2bb0160 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

Streamline error page usage

2bb0160Nick Meves6 years ago

oauthproxy.go+38−37

compare with master

unifiedsplit

@@ -363,12 +363,13 @@ func (p *OAuthProxy) SaveSession(rw http.ResponseWriter, req *http.Request, s *s

363

364// RobotsTxt disallows scraping pages from the OAuthProxy

365func (p *OAuthProxy) RobotsTxt(rw http.ResponseWriter) {

366− rw.WriteHeader(http.StatusOK)

367 _, err := fmt.Fprintf(rw, "User-agent: *\nDisallow: /")

366 _, err := fmt.Fprintf(rw, "User-agent: *\nDisallow: /")

368 if err != nil {

367 if err != nil {

369− logger.Printf("Error writing robots.txt: %s", err.Error())

368+ logger.Printf("Error writing robots.txt: %v", err)

370− p.ErrorPage(rw, 500, "Internal Error", err.Error())

369+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

370+ return

371 }

372+ rw.WriteHeader(http.StatusOK)

372}

373}

373

374

374// ErrorPage writes an error response

375// ErrorPage writes an error response

@@ -385,7 +386,7 @@ func (p *OAuthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, m

385 }

386 }

386 err := p.templates.ExecuteTemplate(rw, "error.html", t)

387 err := p.templates.ExecuteTemplate(rw, "error.html", t)

387 if err != nil {

388 if err != nil {

388− logger.Printf("Error rendering error.html template: %s", err.Error())

389+ logger.Printf("Error rendering error.html template: %v", err)

389 http.Error(rw, "Internal Server Error", http.StatusInternalServerError)

390 http.Error(rw, "Internal Server Error", http.StatusInternalServerError)

390 }

391 }

391}

392}

@@ -395,16 +396,16 @@ func (p *OAuthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code

395 prepareNoCache(rw)

396 prepareNoCache(rw)

396 err := p.ClearSessionCookie(rw, req)

397 err := p.ClearSessionCookie(rw, req)

397 if err != nil {

398 if err != nil {

398− logger.Printf("Error clearing session cookie: %s", err.Error())

399+ logger.Printf("Error clearing session cookie: %v", err)

399− p.ErrorPage(rw, 500, "Internal Error", err.Error())

400+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

400 return

401 return

401 }

402 }

402 rw.WriteHeader(code)

403 rw.WriteHeader(code)

403

404

404 redirectURL, err := p.GetRedirect(req)

405 redirectURL, err := p.GetRedirect(req)

405 if err != nil {

406 if err != nil {

406− logger.Printf("Error obtaining redirect: %s", err.Error())

407+ logger.Printf("Error obtaining redirect: %v", err)

407− p.ErrorPage(rw, 500, "Internal Error", err.Error())

408+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

408 return

409 return

409 }

410 }

410

411

@@ -434,8 +435,8 @@ func (p *OAuthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code

434 }

435 }

435 err = p.templates.ExecuteTemplate(rw, "sign_in.html", t)

436 err = p.templates.ExecuteTemplate(rw, "sign_in.html", t)

436 if err != nil {

437 if err != nil {

437− logger.Printf("Error rendering sign_in.html template: %s", err.Error())

438+ logger.Printf("Error rendering sign_in.html template: %v", err)

438− p.ErrorPage(rw, 500, "Internal Error", err.Error())

439+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

439 }

440 }

440}

441}

441

442

@@ -645,7 +646,7 @@ func (p *OAuthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {

645 redirect, err := p.GetRedirect(req)

646 redirect, err := p.GetRedirect(req)

646 if err != nil {

647 if err != nil {

647 logger.Printf("Error obtaining redirect: %s", err.Error())

648 logger.Printf("Error obtaining redirect: %s", err.Error())

648− p.ErrorPage(rw, 500, "Internal Error", err.Error())

649+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

649 return

650 return

650 }

651 }

651

652

@@ -655,7 +656,7 @@ func (p *OAuthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {

655 err = p.SaveSession(rw, req, session)

656 err = p.SaveSession(rw, req, session)

656 if err != nil {

657 if err != nil {

657 logger.Printf("Error saving session: %s", err.Error())

