d1ef14b · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Move cookie to pkg/encryption

commitd1ef14becc300ee2ad65c07a032daf51dac2ca01 authorJoel Speed <Joel.speed@hotmail.co.uk> dateFri 24 May 2019, 17:06 (7 years ago) parent8027cc4

14 files changed+43−45

compare with master

unifiedsplit

oauthproxy.go+2−2 options.go+3−3 pkg/apis/options/sessions.go+2−4 pkg/apis/sessions/session_state.go+4−4 pkg/apis/sessions/session_state_test.go+7−7 cookie/cookies.go → pkg/encryption/cipher.go+1−1 cookie/cookies_test.go → pkg/encryption/cipher_test.go+1−1 cookie/nonce.go → pkg/encryption/nonce.go+1−1 pkg/sessions/cookie/session_store.go+4−4 pkg/sessions/redis/redis_store.go+6−6 pkg/sessions/session_store_test.go+3−3 pkg/sessions/utils/utils.go+3−3 providers/provider_default.go+3−3 providers/providers.go+3−3

oauthproxy.go+2−2

@@ -14,9 +14,9 @@ import (

1414 "time"

1515

1616 "github.com/mbland/hmacauth"

17− "github.com/pusher/oauth2_proxy/cookie"

1817 "github.com/pusher/oauth2_proxy/logger"

1918 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

19+ "github.com/pusher/oauth2_proxy/pkg/encryption"

2020 "github.com/pusher/oauth2_proxy/providers"

2121 "github.com/yhat/wsutil"

2222)

@@ -555,7 +555,7 @@ func (p *OAuthProxy) SignOut(rw http.ResponseWriter, req *http.Request) {

555555

556556// OAuthStart starts the OAuth2 authentication flow

557557func (p *OAuthProxy) OAuthStart(rw http.ResponseWriter, req *http.Request) {

558− nonce, err := cookie.Nonce()

558+ nonce, err := encryption.Nonce()

559559 if err != nil {

560560 logger.Printf("Error obtaining nonce: %s", err.Error())

561561 p.ErrorPage(rw, 500, "Internal Error", err.Error())

options.go+3−3

@@ -17,10 +17,10 @@ import (

1717 oidc "github.com/coreos/go-oidc"

1818 "github.com/dgrijalva/jwt-go"

1919 "github.com/mbland/hmacauth"

20− "github.com/pusher/oauth2_proxy/cookie"

2120 "github.com/pusher/oauth2_proxy/logger"

2221 "github.com/pusher/oauth2_proxy/pkg/apis/options"

2322 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

23+ "github.com/pusher/oauth2_proxy/pkg/encryption"

2424 "github.com/pusher/oauth2_proxy/pkg/sessions"

2525 "github.com/pusher/oauth2_proxy/providers"

2626 "gopkg.in/natefinch/lumberjack.v2"

@@ -268,7 +268,7 @@ func (o *Options) Validate() error {

268268 }

269269 msgs = parseProviderInfo(o, msgs)

270270

271− var cipher *cookie.Cipher

271+ var cipher *encryption.Cipher

272272 if o.PassAccessToken || o.SetAuthorization || o.PassAuthorization || (o.CookieRefresh != time.Duration(0)) {

273273 validCookieSecretSize := false

274274 for _, i := range []int{16, 24, 32} {

@@ -293,7 +293,7 @@ func (o *Options) Validate() error {

293293 len(secretBytes(o.CookieSecret)), suffix))

294294 } else {

295295 var err error

296− cipher, err = cookie.NewCipher(secretBytes(o.CookieSecret))

296+ cipher, err = encryption.NewCipher(secretBytes(o.CookieSecret))

297297 if err != nil {

298298 msgs = append(msgs, fmt.Sprintf("cookie-secret error: %v", err))

299299 }

pkg/apis/options/sessions.go+2−4

@@ -1,13 +1,11 @@

11package options

3−import (

4− "github.com/pusher/oauth2_proxy/cookie"

5−)

3+import "github.com/pusher/oauth2_proxy/pkg/encryption"

75// SessionOptions contains configuration options for the SessionStore providers.

