mirror of
https://github.com/volatiletech/authboss.git
synced 2025-01-24 05:17:10 +02:00
ca066a55b5
In order to prevent leaking of session values (and to avoid the mess of deleting the entire session cookie which could still have values we want in it) this nuclear method is now called by expire/logout with a whitelist of keys to keep (passed in from Config.Storage.SessionWhitelistKeys).
63 lines
1.6 KiB
Go
63 lines
1.6 KiB
Go
// Package logout allows users to log out (from auth or oauth2 logins)
|
|
package logout
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/pkg/errors"
|
|
"github.com/volatiletech/authboss"
|
|
)
|
|
|
|
func init() {
|
|
authboss.RegisterModule("logout", &Logout{})
|
|
}
|
|
|
|
// Logout module
|
|
type Logout struct {
|
|
*authboss.Authboss
|
|
}
|
|
|
|
// Init the module
|
|
func (l *Logout) Init(ab *authboss.Authboss) error {
|
|
l.Authboss = ab
|
|
|
|
var logoutRouteMethod func(string, http.Handler)
|
|
switch l.Authboss.Config.Modules.LogoutMethod {
|
|
case "GET":
|
|
logoutRouteMethod = l.Authboss.Config.Core.Router.Get
|
|
case "POST":
|
|
logoutRouteMethod = l.Authboss.Config.Core.Router.Post
|
|
case "DELETE":
|
|
logoutRouteMethod = l.Authboss.Config.Core.Router.Delete
|
|
default:
|
|
return errors.Errorf("logout wants to register a logout route but was given an invalid method: %s", l.Authboss.Config.Modules.LogoutMethod)
|
|
}
|
|
|
|
logoutRouteMethod("/logout", l.Authboss.Core.ErrorHandler.Wrap(l.Logout))
|
|
|
|
return nil
|
|
}
|
|
|
|
// Logout the user
|
|
func (l *Logout) Logout(w http.ResponseWriter, r *http.Request) error {
|
|
logger := l.RequestLogger(r)
|
|
|
|
user, err := l.CurrentUser(r)
|
|
if err == nil && user != nil {
|
|
logger.Infof("user %s logged out", user.GetPID())
|
|
} else {
|
|
logger.Info("user (unknown) logged out")
|
|
}
|
|
|
|
authboss.DelAllSession(w, l.Config.Storage.SessionStateWhitelistKeys)
|
|
authboss.DelKnownSession(w)
|
|
authboss.DelKnownCookie(w)
|
|
|
|
ro := authboss.RedirectOptions{
|
|
Code: http.StatusTemporaryRedirect,
|
|
RedirectPath: l.Authboss.Paths.LogoutOK,
|
|
Success: "You have been logged out",
|
|
}
|
|
return l.Authboss.Core.Redirector.Redirect(w, r, ro)
|
|
}
|