git.iko.soy/typeable/oauth2-proxy
on 71dc702 help sign in
typeable/oauth2-proxy/pkg/encryption/utils.go
106 lines 3.2 kB history raw
1package encryption
3import (
4 "crypto/hmac"
5 "crypto/sha1"
6 "crypto/sha256"
7 "encoding/base64"
8 "fmt"
9 "hash"
10 "net/http"
11 "strconv"
12 "strings"
13 "time"
16// SecretBytes attempts to base64 decode the secret, if that fails it treats the secret as binary
17func SecretBytes(secret string) []byte {
18 b, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(secret, "="))
19 if err == nil {
20 // Only return decoded form if a valid AES length
21 // Don't want unintentional decoding resulting in invalid lengths confusing a user
22 // that thought they used a 16, 24, 32 length string
23 for _, i := range []int{16, 24, 32} {
24 if len(b) == i {
25 return b
26 }
27 }
28 }
29 // If decoding didn't work or resulted in non-AES compliant length,
30 // assume the raw string was the intended secret
31 return []byte(secret)
34// cookies are stored in a 3 part (value + timestamp + signature) to enforce that the values are as originally set.
35// additionally, the 'value' is encrypted so it's opaque to the browser
37// Validate ensures a cookie is properly signed
38func Validate(cookie *http.Cookie, seed string, expiration time.Duration) (value []byte, t time.Time, ok bool) {
39 // value, timestamp, sig
40 parts := strings.Split(cookie.Value, "|")
41 if len(parts) != 3 {
42 return
43 }
44 if checkSignature(parts[2], seed, cookie.Name, parts[0], parts[1]) {
45 ts, err := strconv.Atoi(parts[1])
46 if err != nil {
47 return
48 }
49 // The expiration timestamp set when the cookie was created
50 // isn't sent back by the browser. Hence, we check whether the
51 // creation timestamp stored in the cookie falls within the
52 // window defined by (Now()-expiration, Now()].
53 t = time.Unix(int64(ts), 0)
54 if t.After(time.Now().Add(expiration*-1)) && t.Before(time.Now().Add(time.Minute*5)) {
55 // it's a valid cookie. now get the contents
56 rawValue, err := base64.URLEncoding.DecodeString(parts[0])
57 if err == nil {
58 value = rawValue
59 ok = true
60 return
61 }
62 }
63 }
64 return
67// SignedValue returns a cookie that is signed and can later be checked with Validate
68func SignedValue(seed string, key string, value []byte, now time.Time) string {
69 encodedValue := base64.URLEncoding.EncodeToString(value)
70 timeStr := fmt.Sprintf("%d", now.Unix())
71 sig := cookieSignature(sha256.New, seed, key, encodedValue, timeStr)
72 cookieVal := fmt.Sprintf("%s|%s|%s", encodedValue, timeStr, sig)
73 return cookieVal
76func cookieSignature(signer func() hash.Hash, args ...string) string {
77 h := hmac.New(signer, []byte(args[0]))
78 for _, arg := range args[1:] {
79 h.Write([]byte(arg))
80 }
81 var b []byte
82 b = h.Sum(b)
83 return base64.URLEncoding.EncodeToString(b)
86func checkSignature(signature string, args ...string) bool {
87 checkSig := cookieSignature(sha256.New, args...)
88 if checkHmac(signature, checkSig) {
89 return true
90 }
92 // TODO: After appropriate rollout window, remove support for SHA1
93 legacySig := cookieSignature(sha1.New, args...)
94 return checkHmac(signature, legacySig)
97func checkHmac(input, expected string) bool {
98 inputMAC, err1 := base64.URLEncoding.DecodeString(input)
99 if err1 == nil {
100 expectedMAC, err2 := base64.URLEncoding.DecodeString(expected)
101 if err2 == nil {
102 return hmac.Equal(inputMAC, expectedMAC)
103 }
104 }
105 return false