forked from oauth2-proxy/oauth2-proxy
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
6 changed files
with
225 additions
and
0 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,145 @@ | ||
| package cookie | ||
|
|
||
| import ( | ||
| "crypto/aes" | ||
| "crypto/cipher" | ||
| "crypto/rand" | ||
| "crypto/sha1" | ||
| "encoding/base64" | ||
| "encoding/hex" | ||
| "fmt" | ||
| "github.com/go-redis/redis" | ||
| "io" | ||
| "net/http" | ||
| "strings" | ||
| "time" | ||
| ) | ||
|
|
||
| // ServerCookiesStore is the interface to storing cookies. | ||
| // It takes in cookies | ||
| type ServerCookiesStore interface { | ||
| Store(responseCookie *http.Cookie, requestCookie *http.Cookie) (string, error) | ||
| Clear(requestCookie *http.Cookie) error | ||
| Load(requestCookie *http.Cookie) (string, error) | ||
| } | ||
|
|
||
| type RedisCookieStore struct { | ||
| Client *redis.Client | ||
| Block cipher.Block | ||
| Prefix string | ||
| } | ||
|
|
||
| func NewRedisCookieStore(url string, cookieName string, block cipher.Block) (*RedisCookieStore, error) { | ||
| opt, err := redis.ParseURL(url) | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| client := redis.NewClient(opt) | ||
|
|
||
| rs := &RedisCookieStore{ | ||
| Client: client, | ||
| Prefix: cookieName, | ||
| Block: block, | ||
| } | ||
| // Create client as usually. | ||
| return rs, nil | ||
| } | ||
|
|
||
| // Store stores the cookie locally and returns a new response cookie value to be | ||
| // sent back to the client. That value is used to lookup the cookie later. | ||
| func (store *RedisCookieStore) Store(responseCookie *http.Cookie, requestCookie *http.Cookie) (string, error) { | ||
| var cookieHandle string | ||
| var iv []byte | ||
| if requestCookie != nil { | ||
| var err error | ||
| cookieHandle, iv, err = parseCookieTicket(store.Prefix, requestCookie.Value) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| } else { | ||
| hasher := sha1.New() | ||
| hasher.Write([]byte(responseCookie.Value)) | ||
| cookieId := fmt.Sprintf("%x", hasher.Sum(nil)) | ||
| iv = make([]byte, aes.BlockSize) | ||
| if _, err := io.ReadFull(rand.Reader, iv); err != nil { | ||
| return "", fmt.Errorf("failed to create initialization vector %s", err) | ||
| } | ||
| cookieHandle = fmt.Sprintf("%s-%s", store.Prefix, cookieId) | ||
| } | ||
|
|
||
| ciphertext := make([]byte, len(responseCookie.Value)) | ||
| stream := cipher.NewCFBEncrypter(store.Block, iv) | ||
| stream.XORKeyStream(ciphertext, []byte(responseCookie.Value)) | ||
|
|
||
| expires := responseCookie.Expires.Sub(time.Now()) | ||
| err := store.Client.Set(cookieHandle, ciphertext, expires).Err() | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| cookieTicket := cookieHandle + "." + base64.RawURLEncoding.EncodeToString(iv) | ||
| return cookieTicket, nil | ||
| } | ||
|
|
||
| // Clear takes in the client cookie from the request and uses it to | ||
| // clear any lingering server cookies, when possible. | ||
| func (store *RedisCookieStore) Clear(requestCookie *http.Cookie) error { | ||
| var err error | ||
| cookieHandle, _, err := parseCookieTicket(store.Prefix, requestCookie.Value) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| err = store.Client.Del(cookieHandle).Err() | ||
| if err != nil { | ||
| return err | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // Load takes in the client cookie from the request and uses it to lookup | ||
| // the stored value. | ||
| func (store *RedisCookieStore) Load(requestCookie *http.Cookie) (string, error) { | ||
| cookieHandle, iv, err := parseCookieTicket(store.Prefix, requestCookie.Value) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| result, err := store.Client.Get(cookieHandle).Result() | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| resultBytes := []byte(result) | ||
|
|
||
| stream := cipher.NewCFBDecrypter(store.Block, iv) | ||
| stream.XORKeyStream(resultBytes, resultBytes) | ||
| return string(resultBytes), nil | ||
| } | ||
|
|
||
| func parseCookieTicket(expectedPrefix string, ticket string) (string, []byte, error) { | ||
| cookieParts := strings.Split(ticket, ".") | ||
| if len(cookieParts) != 2 { | ||
| return "", nil, fmt.Errorf("failed to decode cookie") | ||
| } | ||
| cookieHandle, ivBase64 := cookieParts[0], cookieParts[1] | ||
| handleParts := strings.Split(cookieHandle, "-") | ||
| if len(handleParts) != 2 { | ||
| return "", nil, fmt.Errorf("failed to decode cookie handle") | ||
| } | ||
| prefix, cookieId := handleParts[0], handleParts[1] | ||
|
|
||
| // cookieId must be a hexadecimal string | ||
| _, err := hex.DecodeString(cookieId) | ||
| if err != nil || expectedPrefix != prefix { | ||
| return "", nil, fmt.Errorf("server cookie failed sanity checks") | ||
| // s is not a valid | ||
| } | ||
|
|
||
| iv, err := base64.RawURLEncoding.DecodeString(ivBase64) | ||
| if err != nil { | ||
| return "", nil, fmt.Errorf("failed to decode initialization vector %s", err) | ||
| } | ||
| return cookieHandle, iv, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters