git.iko.soy/typeable/oauth2-proxy
on master help sign in
Refactor cookie building and parsing

Extracts buildCookieValue() and parseCookieValue() from OauthProxy.ServeHTTP() and adds tests for both.

commit9887ac3be5006d42417f7e195be1d64d693d12c5 authorMike Bland <michael.bland@gsa.gov> dateSun 5 Apr 2015, 10:51 (12 years ago) parentcf79fd9
3 files changed+92−19
compare with master
unifiedsplit
cookies.go+31 cookies_test.go+52 oauthproxy.go+9−19
cookies.go+31
@@ -97,3 +97,34 @@ func decodeAccessToken(aes_cipher cipher.Block, encoded_access_token string) (st
9797
9898 return string(encrypted_access_token), nil
9999}
100+
101+func buildCookieValue(email string, aes_cipher cipher.Block,
102+ access_token string) (string, error) {
103+ if aes_cipher == nil {
104+ return email, nil
105+ }
106+
107+ encoded_token, err := encodeAccessToken(aes_cipher, access_token)
108+ if err != nil {
109+ return email, fmt.Errorf(
110+ "error encoding access token for %s: %s", email, err)
111+ }
112+ return email + "|" + encoded_token, nil
113+}
114+
115+func parseCookieValue(value string, aes_cipher cipher.Block) (email, user,
116+ access_token string, err error) {
117+ components := strings.Split(value, "|")
118+ email = components[0]
119+ user = strings.Split(email, "@")[0]
120+
121+ if aes_cipher != nil && len(components) == 2 {
122+ access_token, err = decodeAccessToken(aes_cipher, components[1])
123+ if err != nil {
124+ err = fmt.Errorf(
125+ "error decoding access token for %s: %s",
126+ email, err)
127+ }
128+ }
129+ return email, user, access_token, err
130+}
cookies_test.go+52
@@ -3,6 +3,7 @@ package main
33import (
44 "crypto/aes"
55 "github.com/bmizerany/assert"
6+ "strings"
67 "testing"
78)
89
@@ -21,3 +22,54 @@ func TestEncodeAndDecodeAccessToken(t *testing.T) {
2122 assert.NotEqual(t, access_token, encoded_token)
2223 assert.Equal(t, access_token, decoded_token)
2324}
25+
26+func TestBuildCookieValueWithoutAccessToken(t *testing.T) {
27+ value, err := buildCookieValue("michael.bland@gsa.gov", nil, "")
28+ assert.Equal(t, nil, err)
29+ assert.Equal(t, "michael.bland@gsa.gov", value)
30+}
31+
32+func TestBuildCookieValueWithAccessTokenAndNilCipher(t *testing.T) {
33+ value, err := buildCookieValue("michael.bland@gsa.gov", nil,
34+ "access token")
35+ assert.Equal(t, nil, err)
36+ assert.Equal(t, "michael.bland@gsa.gov", value)
37+}
38+
39+func TestParseCookieValueWithoutAccessToken(t *testing.T) {
40+ email, user, access_token, err := parseCookieValue(
41+ "michael.bland@gsa.gov", nil)
42+ assert.Equal(t, nil, err)
43+ assert.Equal(t, "michael.bland@gsa.gov", email)
44+ assert.Equal(t, "michael.bland", user)
45+ assert.Equal(t, "", access_token)
46+}
47+
48+func TestParseCookieValueWithAccessTokenAndNilCipher(t *testing.T) {
49+ email, user, access_token, err := parseCookieValue(
50+ "michael.bland@gsa.gov|access_token", nil)
51+ assert.Equal(t, nil, err)
52+ assert.Equal(t, "michael.bland@gsa.gov", email)
53+ assert.Equal(t, "michael.bland", user)
54+ assert.Equal(t, "", access_token)
55+}
56+
57+func TestBuildAndParseCookieValueWithAccessToken(t *testing.T) {
58+ aes_cipher, err := aes.NewCipher([]byte("0123456789abcdef"))
59+ assert.Equal(t, nil, err)
60+ value, err := buildCookieValue("michael.bland@gsa.gov", aes_cipher,
61+ "access_token")
62+ assert.Equal(t, nil, err)
63+
64+ prefix := "michael.bland@gsa.gov|"
65+ if !strings.HasPrefix(value, prefix) {
66+ t.Fatal("cookie value does not start with \"%s\": %s",
67+ prefix, value)
68+ }
69+
70+ email, user, access_token, err := parseCookieValue(value, aes_cipher)
71+ assert.Equal(t, nil, err)
72+ assert.Equal(t, "michael.bland@gsa.gov", email)
73+ assert.Equal(t, "michael.bland", user)
74+ assert.Equal(t, "access_token", access_token)
75+}
oauthproxy.go+9−19
@@ -425,20 +425,12 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
425425 // set cookie, or deny
426426 if p.Validator(email) {
427427 log.Printf("%s authenticating %s completed", remoteAddr, email)
428− encoded_token := ""
429− if p.AesCipher != nil {
430− encoded_token, err = encodeAccessToken(p.AesCipher, access_token)
431− if err != nil {
432− log.Printf("error encoding access token: %s", err)
433− }
434− }
435− access_token = ""
436−
437− if encoded_token != "" {
438− p.SetCookie(rw, req, email+"|"+encoded_token)
439− } else {
440− p.SetCookie(rw, req, email)
428+ value, err := buildCookieValue(
429+ email, p.AesCipher, access_token)
430+ if err != nil {
431+ log.Printf(err.Error())
441432 }
433+ p.SetCookie(rw, req, value)
442434 http.Redirect(rw, req, redirect, 302)
443435 return
444436 } else {
@@ -452,15 +444,13 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
452444 if err == nil {
453445 var value string
454446 value, ok = validateCookie(cookie, p.CookieSeed)
455− components := strings.Split(value, "|")
456− email = components[0]
457− if len(components) == 2 {
458− access_token, err = decodeAccessToken(p.AesCipher, components[1])
447+ if ok {
448+ email, user, access_token, err = parseCookieValue(
449+ value, p.AesCipher)
459450 if err != nil {
460− log.Printf("error decoding access token: %s", err)
451+ log.Printf(err.Error())
461452 }
462453 }
463− user = strings.Split(email, "@")[0]
464454 }
465455 }
466456