86type SessionOptions struct {

97 Type string `flag:"session-store-type" cfg:"session_store_type" env:"OAUTH2_PROXY_SESSION_STORE_TYPE"`

10− Cipher *cookie.Cipher

8+ Cipher *encryption.Cipher

119 CookieStoreOptions

1210 RedisStoreOptions

1311}

pkg/apis/sessions/session_state.go+4−4

@@ -7,7 +7,7 @@ import (

77 "strings"

88 "time"

10− "github.com/pusher/oauth2_proxy/cookie"

10+ "github.com/pusher/oauth2_proxy/pkg/encryption"

1111)

1212

1313// SessionState is used to store information about the currently authenticated user session

@@ -66,7 +66,7 @@ func (s *SessionState) String() string {

6666}

6767

6868// EncodeSessionState returns string representation of the current session

69−func (s *SessionState) EncodeSessionState(c *cookie.Cipher) (string, error) {

69+func (s *SessionState) EncodeSessionState(c *encryption.Cipher) (string, error) {

7070 var ss SessionState

7171 if c == nil {

7272 // Store only Email and User when cipher is unavailable

@@ -133,7 +133,7 @@ func legacyDecodeSessionStatePlain(v string) (*SessionState, error) {

133133

134134// legacyDecodeSessionState attempts to decode the session state string

135135// generated by v3.1.0 or older

136−func legacyDecodeSessionState(v string, c *cookie.Cipher) (*SessionState, error) {

136+func legacyDecodeSessionState(v string, c *encryption.Cipher) (*SessionState, error) {

137137 chunks := strings.Split(v, "|")

138138

139139 if c == nil {

@@ -176,7 +176,7 @@ func legacyDecodeSessionState(v string, c *cookie.Cipher) (*SessionState, error)

176176}

177177

178178// DecodeSessionState decodes the session cookie string into a SessionState

179−func DecodeSessionState(v string, c *cookie.Cipher) (*SessionState, error) {

179+func DecodeSessionState(v string, c *encryption.Cipher) (*SessionState, error) {

180180 var ssj SessionStateJSON

181181 var ss *SessionState

182182 err := json.Unmarshal([]byte(v), &ssj)

pkg/apis/sessions/session_state_test.go+7−7

@@ -5,8 +5,8 @@ import (

55 "testing"

66 "time"

8− "github.com/pusher/oauth2_proxy/cookie"

98 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9+ "github.com/pusher/oauth2_proxy/pkg/encryption"

1010 "github.com/stretchr/testify/assert"

1111)

1212

@@ -14,9 +14,9 @@ const secret = "0123456789abcdefghijklmnopqrstuv"

1414const altSecret = "0000000000abcdefghijklmnopqrstuv"

1515

1616func TestSessionStateSerialization(t *testing.T) {

17− c, err := cookie.NewCipher([]byte(secret))

17+ c, err := encryption.NewCipher([]byte(secret))

1818 assert.Equal(t, nil, err)

19− c2, err := cookie.NewCipher([]byte(altSecret))

19+ c2, err := encryption.NewCipher([]byte(altSecret))

2020 assert.Equal(t, nil, err)

2121 s := &sessions.SessionState{

2222 Email: "user@domain.com",

@@ -54,9 +54,9 @@ func TestSessionStateSerialization(t *testing.T) {

5454}

5555

5656func TestSessionStateSerializationWithUser(t *testing.T) {

57− c, err := cookie.NewCipher([]byte(secret))

57+ c, err := encryption.NewCipher([]byte(secret))

5858 assert.Equal(t, nil, err)

59− c2, err := cookie.NewCipher([]byte(altSecret))

59+ c2, err := encryption.NewCipher([]byte(altSecret))

6060 assert.Equal(t, nil, err)

6161 s := &sessions.SessionState{

6262 User: "just-user",

@@ -146,7 +146,7 @@ func TestExpired(t *testing.T) {

146146type testCase struct {

147147 sessions.SessionState

148148 Encoded string

149− Cipher *cookie.Cipher

149+ Cipher *encryption.Cipher

150150 Error bool

151151}

152152

@@ -203,7 +203,7 @@ func TestDecodeSessionState(t *testing.T) {

203203 eString := string(eJSON)

204204 eUnix := e.Unix()

205205

206− c, err := cookie.NewCipher([]byte(secret))

206+ c, err := encryption.NewCipher([]byte(secret))

207207 assert.NoError(t, err)

208208

209209 testCases := []testCase{

cookie/cookies.go → pkg/encryption/cipher.gorenamed+1−1

@@ -1,4 +1,4 @@

1−package cookie

1+package encryption

33import (

44 "crypto/aes"

cookie/cookies_test.go → pkg/encryption/cipher_test.gorenamed+1−1

@@ -1,4 +1,4 @@

1−package cookie

1+package encryption

33import (

44 "encoding/base64"

cookie/nonce.go → pkg/encryption/nonce.gorenamed+1−1

@@ -1,4 +1,4 @@

1−package cookie

1+package encryption

33import (

44 "crypto/rand"

pkg/sessions/cookie/session_store.go+4−4

@@ -8,10 +8,10 @@ import (

88 "strings"

99 "time"

1010

11− "github.com/pusher/oauth2_proxy/cookie"

1211 "github.com/pusher/oauth2_proxy/pkg/apis/options"

1312 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1413 "github.com/pusher/oauth2_proxy/pkg/cookies"

