fix: proper Zoraxy CSRF/session handling (login.html + cookie jar)
This commit is contained in:
parent
d0f9854084
commit
79bf23618d
1 changed files with 59 additions and 56 deletions
65
deploy.sh
65
deploy.sh
|
|
@ -264,50 +264,56 @@ EOF
|
|||
done
|
||||
sleep 1
|
||||
|
||||
# Shared cookie jar for CSRF-authenticated Zoraxy API calls
|
||||
# Zoraxy API helper — uses direct /login.html to avoid redirect CSRF issues
|
||||
COOKIE_JAR="/tmp/zoraxy_cookies.txt"
|
||||
|
||||
# Helper: fetch CSRF token from Zoraxy login page (uses $COOKIE_JAR)
|
||||
fetch_csrf() {
|
||||
rm -f "$COOKIE_JAR"
|
||||
|
||||
fetch_csrf() {
|
||||
# Fetch /login.html directly (no redirect), save cookies, extract token
|
||||
local page
|
||||
page=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/ 2>&1)
|
||||
page=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html 2>&1)
|
||||
local token
|
||||
token=$(echo "$page" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
|
||||
token=$(echo "$page" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//' | head -1)
|
||||
echo "$token"
|
||||
}
|
||||
|
||||
zoraxy_post() {
|
||||
local path="$1" data="$2"
|
||||
local csrf
|
||||
csrf=$(fetch_csrf)
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000${path}" \
|
||||
-H "X-CSRF-Token: ${csrf}" -d "${data}"
|
||||
}
|
||||
|
||||
zoraxy_get() {
|
||||
local path="$1" data="$2"
|
||||
local csrf
|
||||
csrf=$(fetch_csrf)
|
||||
curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000${path}" \
|
||||
-H "X-CSRF-Token: ${csrf}" -G ${data:+-d "$data"}
|
||||
}
|
||||
|
||||
# Step 1: Create admin account
|
||||
echo " Creating admin account..."
|
||||
CSRF=$(fetch_csrf)
|
||||
if [ -z "$CSRF" ]; then
|
||||
echo " [WARN] Could not fetch CSRF token — trying registration without it"
|
||||
ADMIN_RESULT=$(curl -s -X POST "http://127.0.0.1:8000/api/auth/register" \
|
||||
ADMIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
|
||||
-H "X-CSRF-Token: ${CSRF}" \
|
||||
-d "username=${ADMIN_USERNAME:-master}" \
|
||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||
else
|
||||
ADMIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d "username=${ADMIN_USERNAME:-master}" \
|
||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||
fi
|
||||
|
||||
if echo "$ADMIN_RESULT" | grep -qi '"success"\|"ok"\|"registered'; then
|
||||
echo " [OK] Admin account created: $ADMIN_USERNAME"
|
||||
elif echo "$ADMIN_RESULT" | grep -qi 'already\|exist'; then
|
||||
echo " [OK] Admin account already exists"
|
||||
else
|
||||
echo " [INFO] Admin registration response: $ADMIN_RESULT"
|
||||
echo " [INFO] Admin registration: $ADMIN_RESULT"
|
||||
fi
|
||||
|
||||
# Step 2: Login with Zoraxy admin for LE configuration
|
||||
# Step 2: Login (saves session cookie in $COOKIE_JAR)
|
||||
echo " Logging in for LE configuration..."
|
||||
CSRF=$(fetch_csrf)
|
||||
if [ -z "$CSRF" ]; then
|
||||
echo " [WARN] No CSRF token — skipping LE automation"
|
||||
else
|
||||
LOGIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
LOGIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
|
||||
-H "X-CSRF-Token: ${CSRF}" \
|
||||
-d "username=${ADMIN_USERNAME:-master}" \
|
||||
-d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
|
||||
|
||||
|
|
@ -316,18 +322,17 @@ EOF
|
|||
|
||||
# Set LE email
|
||||
echo " Setting Let's Encrypt email: ${TLS_EMAIL}"
|
||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
|
||||
-d "set=${TLS_EMAIL}" > /dev/null
|
||||
zoraxy_post "/api/acme/autoRenew/email" "set=${TLS_EMAIL}" > /dev/null
|
||||
|
||||
# Obtain certificates for all subdomains (30s timeout each)
|
||||
# URL-encode "Let's Encrypt" as Let%27s%20Encrypt to avoid curl parsing issues
|
||||
# Obtain certificates for all subdomains
|
||||
LE_CA="Let%27s%20Encrypt"
|
||||
for SUB in app dns; do
|
||||
echo " Requesting LE certificate for ${SUB}.${DOMAIN}..."
|
||||
CERT_RESULT=$(curl -s --max-time 30 -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
|
||||
CERT_RESULT=$(curl -s --max-time 60 -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
|
||||
-H "X-CSRF-Token: $(fetch_csrf)" \
|
||||
-G -d "domains=${SUB}.${DOMAIN}" -d "filename=${SUB}.${DOMAIN}" \
|
||||
-d "email=${TLS_EMAIL}" -d "ca=${LE_CA}" -d "dns=false" 2>&1)
|
||||
if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
|
||||
if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed\|true'; then
|
||||
echo " [OK] Certificate obtained for ${SUB}.${DOMAIN}"
|
||||
else
|
||||
echo " [INFO] ${SUB}.${DOMAIN}: $CERT_RESULT (expected if DNS doesn't resolve)"
|
||||
|
|
@ -336,13 +341,11 @@ EOF
|
|||
|
||||
# Enable auto-renew
|
||||
echo " Enabling auto-renew..."
|
||||
curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
|
||||
-d "enable=true" > /dev/null
|
||||
zoraxy_post "/api/acme/autoRenew/enable" "enable=true" > /dev/null
|
||||
echo " [OK] LE auto-renew enabled"
|
||||
else
|
||||
echo " [WARN] Login failed: $LOGIN_RESULT"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Restart Zoraxy to pick up configs
|
||||
echo "[*] Restarting Zoraxy to apply configs..."
|
||||
|
|
|
|||
Loading…
Reference in a new issue