git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #120 from costelmoraru/session_state_email

Encrypting user/email from cookie

commit3f4420fd583e6b7b8c8b4a481e1816f559bc3f97 authorJoel Speed <Joel.speed@hotmail.co.uk> dateWed 10 Apr 2019, 13:57 (8 years ago) parentbd64aebf7c85a4
3 files changed+33−6
compare with master
unifiedsplit
CHANGELOG.md+1 providers/session_state.go+26 providers/session_state_test.go+6−6
CHANGELOG.md+1
@@ -8,6 +8,7 @@
88 - Use JSON to encode session state to be stored in browser cookies
99 - Implement legacy decode function to support existing cookies generated by older versions
1010 - Add detailed table driven tests in session_state_test.go
11+- [#120](https://github.com/pusher/oauth2_proxy/pull/120) Encrypting user/email from cookie (@costelmoraru)
1112- [#55](https://github.com/pusher/oauth2_proxy/pull/55) Added login.gov provider (@timothy-spencer)
1213- [#55](https://github.com/pusher/oauth2_proxy/pull/55) Added environment variables for all config options (@timothy-spencer)
1314- [#70](https://github.com/pusher/oauth2_proxy/pull/70) Fix handling of splitted cookies (@einfachchr)
providers/session_state.go+26
@@ -62,6 +62,18 @@ func (s *SessionState) EncodeSessionState(c *cookie.Cipher) (string, error) {
6262 } else {
6363 ss = *s
6464 var err error
65+ if ss.Email != "" {
66+ ss.Email, err = c.Encrypt(ss.Email)
67+ if err != nil {
68+ return "", err
69+ }
70+ }
71+ if ss.User != "" {
72+ ss.User, err = c.Encrypt(ss.User)
73+ if err != nil {
74+ return "", err
75+ }
76+ }
6577 if ss.AccessToken != "" {
6678 ss.AccessToken, err = c.Encrypt(ss.AccessToken)
6779 if err != nil {
@@ -172,6 +184,20 @@ func DecodeSessionState(v string, c *cookie.Cipher) (*SessionState, error) {
172184 User: ss.User,
173185 }
174186 } else {
187+ // Backward compatibility with using unecrypted Email
188+ if ss.Email != "" {
189+ decryptedEmail, errEmail := c.Decrypt(ss.Email)
190+ if errEmail == nil {
191+ ss.Email = decryptedEmail
192+ }
193+ }
194+ // Backward compatibility with using unecrypted User
195+ if ss.User != "" {
196+ decryptedUser, errUser := c.Decrypt(ss.User)
197+ if errUser == nil {
198+ ss.User = decryptedUser
199+ }
200+ }
175201 if ss.AccessToken != "" {
176202 ss.AccessToken, err = c.Decrypt(ss.AccessToken)
177203 if err != nil {
providers/session_state_test.go+6−6
@@ -41,8 +41,8 @@ func TestSessionStateSerialization(t *testing.T) {
4141 ss, err = DecodeSessionState(encoded, c2)
4242 t.Logf("%#v", ss)
4343 assert.Equal(t, nil, err)
44− assert.Equal(t, "user", ss.User)
45− assert.Equal(t, s.Email, ss.Email)
44+ assert.NotEqual(t, "user", ss.User)
45+ assert.NotEqual(t, s.Email, ss.Email)
4646 assert.Equal(t, s.ExpiresOn.Unix(), ss.ExpiresOn.Unix())
4747 assert.NotEqual(t, s.AccessToken, ss.AccessToken)
4848 assert.NotEqual(t, s.IDToken, ss.IDToken)
@@ -77,8 +77,8 @@ func TestSessionStateSerializationWithUser(t *testing.T) {
7777 ss, err = DecodeSessionState(encoded, c2)
7878 t.Logf("%#v", ss)
7979 assert.Equal(t, nil, err)
80− assert.Equal(t, s.User, ss.User)
81− assert.Equal(t, s.Email, ss.Email)
80+ assert.NotEqual(t, s.User, ss.User)
81+ assert.NotEqual(t, s.Email, ss.Email)
8282 assert.Equal(t, s.ExpiresOn.Unix(), ss.ExpiresOn.Unix())
8383 assert.NotEqual(t, s.AccessToken, ss.AccessToken)
8484 assert.NotEqual(t, s.RefreshToken, ss.RefreshToken)
@@ -229,7 +229,7 @@ func TestDecodeSessionState(t *testing.T) {
229229 ExpiresOn: e,
230230 RefreshToken: "refresh4321",
231231 },
232− Encoded: fmt.Sprintf(`{"Email":"user@domain.com","User":"just-user","AccessToken":"I6s+ml+/MldBMgHIiC35BTKTh57skGX24w==","IDToken":"xojNdyyjB1HgYWh6XMtXY/Ph5eCVxa1cNsklJw==","RefreshToken":"qEX0x6RmASxo4dhlBG6YuRs9Syn/e9sHu/+K","ExpiresOn":%s}`, eString),
232+ Encoded: fmt.Sprintf(`{"Email":"FsKKYrTWZWrxSOAqA/fTNAUZS5QWCqOBjuAbBlbVOw==","User":"rT6JP3dxQhxUhkWrrd7yt6c1mDVyQCVVxw==","AccessToken":"I6s+ml+/MldBMgHIiC35BTKTh57skGX24w==","IDToken":"xojNdyyjB1HgYWh6XMtXY/Ph5eCVxa1cNsklJw==","RefreshToken":"qEX0x6RmASxo4dhlBG6YuRs9Syn/e9sHu/+K","ExpiresOn":%s}`, eString),
233233 Cipher: c,
234234 },
235235 {
@@ -237,7 +237,7 @@ func TestDecodeSessionState(t *testing.T) {
237237 Email: "user@domain.com",
238238 User: "just-user",
239239 },
240− Encoded: `{"Email":"user@domain.com","User":"just-user"}`,
240+ Encoded: `{"Email":"EGTllJcOFC16b7LBYzLekaHAC5SMMSPdyUrg8hd25g==","User":"rT6JP3dxQhxUhkWrrd7yt6c1mDVyQCVVxw=="}`,
241241 Cipher: c,
242242 },
243243 {