Rework Authorization flow

Currently we parse the whole message before authenticating,
allowing an attacker the ability to upload a large image,
or keep a connection open for the max amount of time easier
than it should be. This moves the authentication to the
earliest point possible, and restricts unauthenticated users
timeouts and max upload sizes. It also makes it so that
unauthenticated users cannot keep the connection alive
forever by refusing to close the connection.

Tested:
- login/logout
- firmware update
- large POST when unauthenticated
- timeouts when unauthenticated
- slowhttptest

Change-Id: Ifa02d8db04eac1821e8950eb85e71634a9e6d265
Signed-off-by: James Feist <james.feist@linux.intel.com>

1 files changed, 2 insertions, 3 deletions

diff --git a/include/webserver_common.hpp b/include/webserver_common.hpp
index 079b17a96f..d8876d473b 100644
--- a/include/webserver_common.hpp
+++ b/include/webserver_common.hpp
@@ -15,9 +15,8 @@
 */
 #pragma once
 
+#include "persistent_data_middleware.hpp"
 #include "security_headers_middleware.hpp"
-#include "token_authorization_middleware.hpp"
 
 using CrowApp = crow::App<crow::SecurityHeadersMiddleware,
-                          crow::persistent_data::Middleware,
-                          crow::token_authorization::Middleware>;
+                          crow::persistent_data::Middleware>;