rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make secure cookie configurable

Browse Source 
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2025-11-04 17:09:51 +01:00
parent 549775fd71
commit fee5a9232e
20 changed files with 94 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/server/auth/accept_invitation_handler.go
View File

@@ -19,11 +19,11 @@ import (
"fmt"
"net/http"
"go.gearno.de/kit/httpserver"
authsvc "go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/authz"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/server/session"
"go.gearno.de/kit/httpserver"
)
type (
@@ -36,13 +36,14 @@ type (
}
)
func AcceptInvitationHandler(authSvc *authsvc.Service, authzSvc *authz.Service, cookieName string, cookieSecret string) http.HandlerFunc {
func AcceptInvitationHandler(authSvc *authsvc.Service, authzSvc *authz.Service, cookieName string, cookieSecret string, cookieSecure bool) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
sessionAuthCfg := session.AuthConfig{
CookieName: cookieName,
CookieSecret: cookieSecret,
CookieSecure: cookieSecure,
}
errorHandler := session.ErrorHandler{

29
pkg/server/auth/auth.go
View File

@@ -33,6 +33,7 @@ type Config struct {
CookieDomain string
SessionDuration time.Duration
CookieSecret string
CookieSecure bool
FileManager *filemanager.Service
Logger *log.Logger
}
@@ -44,26 +45,26 @@ type Server struct {
func NewServer(cfg Config) (*Server, error) {
router := chi.NewRouter()
router.Post("/register", SignUpHandler(cfg.Auth, cfg.CookieName, cfg.CookieSecret))
router.Post("/login", SignInHandler(cfg.Auth, cfg.CookieName, cfg.CookieSecret))
router.Delete("/logout", SignOutHandler(cfg.Auth, cfg.CookieName, cfg.CookieSecret))
router.Post("/signup-from-invitation", SignupFromInvitationHandler(cfg.Auth, cfg.CookieName, cfg.CookieSecret))
router.Post("/register", SignUpHandler(cfg.Auth, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure))
router.Post("/login", SignInHandler(cfg.Auth, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure))
router.Delete("/logout", SignOutHandler(cfg.Auth, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure))
router.Post("/signup-from-invitation", SignupFromInvitationHandler(cfg.Auth, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure))
router.Post("/forget-password", ForgetPasswordHandler(cfg.Auth))
router.Post("/reset-password", ResetPasswordHandler(cfg.Auth))
router.Post("/check-sso", SAMLCheckSSOHandler(cfg.Auth, cfg.Logger))
router.Get("/organizations", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, ListOrganizationsHandler(cfg.Auth, cfg.Authz)))
router.Get("/organizations/{organizationID}/logo", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, OrganizationLogoHandler(cfg.Auth, cfg.FileManager)))
router.Get("/invitations", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, ListInvitationsHandler(cfg.Authz)))
router.Post("/invitations/accept", AcceptInvitationHandler(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret))
router.Get("/organizations", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure, ListOrganizationsHandler(cfg.Auth, cfg.Authz)))
router.Get("/organizations/{organizationID}/logo", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure, OrganizationLogoHandler(cfg.Auth, cfg.FileManager)))
router.Get("/invitations", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure, ListInvitationsHandler(cfg.Authz)))
router.Post("/invitations/accept", AcceptInvitationHandler(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure))
router.Get("/api-keys", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, ListUserAPIKeysHandler(cfg.Auth, cfg.Authz)))
router.Post("/api-keys", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, CreateUserAPIKeyHandler(cfg.Auth)))
router.Get("/api-keys/{id}", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, GetUserAPIKeyHandler(cfg.Auth)))
router.Put("/api-keys", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, UpdateUserAPIKeyHandler(cfg.Auth)))
router.Delete("/api-keys", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, DeleteUserAPIKeyHandler(cfg.Auth)))
router.Get("/api-keys", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure, ListUserAPIKeysHandler(cfg.Auth, cfg.Authz)))
router.Post("/api-keys", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure, CreateUserAPIKeyHandler(cfg.Auth)))
router.Get("/api-keys/{id}", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure, GetUserAPIKeyHandler(cfg.Auth)))
router.Put("/api-keys", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure, UpdateUserAPIKeyHandler(cfg.Auth)))
router.Delete("/api-keys", RequireAuth(cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure, DeleteUserAPIKeyHandler(cfg.Auth)))
router.Get("/saml/login/{samlConfigID}", SAMLLoginHandler(cfg.SAML, cfg.Auth, cfg.Logger))
router.Post("/saml/consume", SAMLACSHandler(cfg.SAML, cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, cfg.SessionDuration, cfg.Logger))
router.Post("/saml/consume", SAMLACSHandler(cfg.SAML, cfg.Auth, cfg.Authz, cfg.CookieName, cfg.CookieSecret, cfg.CookieSecure, cfg.SessionDuration, cfg.Logger))
router.Get("/saml/metadata", SAMLMetadataHandler(cfg.SAML))
return &Server{