14+ "github.com/pusher/oauth2_proxy/pkg/encryption"

1515 "github.com/pusher/oauth2_proxy/pkg/sessions/utils"

1616)

1717

@@ -28,7 +28,7 @@ var _ sessions.SessionStore = &SessionStore{}

2828// interface that stores sessions in client side cookies

2929type SessionStore struct {

3030 CookieOptions *options.CookieOptions

31− CookieCipher *cookie.Cipher

31+ CookieCipher *encryption.Cipher

3232}

3333

3434// Save takes a sessions.SessionState and stores the information from it

@@ -53,7 +53,7 @@ func (s *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {

5353 // always http.ErrNoCookie

5454 return nil, fmt.Errorf("Cookie %q not present", s.CookieOptions.CookieName)

5555 }

56− val, _, ok := cookie.Validate(c, s.CookieOptions.CookieSecret, s.CookieOptions.CookieExpire)

56+ val, _, ok := encryption.Validate(c, s.CookieOptions.CookieSecret, s.CookieOptions.CookieExpire)

5757 if !ok {

5858 return nil, errors.New("Cookie Signature not valid")

5959 }

@@ -96,7 +96,7 @@ func (s *SessionStore) setSessionCookie(rw http.ResponseWriter, req *http.Reques

9696// authentication details

9797func (s *SessionStore) makeSessionCookie(req *http.Request, value string, now time.Time) []*http.Cookie {

9898 if value != "" {

99− value = cookie.SignedValue(s.CookieOptions.CookieSecret, s.CookieOptions.CookieName, value, now)

99+ value = encryption.SignedValue(s.CookieOptions.CookieSecret, s.CookieOptions.CookieName, value, now)

100100 }

101101 c := s.makeCookie(req, s.CookieOptions.CookieName, value, s.CookieOptions.CookieExpire, now)

102102 if len(c.Value) > 4096-len(s.CookieOptions.CookieName) {

pkg/sessions/redis/redis_store.go+6−6

@@ -13,10 +13,10 @@ import (

1313 "time"

1414

1515 "github.com/go-redis/redis"

16− "github.com/pusher/oauth2_proxy/cookie"

1716 "github.com/pusher/oauth2_proxy/pkg/apis/options"

1817 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1918 "github.com/pusher/oauth2_proxy/pkg/cookies"

19+ "github.com/pusher/oauth2_proxy/pkg/encryption"

2020)

2121

2222// TicketData is a structure representing the ticket used in server session storage

@@ -28,7 +28,7 @@ type TicketData struct {

2828// SessionStore is an implementation of the sessions.SessionStore

2929// interface that stores sessions in redis

3030type SessionStore struct {

31− CookieCipher *cookie.Cipher

31+ CookieCipher *encryption.Cipher

3232 CookieOptions *options.CookieOptions

3333 Client *redis.Client

3434}

@@ -106,7 +106,7 @@ func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, erro

106106 return nil, fmt.Errorf("error loading session: %s", err)

107107 }

108108

109− val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

109+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

110110 if !ok {

111111 return nil, fmt.Errorf("Cookie Signature not valid")

112112 }

@@ -166,7 +166,7 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro

166166 return fmt.Errorf("error retrieving cookie: %v", err)

167167 }

168168

169− val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

169+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

170170 if !ok {

171171 return fmt.Errorf("Cookie Signature not valid")

172172 }

@@ -186,7 +186,7 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro

186186// makeCookie makes a cookie, signing the value if present

187187func (store *SessionStore) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) *http.Cookie {

188188 if value != "" {

189− value = cookie.SignedValue(store.CookieOptions.CookieSecret, store.CookieOptions.CookieName, value, now)

189+ value = encryption.SignedValue(store.CookieOptions.CookieSecret, store.CookieOptions.CookieName, value, now)

190190 }

191191 return cookies.MakeCookieFromOptions(

192192 req,

@@ -230,7 +230,7 @@ func (store *SessionStore) getTicket(requestCookie *http.Cookie) (*TicketData, e

230230 }

231231

232232 // An existing cookie exists, try to retrieve the ticket

233− val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

233+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

234234 if !ok {

235235 // Cookie is invalid, create a new ticket

236236 return newTicket()

pkg/sessions/session_store_test.go+3−3

@@ -13,10 +13,10 @@ import (

1313 "github.com/alicebob/miniredis"

1414 . "github.com/onsi/ginkgo"

1515 . "github.com/onsi/gomega"

16− "github.com/pusher/oauth2_proxy/cookie"

1716 "github.com/pusher/oauth2_proxy/pkg/apis/options"

1817 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

1918 "github.com/pusher/oauth2_proxy/pkg/cookies"

19+ "github.com/pusher/oauth2_proxy/pkg/encryption"

