mTLS with basic auth fallback wiki entry is unsafe after caddy update

[Maxr1998 (Max Rumpf)]

My feedback concerns the following wiki entry:

Example: mTLS with Basic Auth fallback

This is a config created according to the post here that allows for basic auth to be used as a fallback when an mTLS client cert is not presented. # This matcher checks for the presence of an mTLS client cert (missing_mTLS_cert) { @missing_mTLS_cert { expression {tls_client_subject} == null } } (admin_user) { # user: test, pass: test test JDJhJDEwJGdtd01Gc0ttWUJFaVZEY0hpMGIwTmVSb2lwalpSUFl1NnouT2VjeTZwOTZCNDRuWVA4Ti5h } (guest_user) { # user: guest, pass: test …

In particular, the expression matcher expression {tls_client_subject} == null can never be true anymore since issue #7530 was fixed in version 2.11.2, which means that it won’t reject a missing certificate at all.

Instead of checking against null, the subject has to be matched against an empty string "". Please update the wiki post and mention this behavior change there.

[Mohammed90 (Mohammed Al Sahaf)]

It’s a wiki. You can update it yourself.

[Maxr1998 (Max Rumpf)]

I only signed up just now (for exactly this change), so I unfortunately still seem to lack the required permissions.

[Mohammed90 (Mohammed Al Sahaf)]

I’ve pumped your trust level so you can make the change. Thank you, by the way!

[Maxr1998 (Max Rumpf)]

Thanks, updated the wiki and left a comment