4
pkg/server/auth/auth_middleware.go
View File

@@ -19,11 +19,11 @@ import (
"fmt"
"net/http"
"go.gearno.de/kit/httpserver"
authsvc "go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/authz"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/server/session"
"go.gearno.de/kit/httpserver"
)
type ctxKey struct{ name string }
@@ -38,6 +38,7 @@ func RequireAuth(
authzSvc *authz.Service,
cookieName string,
cookieSecret string,
cookieSecure bool,
next http.HandlerFunc,
) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
@@ -46,6 +47,7 @@ func RequireAuth(
sessionAuthCfg := session.AuthConfig{
CookieName: cookieName,
CookieSecret: cookieSecret,
CookieSecure: cookieSecure,
}
errorHandler := session.ErrorHandler{

10
pkg/server/auth/saml_acs_handler.go
View File

@@ -20,20 +20,21 @@ import (
"net/http"
"time"
"go.gearno.de/kit/log"
authsvc "go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/authz"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/securecookie"
"go.gearno.de/kit/log"
)
func getSessionIDFromCookie(r *http.Request, cookieName string, cookieSecret string) (gid.GID, error) {
func getSessionIDFromCookie(r *http.Request, cookieName string, cookieSecret string, cookieSecure bool) (gid.GID, error) {
cookieValue, err := securecookie.Get(
r,
securecookie.DefaultConfig(
cookieName,
cookieSecret,
cookieSecure,
),
)
if err != nil {
@@ -43,7 +44,7 @@ func getSessionIDFromCookie(r *http.Request, cookieName string, cookieSecret str
return gid.ParseGID(cookieValue)
}
func SAMLACSHandler(samlSvc *authsvc.SAMLService, authSvc *authsvc.Service, authzSvc *authz.Service, cookieName string, cookieSecret string, sessionDuration time.Duration, logger *log.Logger) http.HandlerFunc {
func SAMLACSHandler(samlSvc *authsvc.SAMLService, authSvc *authsvc.Service, authzSvc *authz.Service, cookieName string, cookieSecret string, cookieSecure bool, sessionDuration time.Duration, logger *log.Logger) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
@@ -73,7 +74,7 @@ func SAMLACSHandler(samlSvc *authsvc.SAMLService, authSvc *authsvc.Service, auth
}
var existingSession *coredata.Session
if existingSessionID, err := getSessionIDFromCookie(r, cookieName, cookieSecret); err == nil {
if existingSessionID, err := getSessionIDFromCookie(r, cookieName, cookieSecret, cookieSecure); err == nil {
if session, err := authSvc.GetSession(ctx, existingSessionID); err == nil {
existingSession = session
}
@@ -114,6 +115,7 @@ func SAMLACSHandler(samlSvc *authsvc.SAMLService, authSvc *authsvc.Service, auth
securecookie.DefaultConfig(
cookieName,
cookieSecret,
cookieSecure,
),
session.ID.String(),
)

