Update 'README.md'

README.md

@@ -1,32 +1,64 @@
-# lucidAuth
-[![](https://img.shields.io/badge/status-in%20production-%23003399.svg)](#) [![](https://img.shields.io/badge/contributors-1-green.svg) ](#)  
-
-Forward Authentication for use with proxies (caddy, nginx, traefik, etc)
-
-## Usage
-- Create a new folder, navigate to it in a commandprompt and run the following command:  
-  `git clone https://code.spamasaurus.com/djpbessems/lucidAuth.git`  
-- Edit `include/lucidAuth.config.php.example` to reflect your configuration and save as `include/lucidAuth.config.php`  
-- Create a new website (within any php-capable webserver) and make sure that the documentroot points to the `public` folder  
-- Check if you are able to browse to `https://<fqdn>/lucidAuth.login.php` (where `<fqdn>` is the actual domain -or IP address- your webserver is listening on)  
-- Edit your proxy's configuration to use the new website as forward proxy:  
-  - #### ~~in Caddy/nginx~~    <small>(planned for a later stage)</small>
-
-  - #### in Traefik  
-  Add the following lines (change to reflect your existing configuration):  
-  ```
-  [frontends.server1]
-    entrypoints = ["https"]
-    backend = "server1"
-    [frontends.server1.auth.forward]
-      address = "https://<fqdn>/lucidAuth.validateRequest.php"
-    [frontends.server1.routes]
-      [frontends.server1.routes.ext]
-        rule = "Host:<fqdn>"
-  ```
-
-- #### Important!  
-  The domainname of the website made in step 3, needs to match the domainname (*ignoring subdomains, if any*) of the resource utilizing this authentication proxy.
-
-## Questions or bugs
+# lucidAuth [![](https://img.shields.io/badge/status-in%20production-%23003399.svg)](#) [![](https://img.shields.io/badge/contributors-1-green.svg) ](#)  
+> *Respect* the unexpected, mitigate your risks  
+
+Forward Authentication for use with proxies (caddy, nginx, traefik, etc)
+
+## Usage
+- Create a new folder, navigate to it in a commandprompt and run the following command:  
+  `git clone https://code.spamasaurus.com/djpbessems/lucidAuth.git`  
+- Edit `include/lucidAuth.config.php.example` to reflect your configuration and save as `include/lucidAuth.config.php`  
+- Create a new website (within any php-capable webserver) and make sure that the documentroot points to the `public` folder  
+- Check if you are able to browse to `https://<fqdn>/lucidAuth.login.php` (where `<fqdn>` is the actual domain -or IP address- your webserver is listening on)  
+- Edit your proxy's configuration to use the new website as forward proxy:  
+  - #### ~~in Caddy/nginx~~    <small>(planned for a later stage)</small>
+
+  - #### in Traefik  
+  Add the following lines (change to reflect your existing configuration):  
+#####   1.7  
+  ```
+  [frontends.server1]
+          entrypoints = ["https"]
+          backend = "server1"
+          [frontends.server1.auth.forward]
+            address = "https://<fqdn>/lucidAuth.validateRequest.php"
+          [frontends.server1.routes]
+            [frontends.server1.routes.ext]
+              rule = "Host:<fqdn>"
+  ```
+#####   2.0  
+  Either whitelist IP's which should be trusted to send `HTTP_X-Forwarded-*` headers, ór enable insecure-mode in your static configuration:  
+  ```
+  entryPoints:
+          https:
+            address: :443
+            forwardedHeaders:
+              trustedIPs:
+                - "127.0.0.1/32"
+                - "192.168.1.0/24"
+        #      insecure: true
+  ```
+  Define a middleware that tells Traefik to forward requests for authentication in your dynamic file provider:  
+  ```
+  https:
+          middlewares:
+            ldap-authentication:
+              forwardAuth:
+                address: "https://<fqdn>/lucidAuth.validateRequest.php"
+                trustForwardHeader: true
+  ```
+  And finally add the new middleware to your service (different methods; this depends on your configuration):  
+  ```
+  # as a label (when using Docker provider)
+  traefik.http.routers.router1.middlewares: "ldap-authentication@file"
+  # as yaml (when using file provider)
+  routers:
+          router1:
+            middlewares:
+              - "ldap-authentication"
+  ```
+
+- #### Important!  
+  The domainname of the website made in step 3, needs to match the domainname (*ignoring subdomains, if any*) of the resource utilizing this authentication proxy.
+
+## Questions or bugs
 Feel free to open issues in this repository.

include/lucidAuth.template.php

@@ -15,6 +15,8 @@ $pageLayout['full'] = <<<'FULL'
     <link href="misc/style.button.css" rel="stylesheet" />
     <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.js"></script>
     <script src="misc/script.translation.js"></script>
+    <script src="https://unpkg.com/nprogress@0.2.0/nprogress.js"></script>
+    <link href="https://unpkg.com/nprogress@0.2.0/nprogress.css" rel="stylesheet" />
   </head>
   <body>
     <div id="horizon">

public/example.php

@@ -1,27 +0,0 @@
-<?php
-
-// Basic example of PHP script to handle with jQuery-Tabledit plug-in.
-// Note that is just an example. Should take precautions such as filtering the input data.
-
-header('Content-Type: application/json');
-
-$input = filter_input_array(INPUT_POST);
-
-$mysqli = new mysqli('localhost', 'user', 'password', 'database');
-
-if (mysqli_connect_errno()) {
-  echo json_encode(array('mysqli' => 'Failed to connect to MySQL: ' . mysqli_connect_error()));
-  exit;
-}
-
-if ($input['action'] === 'edit') {
-    $mysqli->query("UPDATE users SET username='" . $input['username'] . "', email='" . $input['email'] . "', avatar='" . $input['avatar'] . "' WHERE id='" . $input['id'] . "'");
-} else if ($input['action'] === 'delete') {
-    $mysqli->query("UPDATE users SET deleted=1 WHERE id='" . $input['id'] . "'");
-} else if ($input['action'] === 'restore') {
-    $mysqli->query("UPDATE users SET deleted=0 WHERE id='" . $input['id'] . "'");
-}
-
-mysqli_close($mysqli);
-
-echo json_encode($input);

public/misc/script.index.js

@@ -40,25 +40,27 @@ $(document).ready(function(){
                                 xhrFields: {
                                     withCredentials: true,
                                 },
+                                timeout: 750,
+// origin domain should be exempted from timeout
+//   (because origin domain can/will be different from current domain --due to traefik design).
                                 data: {
                                     ref: btoa(JSON.stringify({
                                         action: 'login',
                                         token: data.SecureToken
                                     }))
                                 }
+                            }).done(function() {
+                                NProgress.inc(1 / XHR.length);
                             }));
                         });
                         $.when.apply($, XHR).then(function(){
                             $.each(arguments, function(_index, _arg) {
-                                // Show progress somehow (maybe something like https://minicss.org/v2/progress)
+                                // Finished cross-domain logins (either succesfully or through timeout)
+                                NProgress.done();
+                                window.location.replace(data.Location);
                             });
                         });
 					}
-                    // Finished (either succesfully or through timeout) cross-domain logins
-// redirect once all finished loading or timeout after $X ms
-// origin domain should be exempted from timeout
-//   (because origin domain can/will be different from current domain --due to traefik design).
-					//window.location.replace(data.Location);
 				}, 2250);
 			} else {
 				$('#btnlogin').css({