84190ab · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

Validate user during cookie refresh

84190abMike Bland11 years ago

oauthproxy.go+1−1

compare with master

unifiedsplit

@@ -302,7 +302,7 @@ func (p *OauthProxy) ProcessCookie(rw http.ResponseWriter, req *http.Request) (e

302 } else if p.CookieRefresh != time.Duration(0) {

303 refresh_threshold := time.Now().Add(p.CookieRefresh)

304 if refresh_threshold.Unix() > timestamp.Unix() {

305− ok = p.ValidateToken(access_token)

305+ ok = p.Validator(email) && p.ValidateToken(access_token)

306 if ok {

307 p.SetCookie(rw, req, value)

308 }

oauthproxy_test.go+19−1

@@ -397,6 +397,7 @@ type ProcessCookieTest struct {

397 req *http.Request

398 backend *httptest.Server

399 response_code int

400+ validate_user bool

400}

401}

401

402

402func NewProcessCookieTest() *ProcessCookieTest {

403func NewProcessCookieTest() *ProcessCookieTest {

@@ -414,7 +415,7 @@ func NewProcessCookieTest() *ProcessCookieTest {

414 pc_test.opts.Validate()

415 pc_test.opts.Validate()

415

416

416 pc_test.proxy = NewOauthProxy(pc_test.opts, func(email string) bool {

417 pc_test.proxy = NewOauthProxy(pc_test.opts, func(email string) bool {

417− return true

418+ return pc_test.validate_user

418 })

419 })

419

420

420 // Now, zero-out proxy.CookieRefresh for the cases that don't involve

421 // Now, zero-out proxy.CookieRefresh for the cases that don't involve

@@ -422,6 +423,7 @@ func NewProcessCookieTest() *ProcessCookieTest {

422 pc_test.proxy.CookieRefresh = time.Duration(0)

423 pc_test.proxy.CookieRefresh = time.Duration(0)

423 pc_test.rw = httptest.NewRecorder()

424 pc_test.rw = httptest.NewRecorder()

424 pc_test.req, _ = http.NewRequest("GET", "/", strings.NewReader(""))

425 pc_test.req, _ = http.NewRequest("GET", "/", strings.NewReader(""))

426+ pc_test.validate_user = true

425 return &pc_test

427 return &pc_test

426}

428}

427

429

@@ -529,3 +531,19 @@ func TestProcessCookieFailIfRefreshSetAndTokenNoLongerValid(t *testing.T) {

529 assert.Equal(t, false, ok)

531 assert.Equal(t, false, ok)

530 assert.Equal(t, []string(nil), pc_test.rw.HeaderMap["Set-Cookie"])

532 assert.Equal(t, []string(nil), pc_test.rw.HeaderMap["Set-Cookie"])

531}

533}

534+

535+func TestProcessCookieFailIfRefreshSetAndUserNoLongerValid(t *testing.T) {

536+ pc_test := NewProcessCookieTest()

537+ pc_test.InstantiateBackend()

538+ defer pc_test.Close()

539+ pc_test.validate_user = false

540+

541+ cookie := pc_test.MakeCookie("michael.bland@gsa.gov", "my_access_token")

542+ cookie.Expires = time.Now().Add(time.Duration(23) * time.Hour)

543+ pc_test.req.AddCookie(cookie)

544+

545+ pc_test.proxy.CookieRefresh = time.Duration(24) * time.Hour

546+ _, _, _, ok := pc_test.ProcessCookie()

547+ assert.Equal(t, false, ok)

548+ assert.Equal(t, []string(nil), pc_test.rw.HeaderMap["Set-Cookie"])

549+}