c459806 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

promote basic auth to cookie

c459806Jehiah Czebotar14 years ago

README.md+6

compare with master

unifiedsplit

@@ -83,3 +83,9 @@ server {

83 }

84}

85```

86+

87+## Documentation

88+

89+* /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)

90+* /oauth2/start - a URL that will redirect to start the oauth cycle

91+* /oauth2/callback - the URL used at the end of the oauth cycle

oauthproxy.go+26−18

@@ -148,13 +148,13 @@ func (p *OauthProxy) getUserInfo(token string) (string, error) {

148 return email, nil

149}

150

151−func ClearCookie(rw http.ResponseWriter, req *http.Request, key string) {

151+func (p *OauthProxy) ClearCookie(rw http.ResponseWriter, req *http.Request) {

152 domain := strings.Split(req.Host, ":")[0]

153 if *cookieDomain != "" {

154 domain = *cookieDomain

155 }

156 cookie := &http.Cookie{

157− Name: key,

157+ Name: p.CookieKey,

158 Value: "",

159 Path: "/",

160 Domain: domain,

@@ -164,6 +164,25 @@ func ClearCookie(rw http.ResponseWriter, req *http.Request, key string) {

164 http.SetCookie(rw, cookie)

165}

166

167+func (p *OauthProxy) SetCookie(rw http.ResponseWriter, req *http.Request, val string) {

168+

169+ domain := strings.Split(req.Host, ":")[0] // strip the port (if any)

170+ if *cookieDomain != "" {

171+ domain = *cookieDomain

172+ }

173+ cookie := &http.Cookie{

174+ Name: p.CookieKey,

175+ Value: signedCookieValue(p.CookieSeed, p.CookieKey, val),

176+ Path: "/",

177+ Domain: domain,

178+ Expires: time.Now().Add(time.Duration(168) * time.Hour), // 7 days

179+ HttpOnly: true,

180+ // Secure: req. ... ? set if X-Scheme: https ?

181+ }

182+ http.SetCookie(rw, cookie)

183+}

184+

185+

167func (p *OauthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, message string) {

186func (p *OauthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, message string) {

168 log.Printf("ErrorPage %d %s %s", code, title, message)

187 log.Printf("ErrorPage %d %s %s", code, title, message)

169 rw.WriteHeader(code)

188 rw.WriteHeader(code)

@@ -180,6 +199,7 @@ func (p *OauthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, m

180

199

181func (p *OauthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code int) {

200func (p *OauthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code int) {

182 // TODO: capture state for which url to redirect to at the end

201 // TODO: capture state for which url to redirect to at the end

202+ p.ClearCookie(rw, req)

183 rw.WriteHeader(code)

203 rw.WriteHeader(code)

184 templates := getTemplates()

204 templates := getTemplates()

185 t := struct{ SignInMessage string }{SignInMessage: p.SignInMessage}

205 t := struct{ SignInMessage string }{SignInMessage: p.SignInMessage}

@@ -189,7 +209,6 @@ func (p *OauthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code

189func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {

209func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {

190 // check if this is a redirect back at the end of oauth

210 // check if this is a redirect back at the end of oauth

191 if req.URL.Path == signInPath {

211 if req.URL.Path == signInPath {

192− ClearCookie(rw, req, p.CookieKey)

193 p.SignInPage(rw, req, 200)

212 p.SignInPage(rw, req, 200)

194 return

213 return

195 }

214 }

@@ -232,21 +251,7 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {

232 // set cookie, or deny

251 // set cookie, or deny

233 if p.Validator(email) {

252 if p.Validator(email) {

234 log.Printf("authenticating %s completed", email)

253 log.Printf("authenticating %s completed", email)

235− domain := strings.Split(req.Host, ":")[0]

236− if *cookieDomain != "" {

237− domain = *cookieDomain

238− }

239−

240− cookie := &http.Cookie{

241− Name: p.CookieKey,

242− Value: signedCookieValue(p.CookieSeed, p.CookieKey, email),

243− Path: "/",

244− Domain: domain,

245− Expires: time.Now().Add(time.Duration(168) * time.Hour), // 7 days

246− HttpOnly: true,

247− // Secure: req. ... ? set if X-Scheme: https ?

248− }

249− http.SetCookie(rw, cookie)

254+ p.SetCookie(rw, req, email)

250 http.Redirect(rw, req, "/", 302)

255 http.Redirect(rw, req, "/", 302)

251 return

256 return

252 } else {

257 } else {

@@ -266,6 +271,9 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {

266

271

267 if !ok {

272 if !ok {

268 user, ok = p.CheckBasicAuth(req)

273 user, ok = p.CheckBasicAuth(req)

274+ if ok {

275+ p.SetCookie(rw, req, user)

276+ }

269 }

277 }

270

278

271 if !ok {

279 if !ok {