7
pkg/server/auth/sign_in_handler.go
View File

@@ -21,11 +21,11 @@ import (
"net/http"
"time"
"go.gearno.de/kit/httpserver"
authsvc "go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/securecookie"
"go.gearno.de/kit/httpserver"
)
type (
@@ -47,7 +47,7 @@ type (
}
)
func SignInHandler(authSvc *authsvc.Service, cookieName string, cookieSecret string) http.HandlerFunc {
func SignInHandler(authSvc *authsvc.Service, cookieName string, cookieSecret string, cookieSecure bool) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
var req SignInRequest
@@ -57,7 +57,7 @@ func SignInHandler(authSvc *authsvc.Service, cookieName string, cookieSecret str
}
var existingSession *coredata.Session
if existingSessionID, err := getSessionIDFromCookie(r, cookieName, cookieSecret); err == nil {
if existingSessionID, err := getSessionIDFromCookie(r, cookieName, cookieSecret, cookieSecure); err == nil {
if session, err := authSvc.GetSession(r.Context(), existingSessionID); err == nil {
existingSession = session
}
@@ -79,6 +79,7 @@ func SignInHandler(authSvc *authsvc.Service, cookieName string, cookieSecret str
securecookie.DefaultConfig(
cookieName,
cookieSecret,
cookieSecure,
),
session.ID.String(),
)

8
pkg/server/auth/sign_out_handler.go
View File

@@ -18,18 +18,19 @@ import (
"fmt"
"net/http"
"go.gearno.de/kit/httpserver"
authsvc "go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/securecookie"
authsvc "go.probo.inc/probo/pkg/auth"
"go.gearno.de/kit/httpserver"
)
func SignOutHandler(authSvc *authsvc.Service, cookieName string, cookieSecret string) http.HandlerFunc {
func SignOutHandler(authSvc *authsvc.Service, cookieName string, cookieSecret string, cookieSecure bool) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
sessionID, err := securecookie.Get(r, securecookie.DefaultConfig(
cookieName,
cookieSecret,
cookieSecure,
))
if err != nil {
httpserver.RenderError(w, http.StatusBadRequest, err)
@@ -50,6 +51,7 @@ func SignOutHandler(authSvc *authsvc.Service, cookieName string, cookieSecret st
securecookie.Clear(w, securecookie.DefaultConfig(
cookieName,
cookieSecret,
cookieSecure,
))
w.Header().Set("Clear-Site-Data", "*")

5
pkg/server/auth/sign_up_handler.go
View File

@@ -20,9 +20,9 @@ import (
"fmt"
"net/http"
"go.gearno.de/kit/httpserver"
authsvc "go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/securecookie"
"go.gearno.de/kit/httpserver"
)
type (
@@ -37,7 +37,7 @@ type (
}
)
func SignUpHandler(authSvc *authsvc.Service, cookieName string, cookieSecret string) http.HandlerFunc {
func SignUpHandler(authSvc *authsvc.Service, cookieName string, cookieSecret string, cookieSecure bool) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
var req SignUpRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
@@ -72,6 +72,7 @@ func SignUpHandler(authSvc *authsvc.Service, cookieName string, cookieSecret str
securecookie.DefaultConfig(
cookieName,
cookieSecret,
cookieSecure,
),
session.ID.String(),
)

5
pkg/server/auth/signup_from_invitation_handler.go
View File

@@ -19,9 +19,9 @@ import (
"fmt"
"net/http"
"go.gearno.de/kit/httpserver"
authsvc "go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/securecookie"
"go.gearno.de/kit/httpserver"
)
type (
@@ -35,7 +35,7 @@ type (
}
)
func SignupFromInvitationHandler(authSvc *authsvc.Service, cookieName string, cookieSecret string) http.HandlerFunc {
func SignupFromInvitationHandler(authSvc *authsvc.Service, cookieName string, cookieSecret string, cookieSecure bool) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
var req SignupFromInvitationRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
@@ -54,6 +54,7 @@ func SignupFromInvitationHandler(authSvc *authsvc.Service, cookieName string, co
securecookie.DefaultConfig(
cookieName,
cookieSecret,
cookieSecure,
),
session.ID.String(),
)