go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-06-15 00:15:00 +02:00
Code Issues Releases Activity

Let authentication fail when session validation fails (fixes #1396) (#1433)

Browse Source 
* Error page for session validation failure

* Fix existing tests

* Add test-case for session validation failure

* Simplify test

* Add changelog entry for PR

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>
This commit is contained in:
Stephan Aßmus
2021-11-12 19:36:29 +01:00
committed by GitHub
parent 9caf8c7040
commit 2c668a52d4
3 changed files with 33 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
oauthproxy.go
View File

@ -755,7 +755,11 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
}
csrf.SetSessionNonce(session)
p.provider.ValidateSession(req.Context(), session)
if !p.provider.ValidateSession(req.Context(), session) {
logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Session validation failed: %s", session)
p.ErrorPage(rw, req, http.StatusForbidden, "Session validation failed")
return
}
if !p.redirectValidator.IsValidRedirect(appRedirect) {
appRedirect = "/"