658 logger.Printf("Error saving session: %s", err.Error())

658− p.ErrorPage(rw, 500, "Internal Error", err.Error())

659+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

659 return

660 return

660 }

661 }

661 http.Redirect(rw, req, redirect, http.StatusFound)

662 http.Redirect(rw, req, redirect, http.StatusFound)

@@ -687,8 +688,8 @@ func (p *OAuthProxy) UserInfo(rw http.ResponseWriter, req *http.Request) {

687 rw.WriteHeader(http.StatusOK)

688 rw.WriteHeader(http.StatusOK)

688 err = json.NewEncoder(rw).Encode(userInfo)

689 err = json.NewEncoder(rw).Encode(userInfo)

689 if err != nil {

690 if err != nil {

690− logger.Printf("Error encoding user info: %s", err.Error())

691+ logger.Printf("Error encoding user info: %v", err)

691− p.ErrorPage(rw, 500, "Internal Error", err.Error())

692+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

692 }

693 }

693}

694}

694

695

@@ -696,14 +697,14 @@ func (p *OAuthProxy) UserInfo(rw http.ResponseWriter, req *http.Request) {

696func (p *OAuthProxy) SignOut(rw http.ResponseWriter, req *http.Request) {

697func (p *OAuthProxy) SignOut(rw http.ResponseWriter, req *http.Request) {

697 redirect, err := p.GetRedirect(req)

698 redirect, err := p.GetRedirect(req)

698 if err != nil {

699 if err != nil {

699− logger.Printf("Error obtaining redirect: %s", err.Error())

700+ logger.Printf("Error obtaining redirect: %v", err)

700− p.ErrorPage(rw, 500, "Internal Error", err.Error())

701+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

701 return

702 return

702 }

703 }

703 err = p.ClearSessionCookie(rw, req)

704 err = p.ClearSessionCookie(rw, req)

704 if err != nil {

705 if err != nil {

705− logger.Printf("Error clearing session cookie: %s", err.Error())

706+ logger.Printf("Error clearing session cookie: %v", err)

706− p.ErrorPage(rw, 500, "Internal Error", err.Error())

707+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

707 return

708 return

708 }

709 }

709 http.Redirect(rw, req, redirect, http.StatusFound)

710 http.Redirect(rw, req, redirect, http.StatusFound)

@@ -714,15 +715,15 @@ func (p *OAuthProxy) OAuthStart(rw http.ResponseWriter, req *http.Request) {

714 prepareNoCache(rw)

715 prepareNoCache(rw)

715 nonce, err := encryption.Nonce()

716 nonce, err := encryption.Nonce()

716 if err != nil {

717 if err != nil {

717− logger.Printf("Error obtaining nonce: %s", err.Error())

718+ logger.Printf("Error obtaining nonce: %v", err)

718− p.ErrorPage(rw, 500, "Internal Error", err.Error())

719+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

719 return

720 return

720 }

721 }

721 p.SetCSRFCookie(rw, req, nonce)

722 p.SetCSRFCookie(rw, req, nonce)

722 redirect, err := p.GetRedirect(req)

723 redirect, err := p.GetRedirect(req)

723 if err != nil {

724 if err != nil {

724− logger.Printf("Error obtaining redirect: %s", err.Error())

725+ logger.Printf("Error obtaining redirect: %v", err)

725− p.ErrorPage(rw, 500, "Internal Error", err.Error())

726+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

726 return

727 return

727 }

728 }

728 redirectURI := p.GetRedirectURI(req.Host)

729 redirectURI := p.GetRedirectURI(req.Host)

@@ -737,42 +738,42 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {

737 // finish the oauth cycle

738 // finish the oauth cycle

738 err := req.ParseForm()

739 err := req.ParseForm()

739 if err != nil {

740 if err != nil {

740− logger.Printf("Error while parsing OAuth2 callback: %s" + err.Error())

741+ logger.Printf("Error while parsing OAuth2 callback: %v", err)

741− p.ErrorPage(rw, 500, "Internal Error", err.Error())

742+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

742 return

743 return

743 }

744 }

744 errorString := req.Form.Get("error")

745 errorString := req.Form.Get("error")

