New: Remove Basic Auth

Closes #7597

frontend/src/Settings/General/SecuritySettings.tsx

@@ -36,6 +36,8 @@ export const authenticationMethodOptions = [
     get value() {
       return translate('AuthBasic');
     },
+    isDisabled: true,
+    isHidden: true,
   },
   {
     key: 'forms',

src/NzbDrone.Core/Authentication/AuthenticationType.cs

@@ -1,8 +1,11 @@
+using System;
+
 namespace NzbDrone.Core.Authentication
 {
     public enum AuthenticationType
     {
         None = 0,
+        [Obsolete("Use Forms authentication instead")]
         Basic = 1,
         Forms = 2,
         External = 3

src/NzbDrone.Core/Configuration/ConfigFileProvider.cs

@@ -205,8 +205,8 @@ namespace NzbDrone.Core.Configuration
 
                 if (enabled)
                 {
-                    SetValue("AuthenticationMethod", AuthenticationType.Basic);
-                    return AuthenticationType.Basic;
+                    SetValue("AuthenticationMethod", AuthenticationType.Forms);
+                    return AuthenticationType.Forms;
                 }
 
                 return Enum.TryParse<AuthenticationType>(_authOptions.Method, out var enumValue)

src/Sonarr.Api.V3/Config/HostConfigController.cs

@@ -40,10 +40,14 @@ namespace Sonarr.Api.V3.Config
             SharedValidator.RuleFor(c => c.UrlBase).ValidUrlBase();
             SharedValidator.RuleFor(c => c.InstanceName).StartsOrEndsWithSonarr();
 
-            SharedValidator.RuleFor(c => c.Username).NotEmpty().When(c => c.AuthenticationMethod == AuthenticationType.Basic ||
-                                                                          c.AuthenticationMethod == AuthenticationType.Forms);
-            SharedValidator.RuleFor(c => c.Password).NotEmpty().When(c => c.AuthenticationMethod == AuthenticationType.Basic ||
-                                                                          c.AuthenticationMethod == AuthenticationType.Forms);
+            SharedValidator.RuleFor(c => c.Username).NotEmpty().When(c => c.AuthenticationMethod == AuthenticationType.Forms);
+            SharedValidator.RuleFor(c => c.Password).NotEmpty().When(c => c.AuthenticationMethod == AuthenticationType.Forms);
+
+            SharedValidator.RuleFor(c => c.AuthenticationMethod)
+#pragma warning disable CS0618 // Type or member is obsolete
+                .NotEqual(AuthenticationType.Basic)
+#pragma warning restore CS0618 // Type or member is obsolete
+                .WithMessage("'Basic' is no longer supported, switch to 'Forms' instead.");
 
             SharedValidator.RuleFor(c => c.PasswordConfirmation)
                 .Must((resource, p) => IsMatchingPassword(resource)).WithMessage("Must match Password");

src/Sonarr.Http/Authentication/AuthenticationBuilderExtensions.cs

@@ -18,11 +18,6 @@ namespace Sonarr.Http.Authentication
             return authenticationBuilder.AddScheme<ApiKeyAuthenticationOptions, ApiKeyAuthenticationHandler>(name, options);
         }
 
-        public static AuthenticationBuilder AddBasic(this AuthenticationBuilder authenticationBuilder, string name)
-        {
-            return authenticationBuilder.AddScheme<AuthenticationSchemeOptions, BasicAuthenticationHandler>(name, options => { });
-        }
-
         public static AuthenticationBuilder AddNone(this AuthenticationBuilder authenticationBuilder, string name)
         {
             return authenticationBuilder.AddScheme<AuthenticationSchemeOptions, NoAuthenticationHandler>(name, options => { });
@@ -54,7 +49,9 @@ namespace Sonarr.Http.Authentication
             return services.AddAuthentication()
                 .AddNone(AuthenticationType.None.ToString())
                 .AddExternal(AuthenticationType.External.ToString())
-                .AddBasic(AuthenticationType.Basic.ToString())
+#pragma warning disable CS0618 // Type or member is obsolete
+                .AddCookie(AuthenticationType.Basic.ToString())
+#pragma warning restore CS0618 // Type or member is obsolete
                 .AddCookie(AuthenticationType.Forms.ToString())
                 .AddApiKey("API", options =>
                 {

src/Sonarr.Http/Authentication/BasicAuthenticationHandler.cs

@@ -1,84 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Security.Claims;
-using System.Text;
-using System.Text.Encodings.Web;
-using System.Text.RegularExpressions;
-using System.Threading.Tasks;
-using Microsoft.AspNetCore.Authentication;
-using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Options;
-using NzbDrone.Common.EnvironmentInfo;
-using NzbDrone.Core.Authentication;
-
-namespace Sonarr.Http.Authentication
-{
-    public class BasicAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
-    {
-        private readonly IAuthenticationService _authService;
-
-        public BasicAuthenticationHandler(IAuthenticationService authService,
-            IOptionsMonitor<AuthenticationSchemeOptions> options,
-            ILoggerFactory logger,
-            UrlEncoder encoder)
-            : base(options, logger, encoder)
-        {
-            _authService = authService;
-        }
-
-        protected override Task<AuthenticateResult> HandleAuthenticateAsync()
-        {
-            if (!Request.Headers.ContainsKey("Authorization"))
-            {
-                return Task.FromResult(AuthenticateResult.Fail("Authorization header missing."));
-            }
-
-            // Get authorization key
-            var authorizationHeader = Request.Headers["Authorization"].ToString();
-            var authHeaderRegex = new Regex(@"Basic (.*)");
-
-            if (!authHeaderRegex.IsMatch(authorizationHeader))
-            {
-                return Task.FromResult(AuthenticateResult.Fail("Authorization code not formatted properly."));
-            }
-
-            var authBase64 = Encoding.UTF8.GetString(Convert.FromBase64String(authHeaderRegex.Replace(authorizationHeader, "$1")));
-            var authSplit = authBase64.Split(':', 2);
-            var authUsername = authSplit[0];
-            var authPassword = authSplit.Length > 1 ? authSplit[1] : throw new Exception("Unable to get password");
-
-            var user = _authService.Login(Request, authUsername, authPassword);
-
-            if (user == null)
-            {
-                return Task.FromResult(AuthenticateResult.Fail("The username or password is not correct."));
-            }
-
-            var claims = new List<Claim>
-            {
-                new Claim("user", user.Username),
-                new Claim("identifier", user.Identifier.ToString()),
-                new Claim("AuthType", AuthenticationType.Basic.ToString())
-            };
-
-            var identity = new ClaimsIdentity(claims, "Basic", "user", "identifier");
-            var principal = new ClaimsPrincipal(identity);
-            var ticket = new AuthenticationTicket(principal, "Basic");
-
-            return Task.FromResult(AuthenticateResult.Success(ticket));
-        }
-
-        protected override Task HandleChallengeAsync(AuthenticationProperties properties)
-        {
-            Response.Headers["WWW-Authenticate"] = $"Basic realm=\"{BuildInfo.AppName}\"";
-            Response.StatusCode = 401;
-            return Task.CompletedTask;
-        }
-
-        protected override Task HandleForbiddenAsync(AuthenticationProperties properties)
-        {
-            Response.StatusCode = 403;
-            return Task.CompletedTask;
-        }
-    }
-}