6aa35a9 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Update sessions state

commit6aa35a9ecfe99dc9c78839da60b98b2bd250549a authorJoel Speed <Joel.speed@hotmail.co.uk> dateSat 27 Jan 2018, 10:53 (9 years ago) parent68d4164

2 files changed+26−8

compare with master

unifiedsplit

providers/session_state.go+21−6 providers/session_state_test.go+5−2

providers/session_state.go+21−6

@@ -33,6 +33,9 @@ func (s *SessionState) String() string {

3333 if s.AccessToken != "" {

3434 o += " token:true"

3535 }

36+ if s.IDToken != "" {

37+ o += " id_token:true"

38+ }

3639 if !s.ExpiresOn.IsZero() {

3740 o += fmt.Sprintf(" expires:%s", s.ExpiresOn)

3841 }

@@ -66,13 +69,19 @@ func (s *SessionState) EncryptedString(c *cookie.Cipher) (string, error) {

6669 return "", err

6770 }

6871 }

72+ i := s.IDToken

73+ if i != "" {

74+ if i, err = c.Encrypt(i); err != nil {

75+ return "", err

76+ }

77+ }

6978 r := s.RefreshToken

7079 if r != "" {

7180 if r, err = c.Encrypt(r); err != nil {

7281 return "", err

7382 }

7483 }

75− return fmt.Sprintf("%s|%s|%d|%s", s.accountInfo(), a, s.ExpiresOn.Unix(), r), nil

84+ return fmt.Sprintf("%s|%s|%s|%d|%s", s.accountInfo(), a, i, s.ExpiresOn.Unix(), r), nil

7685}

7786

7887func decodeSessionStatePlain(v string) (s *SessionState, err error) {

@@ -97,8 +106,8 @@ func DecodeSessionState(v string, c *cookie.Cipher) (s *SessionState, err error)

97106 }

98107

99108 chunks := strings.Split(v, "|")

100− if len(chunks) != 4 {

101− err = fmt.Errorf("invalid number of fields (got %d expected 4)", len(chunks))

109+ if len(chunks) != 5 {

110+ err = fmt.Errorf("invalid number of fields (got %d expected 5)", len(chunks))

102111 return

103112 }

104113

@@ -113,11 +122,17 @@ func DecodeSessionState(v string, c *cookie.Cipher) (s *SessionState, err error)

113122 }

114123 }

115124

116− ts, _ := strconv.Atoi(chunks[2])

125+ if chunks[2] != "" {

126+ if sessionState.IDToken, err = c.Decrypt(chunks[2]); err != nil {

127+ return nil, err

128+ }

129+ }

130+

131+ ts, _ := strconv.Atoi(chunks[3])

117132 sessionState.ExpiresOn = time.Unix(int64(ts), 0)

118133

119− if chunks[3] != "" {

120− if sessionState.RefreshToken, err = c.Decrypt(chunks[3]); err != nil {

134+ if chunks[4] != "" {

135+ if sessionState.RefreshToken, err = c.Decrypt(chunks[4]); err != nil {

121136 return nil, err

122137 }

123138 }

providers/session_state_test.go+5−2

@@ -21,12 +21,13 @@ func TestSessionStateSerialization(t *testing.T) {

2121 s := &SessionState{

2222 Email: "user@domain.com",

2323 AccessToken: "token1234",

24+ IDToken: "rawtoken1234",

2425 ExpiresOn: time.Now().Add(time.Duration(1) * time.Hour),

2526 RefreshToken: "refresh4321",

2627 }

2728 encoded, err := s.EncodeSessionState(c)

2829 assert.Equal(t, nil, err)

29− assert.Equal(t, 3, strings.Count(encoded, "|"))

30+ assert.Equal(t, 4, strings.Count(encoded, "|"))

3031

3132 ss, err := DecodeSessionState(encoded, c)

3233 t.Logf("%#v", ss)

@@ -34,6 +35,7 @@ func TestSessionStateSerialization(t *testing.T) {

3435 assert.Equal(t, "user", ss.User)

3536 assert.Equal(t, s.Email, ss.Email)

3637 assert.Equal(t, s.AccessToken, ss.AccessToken)

38+ assert.Equal(t, s.IDToken, ss.IDToken)

3739 assert.Equal(t, s.ExpiresOn.Unix(), ss.ExpiresOn.Unix())

3840 assert.Equal(t, s.RefreshToken, ss.RefreshToken)

3941

@@ -45,6 +47,7 @@ func TestSessionStateSerialization(t *testing.T) {

4547 assert.Equal(t, s.Email, ss.Email)

4648 assert.Equal(t, s.ExpiresOn.Unix(), ss.ExpiresOn.Unix())

4749 assert.NotEqual(t, s.AccessToken, ss.AccessToken)

50+ assert.NotEqual(t, s.IDToken, ss.IDToken)

4851 assert.NotEqual(t, s.RefreshToken, ss.RefreshToken)

4952}

5053

@@ -62,7 +65,7 @@ func TestSessionStateSerializationWithUser(t *testing.T) {

6265 }

6366 encoded, err := s.EncodeSessionState(c)

6467 assert.Equal(t, nil, err)

65− assert.Equal(t, 3, strings.Count(encoded, "|"))

68+ assert.Equal(t, 4, strings.Count(encoded, "|"))

6669

6770 ss, err := DecodeSessionState(encoded, c)

6871 t.Logf("%#v", ss)