745 if errorString != "" {

746 if errorString != "" {

746− logger.Printf("Error while parsing OAuth2 callback: %s ", errorString)

747+ logger.Printf("Error while parsing OAuth2 callback: %s", errorString)

747− p.ErrorPage(rw, 403, "Permission Denied", errorString)

748+ p.ErrorPage(rw, http.StatusForbidden, "Permission Denied", errorString)

748 return

749 return

749 }

750 }

750

751

751 session, err := p.redeemCode(req.Context(), req.Host, req.Form.Get("code"))

752 session, err := p.redeemCode(req.Context(), req.Host, req.Form.Get("code"))

752 if err != nil {

753 if err != nil {

753− logger.Printf("Error redeeming code during OAuth2 callback: %s ", err.Error())

754+ logger.Printf("Error redeeming code during OAuth2 callback: %v", err)

754− p.ErrorPage(rw, 500, "Internal Error", "Internal Error")

755+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", "Internal Error")

755 return

756 return

756 }

757 }

757

758

758 s := strings.SplitN(req.Form.Get("state"), ":", 2)

759 s := strings.SplitN(req.Form.Get("state"), ":", 2)

759 if len(s) != 2 {

760 if len(s) != 2 {

760 logger.Printf("Error while parsing OAuth2 state: invalid length")

761 logger.Printf("Error while parsing OAuth2 state: invalid length")

761− p.ErrorPage(rw, 500, "Internal Error", "Invalid State")

762+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", "Invalid State")

762 return

763 return

763 }

764 }

764 nonce := s[0]

765 nonce := s[0]

765 redirect := s[1]

766 redirect := s[1]

766 c, err := req.Cookie(p.CSRFCookieName)

767 c, err := req.Cookie(p.CSRFCookieName)

767 if err != nil {

768 if err != nil {

768− logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2: unable too obtain CSRF cookie")

769+ logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2: unable to obtain CSRF cookie")

769− p.ErrorPage(rw, 403, "Permission Denied", err.Error())

770+ p.ErrorPage(rw, http.StatusForbidden, "Permission Denied", err.Error())

770 return

771 return

771 }

772 }

772 p.ClearCSRFCookie(rw, req)

773 p.ClearCSRFCookie(rw, req)

773 if c.Value != nonce {

774 if c.Value != nonce {

774− logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2: csrf token mismatch, potential attack")

775+ logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2: CSRF token mismatch, potential attack")

775− p.ErrorPage(rw, 403, "Permission Denied", "csrf failed")

776+ p.ErrorPage(rw, http.StatusForbidden, "Permission Denied", "CSRF Failed")

776 return

777 return

777 }

778 }

778

779

@@ -785,14 +786,14 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {

785 logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Authenticated via OAuth2: %s", session)

786 logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Authenticated via OAuth2: %s", session)

786 err := p.SaveSession(rw, req, session)

787 err := p.SaveSession(rw, req, session)

787 if err != nil {

788 if err != nil {

788− logger.Printf("%s %s", remoteAddr, err)

789+ logger.Printf("Error saving session state for %s: %v", remoteAddr, err)

789− p.ErrorPage(rw, 500, "Internal Error", "Internal Error")

790+ p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", err.Error())

790 return

791 return

791 }

792 }

792 http.Redirect(rw, req, redirect, http.StatusFound)

793 http.Redirect(rw, req, redirect, http.StatusFound)

793 } else {

794 } else {

794 logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2: unauthorized")

795 logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2: unauthorized")

795− p.ErrorPage(rw, 403, "Permission Denied", "Invalid Account")

796+ p.ErrorPage(rw, http.StatusForbidden, "Permission Denied", "Invalid Account")

796 }

797 }

797}

798}

798

799

@@ -870,7 +871,7 @@ func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.R

870 // Invalid session, clear it

871 // Invalid session, clear it

871 err := p.ClearSessionCookie(rw, req)

872 err := p.ClearSessionCookie(rw, req)

872 if err != nil {

873 if err != nil {

873− logger.Printf("Error clearing session cookie: %s", err.Error())

874+ logger.Printf("Error clearing session cookie: %v", err)

874 }

875 }

875 return nil, ErrNeedsLogin

876 return nil, ErrNeedsLogin

876 }

877 }