devstack/authorizer
4
0
Fork 0
Code Pull Requests Actions Activity

Fix/cookie host (#76)

Browse Source 
* fix: cookie host

* feat: add test for url utils

* fix: url test

* fix: multi domain cookie if allowed
This commit is contained in:
Lakhan Samani 2021-12-11 06:41:35 +05:30 committed by GitHub
parent 74a551ae09
commit 00565c8717
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 41 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -5,3 +5,5 @@ cmd:
cd server && go build -ldflags "-w -X main.Version=$(VERSION)" -o '../build/server'
clean:
rm -rf build
test:
cd server && go test ./...

2
server/handlers/oauthCallback.go
View File

@ -40,7 +40,7 @@ func processGoogleUserInfo(code string) (db.User, error) {
// Parse and verify ID Token payload.
idToken, err := verifier.Verify(ctx, rawIDToken)
if err != nil {
return user, fmt.Errorf("unable to verify id_token:", err.Error())
return user, fmt.Errorf("unable to verify id_token: %s", err.Error())
}
// Extract custom claims

12
server/utils/cookie.go
View File

@ -11,9 +11,14 @@ func SetCookie(gc *gin.Context, token string) {
secure := true
httpOnly := true
host := GetHostName(constants.AUTHORIZER_URL)
domain := GetDomainName(constants.AUTHORIZER_URL)
if domain != "localhost" {
domain = "." + domain
}
gc.SetSameSite(http.SameSiteNoneMode)
gc.SetCookie(constants.COOKIE_NAME, token, 3600, "/", host, secure, httpOnly)
gc.SetCookie(constants.COOKIE_NAME+"-client", token, 3600, "/", domain, secure, httpOnly)
}
func GetCookie(gc *gin.Context) (string, error) {
@ -29,8 +34,13 @@ func DeleteCookie(gc *gin.Context) {
secure := true
httpOnly := true
host := GetHostName(constants.AUTHORIZER_URL)
host := GetDomainName(constants.AUTHORIZER_URL)
domain := GetDomainName(constants.AUTHORIZER_URL)
if domain != "localhost" {
domain = "." + domain
}
gc.SetSameSite(http.SameSiteNoneMode)
gc.SetCookie(constants.COOKIE_NAME, "", -1, "/", host, secure, httpOnly)
gc.SetCookie(constants.COOKIE_NAME+"-client", "", -1, "/", domain, secure, httpOnly)
}

2
server/utils/urls.go
View File

@ -17,7 +17,7 @@ func GetHostName(auth_url string) string {
return host
}
// function to get domain name
// GetDomainName function to get domain name
func GetDomainName(auth_url string) string {
u, err := url.Parse(auth_url)
if err != nil {

25
server/utils/urls_test.go Normal file
View File

@ -0,0 +1,25 @@
package utils
import "testing"
func TestGetHostName(t *testing.T) {
authorizer_url := "http://test.herokuapp.com"
got := GetHostName(authorizer_url)
want := "test.herokuapp.com"
if got != want {
t.Errorf("GetHostName Test failed got %s, wanted %s", got, want)
}
}
func TestGetDomainName(t *testing.T) {
authorizer_url := "http://test.herokuapp.com"
got := GetDomainName(authorizer_url)
want := "herokuapp.com"
if got != want {
t.Errorf("GetHostName Test failed got %q, wanted %q", got, want)
}
}