Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
'CgC6RwAAAA9EAEUAUwBLAFQATwBQAC0ASgBTADQAVQBKAFQARAACAB4ARABFAFMA' +
'SwBUAE8AUAAtAEoAUwA0AFUASgBUAEQAAQAeAEQARQBTAEsAVABPAFAALQBKAFMA' +
'NABVAEoAVABEAAQAHgBEAEUAUwBLAFQATwBQAC0ASgBTADQAVQBKAFQARAADAB4A' +
'RABFAFMASwBUAE8AUAAtAEoAUwA0AFUASgBUAEQABwAIADmguzCHn9UBAAAAAA==',
parsedType2Message = ntlmUtils.parseType2Message(type2Message, _.noop),
username = options.username || 'username',
password = options.password || 'password',
domain = options.domain || '',
workstation = options.workstation || '',
type1Message = ntlmUtils.createType1Message({
domain,
workstation
}),
type3Message = ntlmUtils.createType3Message(parsedType2Message, {
domain,
workstation,
username,
password
}),
handler = function (req, res) {
var authHeaders = req.headers.authorization;
// send type2 message and ask for type3 message
if (authHeaders && authHeaders.startsWith(type1Message.slice(0, 20))) {
res.writeHead(401, {
// @note we're sending a 'Negotiate' header here to make
// sure that runtime can handle it.
'www-authenticate': [type2Message, 'Negotiate']
ntlmType2Header = response.headers.find(function (header) {
return String(header.key).toLowerCase() === WWW_AUTHENTICATE &&
header.valueOf().startsWith('NTLM ');
});
if (!ntlmType2Header) {
return done(new Error('ntlm: server did not send NTLM type 2 message'));
}
challengeMessage = ntlmUtil.parseType2Message(ntlmType2Header.valueOf(), _.noop);
if (!challengeMessage) {
return done(new Error('ntlm: server did not correctly process authentication request'));
}
authenticateMessage = ntlmUtil.createType3Message(challengeMessage, {
domain: domain,
workstation: workstation,
username: username,
password: password
});
// Now create the type 3 message, and add it to the request
auth.set(NTLM_HEADER, authenticateMessage);
auth.set(STATE, STATES.T3_MSG_CREATED);
// ask runtime to replay the request
return done(null, false);
}
else if (state === STATES.T3_MSG_CREATED) {
// Means we have tried to authenticate, so we should stop here without worrying about anything
return done(null, true);