git.iko.soy/typeable/oauth2-proxy
on master help sign in
Stop accepting legacy SHA1 signed cookies
commit56f199a24f313f3b68f620ec278a9c40c2ee390c authorNick Meves <nick.meves@greenhouse.io> dateSun 24 May 2020, 11:02 (6 years ago) parent55a941b
3 files changed+7−14
compare with master
unifiedsplit
CHANGELOG.md+4 pkg/encryption/utils.go+1−12 pkg/encryption/utils_test.go+2−2
CHANGELOG.md+4
@@ -4,12 +4,16 @@
44
55## Important Notes
66
7+- [#575](https://github.com/oauth2-proxy/oauth2-proxy/pull/575) Sessions from v5.1.1 or earlier will no longer validate since they were not signed with SHA1.
8+ - Sessions from v6.0.0 or later had a graceful conversion to SHA256 that resulted in no reauthentication
9+ - Upgrading from v5.1.1 or earlier will result in a reauthentication
710- [#616](https://github.com/oauth2-proxy/oauth2-proxy/pull/616) Ensure you have configured oauth2-proxy to use the `groups` scope. The user may be logged out initially as they may not currently have the `groups` claim however after going back through login process wil be authenticated.
811
912## Breaking Changes
1013
1114## Changes since v6.1.1
1215
16+- [#575](https://github.com/oauth2-proxy/oauth2-proxy/pull/575) Stop accepting legacy SHA1 signed cookies (@NickMeves)
1317- [#764](https://github.com/oauth2-proxy/oauth2-proxy/pull/764) Document bcrypt encryption for htpasswd (and hide SHA) (@lentzi90)
1418- [#616](https://github.com/oauth2-proxy/oauth2-proxy/pull/616) Add support to ensure user belongs in required groups when using the OIDC provider (@stefansedich)
1519
pkg/encryption/utils.go+1−12
@@ -2,8 +2,6 @@ package encryption
22
33import (
44 "crypto/hmac"
5− // TODO (@NickMeves): Remove SHA1 signed cookie support in V7
6− "crypto/sha1" // #nosec G505
75 "crypto/sha256"
86 "encoding/base64"
97 "fmt"
@@ -95,16 +93,7 @@ func checkSignature(signature string, args ...string) bool {
9593 if err != nil {
9694 return false
9795 }
98− if checkHmac(signature, checkSig) {
99− return true
100− }
101−
102− // TODO (@NickMeves): Remove SHA1 signed cookie support in V7
103− legacySig, err := cookieSignature(sha1.New, args...)
104− if err != nil {
105− return false
106− }
107− return checkHmac(signature, legacySig)
96+ return checkHmac(signature, checkSig)
10897}
10998
11099func checkHmac(input, expected string) bool {
pkg/encryption/utils_test.go+2−2
@@ -94,8 +94,8 @@ func TestSignAndValidate(t *testing.T) {
9494 assert.NoError(t, err)
9595
9696 assert.True(t, checkSignature(sha256sig, seed, key, value, epoch))
97− // This should be switched to False after fully deprecating SHA1
98− assert.True(t, checkSignature(sha1sig, seed, key, value, epoch))
97+ // We don't validate legacy SHA1 signatures anymore
98+ assert.False(t, checkSignature(sha1sig, seed, key, value, epoch))
9999
100100 assert.False(t, checkSignature(sha256sig, seed, key, "tampered", epoch))
101101 assert.False(t, checkSignature(sha1sig, seed, key, "tampered", epoch))