37f287b · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Calculate cookie expiration from encoded timestamp

Found out the hard way that _incoming_ cookies do _not_ have their expiration timestamps encoded. To perform auto-refresh based on expiration time, we have to recalculate it from the time encoded in the cookie value.

commit37f287bef46c11cee2e8c0d9af364b9f148a9225 authorMike Bland <michael.bland@gsa.gov> dateSun 10 May 2015, 00:11 (11 years ago) parent41b21dd

2 files changed+21−5

compare with master

unifiedsplit

oauthproxy.go+2−1 oauthproxy_test.go+19−4

oauthproxy.go+2−1

@@ -300,8 +300,9 @@ func (p *OauthProxy) ProcessCookie(rw http.ResponseWriter, req *http.Request) (e

300300 log.Printf(err.Error())

301301 ok = false

302302 } else if p.CookieRefresh != time.Duration(0) {

303+ expires := timestamp.Add(p.CookieExpire)

303304 refresh_threshold := time.Now().Add(p.CookieRefresh)

304− if refresh_threshold.Unix() > timestamp.Unix() {

305+ if refresh_threshold.Unix() > expires.Unix() {

305306 ok = p.Validator(email) && p.ValidateToken(access_token)

306307 if ok {

307308 p.SetCookie(rw, req, value)

oauthproxy_test.go+19−4

@@ -492,8 +492,8 @@ func TestProcessCookieRefreshNotSet(t *testing.T) {

492492 pc_test.InstantiateBackend()

493493 defer pc_test.Close()

494494

495+ pc_test.proxy.CookieExpire = time.Duration(23) * time.Hour

495496 cookie := pc_test.MakeCookie("michael.bland@gsa.gov", "")

496− cookie.Expires = time.Now().Add(time.Duration(23) * time.Hour)

497497 pc_test.req.AddCookie(cookie)

498498

499499 _, _, _, ok := pc_test.ProcessCookie()

@@ -506,8 +506,8 @@ func TestProcessCookieRefresh(t *testing.T) {

506506 pc_test.InstantiateBackend()

507507 defer pc_test.Close()

508508

509+ pc_test.proxy.CookieExpire = time.Duration(23) * time.Hour

509510 cookie := pc_test.MakeCookie("michael.bland@gsa.gov", "my_access_token")

510− cookie.Expires = time.Now().Add(time.Duration(23) * time.Hour)

511511 pc_test.req.AddCookie(cookie)

512512

513513 pc_test.proxy.CookieRefresh = time.Duration(24) * time.Hour

@@ -516,14 +516,29 @@ func TestProcessCookieRefresh(t *testing.T) {

516516 assert.NotEqual(t, []string(nil), pc_test.rw.HeaderMap["Set-Cookie"])

517517}

518518

519+func TestProcessCookieRefreshThresholdNotCrossed(t *testing.T) {

520+ pc_test := NewProcessCookieTest()

521+ pc_test.InstantiateBackend()

522+ defer pc_test.Close()

523+

524+ pc_test.proxy.CookieExpire = time.Duration(25) * time.Hour

525+ cookie := pc_test.MakeCookie("michael.bland@gsa.gov", "my_access_token")

526+ pc_test.req.AddCookie(cookie)

527+

528+ pc_test.proxy.CookieRefresh = time.Duration(24) * time.Hour

529+ _, _, _, ok := pc_test.ProcessCookie()

530+ assert.Equal(t, true, ok)

531+ assert.Equal(t, []string(nil), pc_test.rw.HeaderMap["Set-Cookie"])

532+}

533+

519534func TestProcessCookieFailIfRefreshSetAndTokenNoLongerValid(t *testing.T) {

520535 pc_test := NewProcessCookieTest()

521536 pc_test.InstantiateBackend()

522537 defer pc_test.Close()

523538 pc_test.response_code = 401

524539

540+ pc_test.proxy.CookieExpire = time.Duration(23) * time.Hour

525541 cookie := pc_test.MakeCookie("michael.bland@gsa.gov", "my_access_token")

526− cookie.Expires = time.Now().Add(time.Duration(23) * time.Hour)

527542 pc_test.req.AddCookie(cookie)

528543

529544 pc_test.proxy.CookieRefresh = time.Duration(24) * time.Hour

@@ -538,8 +553,8 @@ func TestProcessCookieFailIfRefreshSetAndUserNoLongerValid(t *testing.T) {

538553 defer pc_test.Close()

539554 pc_test.validate_user = false

540555

556+ pc_test.proxy.CookieExpire = time.Duration(23) * time.Hour

541557 cookie := pc_test.MakeCookie("michael.bland@gsa.gov", "my_access_token")

542− cookie.Expires = time.Now().Add(time.Duration(23) * time.Hour)

543558 pc_test.req.AddCookie(cookie)

544559

545560 pc_test.proxy.CookieRefresh = time.Duration(24) * time.Hour