2020 "github.com/pusher/oauth2_proxy/pkg/sessions"

2121 sessionscookie "github.com/pusher/oauth2_proxy/pkg/sessions/cookie"

2222 "github.com/pusher/oauth2_proxy/pkg/sessions/redis"

@@ -158,7 +158,7 @@ var _ = Describe("NewSessionStore", func() {

158158 BeforeEach(func() {

159159 By("Using a valid cookie with a different providers session encoding")

160160 broken := "BrokenSessionFromADifferentSessionImplementation"

161− value := cookie.SignedValue(cookieOpts.CookieSecret, cookieOpts.CookieName, broken, time.Now())

161+ value := encryption.SignedValue(cookieOpts.CookieSecret, cookieOpts.CookieName, broken, time.Now())

162162 cookie := cookies.MakeCookieFromOptions(request, cookieOpts.CookieName, value, cookieOpts, cookieOpts.CookieExpire, time.Now())

163163 request.AddCookie(cookie)

164164

@@ -354,7 +354,7 @@ var _ = Describe("NewSessionStore", func() {

354354 _, err := rand.Read(secret)

355355 Expect(err).ToNot(HaveOccurred())

356356 cookieOpts.CookieSecret = base64.URLEncoding.EncodeToString(secret)

357− cipher, err := cookie.NewCipher(utils.SecretBytes(cookieOpts.CookieSecret))

357+ cipher, err := encryption.NewCipher(utils.SecretBytes(cookieOpts.CookieSecret))

358358 Expect(err).ToNot(HaveOccurred())

359359 Expect(cipher).ToNot(BeNil())

360360 opts.Cipher = cipher

pkg/sessions/utils/utils.go+3−3

@@ -3,17 +3,17 @@ package utils

33import (

44 "encoding/base64"

6− "github.com/pusher/oauth2_proxy/cookie"

76 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

7+ "github.com/pusher/oauth2_proxy/pkg/encryption"

88)

1010// CookieForSession serializes a session state for storage in a cookie

11−func CookieForSession(s *sessions.SessionState, c *cookie.Cipher) (string, error) {

11+func CookieForSession(s *sessions.SessionState, c *encryption.Cipher) (string, error) {

1212 return s.EncodeSessionState(c)

1313}

1414

1515// SessionFromCookie deserializes a session from a cookie value

16−func SessionFromCookie(v string, c *cookie.Cipher) (s *sessions.SessionState, err error) {

16+func SessionFromCookie(v string, c *encryption.Cipher) (s *sessions.SessionState, err error) {

1717 return sessions.DecodeSessionState(v, c)

1818}

1919

providers/provider_default.go+3−3

@@ -10,8 +10,8 @@ import (

1010 "net/url"

1111 "time"

1212

13− "github.com/pusher/oauth2_proxy/cookie"

1413 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

14+ "github.com/pusher/oauth2_proxy/pkg/encryption"

1515)

1616

1717// Redeem provides a default implementation of the OAuth2 token redemption process

@@ -96,12 +96,12 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {

9696}

9797

9898// CookieForSession serializes a session state for storage in a cookie

99−func (p *ProviderData) CookieForSession(s *sessions.SessionState, c *cookie.Cipher) (string, error) {

99+func (p *ProviderData) CookieForSession(s *sessions.SessionState, c *encryption.Cipher) (string, error) {

100100 return s.EncodeSessionState(c)

101101}

102102

103103// SessionFromCookie deserializes a session from a cookie value

104−func (p *ProviderData) SessionFromCookie(v string, c *cookie.Cipher) (s *sessions.SessionState, err error) {

104+func (p *ProviderData) SessionFromCookie(v string, c *encryption.Cipher) (s *sessions.SessionState, err error) {

105105 return sessions.DecodeSessionState(v, c)

106106}

107107

providers/providers.go+3−3

@@ -1,8 +1,8 @@

11package providers

33import (

4− "github.com/pusher/oauth2_proxy/cookie"

54 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

5+ "github.com/pusher/oauth2_proxy/pkg/encryption"

66)

88// Provider represents an upstream identity provider implementation

@@ -15,8 +15,8 @@ type Provider interface {

1515 ValidateSessionState(*sessions.SessionState) bool

1616 GetLoginURL(redirectURI, finalRedirect string) string

1717 RefreshSessionIfNeeded(*sessions.SessionState) (bool, error)

18− SessionFromCookie(string, *cookie.Cipher) (*sessions.SessionState, error)

19− CookieForSession(*sessions.SessionState, *cookie.Cipher) (string, error)

18+ SessionFromCookie(string, *encryption.Cipher) (*sessions.SessionState, error)

19+ CookieForSession(*sessions.SessionState, *encryption.Cipher) (string, error)

2020}

2121

2222// New provides a new Provider based on the configured provider string