:
|
|
log.Error(ctx, "Error retrieving share", "id", id, err)
|
|
http.Error(w, "Error retrieving share", http.StatusInternalServerError)
|
|
}
|
|
}
|
|
|
|
func (pub *Router) mapShareInfo(r *http.Request, s model.Share) *model.Share {
|
|
s.URL = ShareURL(r, s.ID)
|
|
s.ImageURL = publicurl.ImageURL(r, s.CoverArtID(), conf.Server.UICoverArtSize)
|
|
for i := range s.Tracks {
|
|
s.Tracks[i].ID = encodeMediafileShare(s, s.Tracks[i].ID)
|
|
}
|
|
return &s
|
|
}
|
|
|
|
func (pub *Router) mapShareToM3U(r *http.Request, s model.Share) *model.Share {
|
|
for i := range s.Tracks {
|
|
id := encodeMediafileShare(s, s.Tracks[i].ID)
|
|
s.Tracks[i].Path = publicurl.PublicURL(r, path.Join(consts.URLPathPublic, "s", id), nil)
|
|
}
|
|
return &s
|
|
}
|
|
|
|
func encodeMediafileShare(s model.Share, id string) string {
|
|
claims := auth.Claims{
|
|
ID: id,
|
|
Format: s.Format,
|
|
BitRate: s.MaxBitRate,
|
|
ShareID: s.ID,
|
|
}
|
|
token, _ := auth.CreateExpiringPublicToken(V(s.ExpiresAt), claims)
|
|
return token
|
|
}
|