git.iko.soy/typeable/oauth2-proxy
on master help sign in
Check cookie_secret size when cookie_refresh set
commit8ec967ac324734f0180f9b7307e0406aefe31246 authorMike Bland <michael.bland@gsa.gov> dateSat 9 May 2015, 17:31 (11 years ago) parent082b7c0
3 files changed+8−4
compare with master
unifiedsplit
oauthproxy.go+1−1 options.go+3−3 options_test.go+4
oauthproxy.go+1−1
@@ -128,7 +128,7 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
128128 aes_cipher, err = aes.NewCipher([]byte(opts.CookieSecret))
129129 if err != nil {
130130 log.Fatal("error creating AES cipher with "+
131− "pass_access_token == true: %s", err)
131+ "cookie-secret ", opts.CookieSecret, ": ", err)
132132 }
133133 }
134134
options.go+3−3
@@ -120,7 +120,7 @@ func (o *Options) Validate() error {
120120 }
121121 msgs = parseProviderInfo(o, msgs)
122122
123− if o.PassAccessToken {
123+ if o.PassAccessToken || (o.CookieRefresh != time.Duration(0)) {
124124 valid_cookie_secret_size := false
125125 for _, i := range []int{16, 24, 32} {
126126 if len(o.CookieSecret) == i {
@@ -131,8 +131,8 @@ func (o *Options) Validate() error {
131131 msgs = append(msgs, fmt.Sprintf(
132132 "cookie_secret must be 16, 24, or 32 bytes "+
133133 "to create an AES cipher when "+
134− "pass_access_token == true, "+
135− "but is %d bytes",
134+ "pass_access_token == true or "+
135+ "cookie_refresh != 0, but is %d bytes",
136136 len(o.CookieSecret)))
137137 }
138138 }
options_test.go+4
@@ -112,6 +112,10 @@ func TestPassAccessTokenRequiresSpecificCookieSecretLengths(t *testing.T) {
112112 o.CookieSecret = "cookie of invalid length-"
113113 assert.NotEqual(t, nil, o.Validate())
114114
115+ o.PassAccessToken = false
116+ o.CookieRefresh = time.Duration(24) * time.Hour
117+ assert.NotEqual(t, nil, o.Validate())
118+
115119 o.CookieSecret = "16 bytes AES-128"
116120 assert.Equal(t, nil, o.Validate())
117121