git.iko.soy/typeable/oauth2-proxy
on master help sign in
Sign cookies in the Redis Session store
b255ed5Joel Speed
pkg/sessions/redis/redis_store.go+30−11
compare with master
unifiedsplit
@@ -71,11 +71,9 @@ func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *se
71 return err
71 return err
72 }
72 }
73
73
74− ticketCookie := cookies.MakeCookieFromOptions(
74+ ticketCookie := store.makeCookie(
75 req,
75 req,
76− store.CookieOptions.CookieName,
77 ticketString,
76 ticketString,
78− store.CookieOptions,
79 store.CookieOptions.CookieExpire,
77 store.CookieOptions.CookieExpire,
80 s.CreatedAt,
78 s.CreatedAt,
81 )
79 )
@@ -91,8 +89,12 @@ func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, erro
91 if err != nil {
89 if err != nil {
92 return nil, fmt.Errorf("error loading session: %s", err)
90 return nil, fmt.Errorf("error loading session: %s", err)
93 }
91 }
94− // No cookie validation necessary
92+
93+ val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)
94+ if !ok {
95+ return nil, fmt.Errorf("Cookie Signature not valid")
96+ }
95− session, err := store.LoadSessionFromString(requestCookie.Value)
97+ session, err := store.LoadSessionFromString(val)
96 if err != nil {
98 if err != nil {
97 return nil, fmt.Errorf("error loading session: %s", err)
99 return nil, fmt.Errorf("error loading session: %s", err)
98 }
100 }
@@ -132,12 +134,15 @@ func (store *SessionStore) LoadSessionFromString(value string) (*sessions.Sessio
132func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) error {
134func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) error {
133 requestCookie, _ := req.Cookie(store.CookieOptions.CookieName)
135 requestCookie, _ := req.Cookie(store.CookieOptions.CookieName)
134
136
137+ val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)
138+ if !ok {
139+ return fmt.Errorf("Cookie Signature not valid")
140+ }
141+
135 // We go ahead and clear the cookie first, always.
142 // We go ahead and clear the cookie first, always.
136− clearCookie := cookies.MakeCookieFromOptions(
143+ clearCookie := store.makeCookie(
137 req,
144 req,
138− store.CookieOptions.CookieName,
139 "",
145 "",
140− store.CookieOptions,
141 time.Hour*-1,
146 time.Hour*-1,
142 time.Now(),
147 time.Now(),
143 )
148 )
@@ -145,10 +150,9 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
145
150
146 // We only return an error if we had an issue with redis
151 // We only return an error if we had an issue with redis
147 // If there's an issue decoding the ticket, ignore it
152 // If there's an issue decoding the ticket, ignore it
148− ticket, _ := decodeTicket(store.CookieOptions.CookieName, requestCookie.Value)
153+ ticket, _ := decodeTicket(store.CookieOptions.CookieName, val)
149 if ticket != nil {
154 if ticket != nil {
150− deleted, err := store.Client.Del(ticket.asHandle(store.CookieOptions.CookieName)).Result()
155+ _, err := store.Client.Del(ticket.asHandle(store.CookieOptions.CookieName)).Result()
151− fmt.Println("delted %n", deleted)
152 if err != nil {
156 if err != nil {
153 return fmt.Errorf("error clearing cookie from redis: %s", err)
157 return fmt.Errorf("error clearing cookie from redis: %s", err)
154 }
158 }
@@ -156,6 +160,21 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
156 return nil
160 return nil
157}
161}
158
162
163+// makeCookie makes a cookie, signing the value if present
164+func (store *SessionStore) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) *http.Cookie {
165+ if value != "" {
166+ value = cookie.SignedValue(store.CookieOptions.CookieSecret, store.CookieOptions.CookieName, value, now)
167+ }
168+ return cookies.MakeCookieFromOptions(
169+ req,
170+ store.CookieOptions.CookieName,
171+ value,
172+ store.CookieOptions,
173+ expires,
174+ now,
175+ )
176+}
177+
159func (store *SessionStore) storeValue(value string, expiresOn time.Time, requestCookie *http.Cookie) (string, error) {
178func (store *SessionStore) storeValue(value string, expiresOn time.Time, requestCookie *http.Cookie) (string, error) {
160 var ticket *TicketData
179 var ticket *TicketData
161 if requestCookie != nil {
180 if requestCookie != nil {