Merge pull request #17

Fix password comparison
sentinel-official · Nov 30, 2020 · a614c8e · a614c8e
2 parents 76908e4 + 3365c4e
commit a614c8e
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/cli/rest/auth/handlers.go b/cli/rest/auth/handlers.go
@@ -2,6 +2,7 @@ package auth
 
 import (
 	"crypto/rand"
+	"crypto/sha256"
 	"fmt"
 	"net/http"
 	"strings"
@@ -26,7 +27,8 @@ func HandlerLogin(ctx *context.Context) http.HandlerFunc {
 
 		auth := r.Header.Get("Authorization")
 		if auth == "" {
-			if body.Password != ctx.Config().Password {
+			password := fmt.Sprintf("%X", sha256.Sum256([]byte(body.Password)))
+			if password != ctx.Config().Password {
 				utils.WriteErrorToResponse(w, http.StatusUnauthorized, 3, "")
 				return
 			}