go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-08-08 22:46:33 +02:00
Code Issues Releases Activity

Add option to remove tokens from cookie sessions (#673)

Browse Source 
* Add option to remove tokens from cookie sessions

* Move Minimal to be an option on CookieSession

* Add sessionOptionsDefaults helper
This commit is contained in:
Nick Meves
2020-07-14 15:02:10 -07:00
committed by GitHub
parent a09eecc6a2
commit bb5977095f
8 changed files with 199 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
pkg/sessions/cookie/session_store.go
View File

@ -30,6 +30,7 @@ var _ sessions.SessionStore = &SessionStore{}
type SessionStore struct {
Cookie *options.Cookie
CookieCipher encryption.Cipher
Minimal bool
}
// Save takes a sessions.SessionState and stores the information from it
@ -39,7 +40,7 @@ func (s *SessionStore) Save(rw http.ResponseWriter, req *http.Request, ss *sessi
now := time.Now()
ss.CreatedAt = &now
}
value, err := cookieForSession(ss, s.CookieCipher)
value, err := s.cookieForSession(ss)
if err != nil {
return err
}
@ -85,8 +86,17 @@ func (s *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) error {
}
// cookieForSession serializes a session state for storage in a cookie
func cookieForSession(s *sessions.SessionState, c encryption.Cipher) ([]byte, error) {
return s.EncodeSessionState(c, true)
func (s *SessionStore) cookieForSession(ss *sessions.SessionState) ([]byte, error) {
if s.Minimal && (ss.AccessToken != "" || ss.IDToken != "" || ss.RefreshToken != "") {
minimal := *ss
minimal.AccessToken = ""
minimal.IDToken = ""
minimal.RefreshToken = ""
return minimal.EncodeSessionState(s.CookieCipher, true)
}
return ss.EncodeSessionState(s.CookieCipher, true)
}
// sessionFromCookie deserializes a session from a cookie value
@ -146,6 +156,7 @@ func NewCookieSessionStore(opts *options.SessionOptions, cookieOpts *options.Coo
return &SessionStore{
CookieCipher: cipher,
Cookie: cookieOpts,
Minimal: opts.Cookie.Minimal,
}, nil
}