go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-02-09 13:46:51 +02:00
Code Issues Releases Activity

Allow binary values in signed cookies

Browse Source 
Make signedValue & Validate operate on []byte
by default and not assume/cast string. Any casting
will be done from callers.
This commit is contained in:
Nick Meves 2020-05-04 11:34:01 -07:00
parent f9025a8f8f
commit b4530b9292
No known key found for this signature in database
GPG Key ID: 93BA8A3CEDCDD1CF
4 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/encryption/cipher.go
View File

@ -39,7 +39,7 @@ func SecretBytes(secret string) []byte {
// additionally, the 'value' is encrypted so it's opaque to the browser // additionally, the 'value' is encrypted so it's opaque to the browser
// Validate ensures a cookie is properly signed // Validate ensures a cookie is properly signed
func Validate(cookie *http.Cookie, seed string, expiration time.Duration) (value string, t time.Time, ok bool) { func Validate(cookie *http.Cookie, seed string, expiration time.Duration) (value []byte, t time.Time, ok bool) {
// value, timestamp, sig // value, timestamp, sig
parts := strings.Split(cookie.Value, "|") parts := strings.Split(cookie.Value, "|")
if len(parts) != 3 { if len(parts) != 3 {
@ -59,7 +59,7 @@ func Validate(cookie *http.Cookie, seed string, expiration time.Duration) (value
// it's a valid cookie. now get the contents // it's a valid cookie. now get the contents
rawValue, err := base64.URLEncoding.DecodeString(parts[0]) rawValue, err := base64.URLEncoding.DecodeString(parts[0])
if err == nil { if err == nil {
value = string(rawValue) value = rawValue
ok = true ok = true
return return
} }
@ -69,8 +69,8 @@ func Validate(cookie *http.Cookie, seed string, expiration time.Duration) (value
} }
// SignedValue returns a cookie that is signed and can later be checked with Validate // SignedValue returns a cookie that is signed and can later be checked with Validate
func SignedValue(seed string, key string, value string, now time.Time) string { func SignedValue(seed string, key string, value []byte, now time.Time) string {
encodedValue := base64.URLEncoding.EncodeToString([]byte(value)) encodedValue := base64.URLEncoding.EncodeToString(value)
timeStr := fmt.Sprintf("%d", now.Unix()) timeStr := fmt.Sprintf("%d", now.Unix())
sig := cookieSignature(sha256.New, seed, key, encodedValue, timeStr) sig := cookieSignature(sha256.New, seed, key, encodedValue, timeStr)
cookieVal := fmt.Sprintf("%s|%s|%s", encodedValue, timeStr, sig) cookieVal := fmt.Sprintf("%s|%s|%s", encodedValue, timeStr, sig)

4
pkg/sessions/cookie/session_store.go
View File

@ -59,7 +59,7 @@ func (s *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {
return nil, errors.New("cookie signature not valid") return nil, errors.New("cookie signature not valid")
} }
session, err := sessionFromCookie(val, s.CookieCipher) session, err := sessionFromCookie(string(val), s.CookieCipher)
if err != nil { if err != nil {
return nil, err return nil, err
} }
@ -104,7 +104,7 @@ func (s *SessionStore) setSessionCookie(rw http.ResponseWriter, req *http.Reques
// authentication details // authentication details
func (s *SessionStore) makeSessionCookie(req *http.Request, value string, now time.Time) []*http.Cookie { func (s *SessionStore) makeSessionCookie(req *http.Request, value string, now time.Time) []*http.Cookie {
if value != "" { if value != "" {
value = encryption.SignedValue(s.CookieOptions.Secret, s.CookieOptions.Name, value, now) value = encryption.SignedValue(s.CookieOptions.Secret, s.CookieOptions.Name, []byte(value), now)
} }
c := s.makeCookie(req, s.CookieOptions.Name, value, s.CookieOptions.Expire, now) c := s.makeCookie(req, s.CookieOptions.Name, value, s.CookieOptions.Expire, now)
if len(c.Value) > 4096-len(s.CookieOptions.Name) { if len(c.Value) > 4096-len(s.CookieOptions.Name) {

8
pkg/sessions/redis/redis_store.go
View File

@ -175,7 +175,7 @@ func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, erro
return nil, fmt.Errorf("cookie signature not valid") return nil, fmt.Errorf("cookie signature not valid")
} }
ctx := req.Context() ctx := req.Context()
session, err := store.loadSessionFromString(ctx, val) session, err := store.loadSessionFromString(ctx, string(val))
if err != nil { if err != nil {
return nil, fmt.Errorf("error loading session: %s", err) return nil, fmt.Errorf("error loading session: %s", err)
} }
@ -237,7 +237,7 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
// We only return an error if we had an issue with redis // We only return an error if we had an issue with redis
// If there's an issue decoding the ticket, ignore it // If there's an issue decoding the ticket, ignore it
ticket, _ := decodeTicket(store.CookieOptions.Name, val) ticket, _ := decodeTicket(store.CookieOptions.Name, string(val))
if ticket != nil { if ticket != nil {
ctx := req.Context() ctx := req.Context()
err := store.Client.Del(ctx, ticket.asHandle(store.CookieOptions.Name)) err := store.Client.Del(ctx, ticket.asHandle(store.CookieOptions.Name))
@ -251,7 +251,7 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
// makeCookie makes a cookie, signing the value if present // makeCookie makes a cookie, signing the value if present
func (store *SessionStore) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) *http.Cookie { func (store *SessionStore) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) *http.Cookie {
if value != "" { if value != "" {
value = encryption.SignedValue(store.CookieOptions.Secret, store.CookieOptions.Name, value, now) value = encryption.SignedValue(store.CookieOptions.Secret, store.CookieOptions.Name, []byte(value), now)
} }
return cookies.MakeCookieFromOptions( return cookies.MakeCookieFromOptions(
req, req,
@ -302,7 +302,7 @@ func (store *SessionStore) getTicket(requestCookie *http.Cookie) (*TicketData, e
} }
// Valid cookie, decode the ticket // Valid cookie, decode the ticket
ticket, err := decodeTicket(store.CookieOptions.Name, val) ticket, err := decodeTicket(store.CookieOptions.Name, string(val))
if err != nil { if err != nil {
// If we can't decode the ticket we have to create a new one // If we can't decode the ticket we have to create a new one
return newTicket() return newTicket()

2
pkg/sessions/session_store_test.go
View File

@ -170,7 +170,7 @@ var _ = Describe("NewSessionStore", func() {
BeforeEach(func() { BeforeEach(func() {
By("Using a valid cookie with a different providers session encoding") By("Using a valid cookie with a different providers session encoding")
broken := "BrokenSessionFromADifferentSessionImplementation" broken := "BrokenSessionFromADifferentSessionImplementation"
value := encryption.SignedValue(cookieOpts.Secret, cookieOpts.Name, broken, time.Now()) value := encryption.SignedValue(cookieOpts.Secret, cookieOpts.Name, []byte(broken), time.Now())
cookie := cookiesapi.MakeCookieFromOptions(request, cookieOpts.Name, value, cookieOpts, cookieOpts.Expire, time.Now()) cookie := cookiesapi.MakeCookieFromOptions(request, cookieOpts.Name, value, cookieOpts, cookieOpts.Expire, time.Now())
request.AddCookie(cookie) request.AddCookie(cookie)