ueffel/caddy-basic-auth-filter

Caddy log filter module with a log field filter to extract the user from a basic Authorization HTTP-Header

caddy-basic-auth-filter

This packages contains a log field filter to extract the user from a basic Authorization HTTP-Header.

Installation

xcaddy build --with github.com/ueffel/caddy-basic-auth-filter

Usage

See caddy log filter documentation. There will be a new filters to use:

<field> basic_auth_user

• field Probably the only sensible field to use here is: request>headers>Authorization

Since caddy v2.5.0 logging of credentials needs to be enabled in the global server options with log_credentials for this filter to work. See caddyserver/caddy#4438.

Example configuration

The following example configuration uses the Formatted Log Encoder

format filter {
    wrap formatted "{request>host} {request>headers>Authorization} [{ts}] \"{request>method} {request>uri} {request>proto}\""
    fields {
        request>headers>Authorization basic_auth_user
    }
}

localhost admin [1620840157.514536] "GET /some/path HTTP/2.0" 

For reference the configuration and output without filters:

format formatted "{request>host} {request>headers>Authorization} [{ts}] \"{request>method} {request>uri} {request>proto}\""

Log output:

localhost ["Basic YWRtaW46YWRtaW4="] [1638732239.578346] "GET /some/path HTTP/2.0"

caddy-basic-auth-filter's Issues

Retain non Basic-Auth authorization header values in logs

Hallo Steffen,

hier auch Steffen - ebenfalls ein Caddy-User aus Deutschland 😄

I am using your Caddy module on a domain, where different types of HTTP-Authentication are used, but mostly Basic-Auth and Digest-Auth.
My log configuration is this:

        log access-log-json {
                include http.log.access
                output file log/access.json {
                        roll_size 10m
                        roll_local_time
                        roll_keep_for 365d
                }
                format filter {
                        wrap json {
                                time_format iso8601
                                time_local
                        }
                        fields {
                                request>tls>version tls_version TLSv
                                request>tls>cipher_suite tls_cipher
                                request>headers>Authorization basic_auth_user
                        }
                }
        }

BTW: My server block contains log_credentials.

When Basic-Auth is used, such as curl https://playground.stbu.net -H "Authorization: Basic dGVzdHVzZXI6dGVzdA==", everything is perfect. The JSON log output will contain "Authorization": "testuser".

When Digest-Auth is used, such as curl https://playground.stbu.net -H 'Authorization: Digest username="exampleuser", realm="protected", nonce="12345678901", uri="/", response="123456789012345678901234567890", qop=auth, nc=00000911, cnonce="1234567890" then the JSON log output will contain "Authorization": "".

When Bearer-Auth is used, such as curl https://playground.stbu.net -H "Authorization: Bearer 123456789012345678901234567890", then the JSON log output will contain "Authorization": "".

I would rather like to have the original value of the Authorization Header in case it is not Basic-Auth.
For example when Bearer-Auth is used, I would like to have "Authorization": "Bearer 123456789012345678901234567890" logged instead of an empty Authorization. Ideally, in case of Digest-Auth, I would like to have the value of username="exampleuser", but that would contradict with this module name.
Would it be possible to implement an optional flag like "preserve_other" (request>headers>Authorization basic_auth_user preserve_other) in this module with the logic that if this flag is provided, the original value is returned when it's not a Basic-Auth instead of return an empty string?