github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-05-08 17:37:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(handler): validate acr if configured, change auth status if invalid

Browse Source
This commit is contained in:
Trong Huu Nguyen
2023-05-12 08:45:18 +02:00
parent 390cd78e9f
commit 97f0d078bf
4 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/handler/acr/acr.go
View File

@@ -21,7 +21,7 @@ func (h *Handler) Validate(sess *session.Session) error {
func NewHandler(cfg *config.Config) *Handler {
return &Handler{
Enabled: len(cfg.OpenID.ACRValues) > 0 && cfg.AutoLogin,
Enabled: len(cfg.OpenID.ACRValues) > 0,
ExpectedValue: cfg.OpenID.ACRValues,
}
}

4
pkg/handler/autologin/autologin.go
View File

@@ -21,8 +21,8 @@ type AutoLogin struct {
cache sync.Map
}
func (a *AutoLogin) NeedsLogin(r *http.Request, isAuthenticated, isAcrValid bool) bool {
if (isAuthenticated && isAcrValid) || !a.Enabled || r.Method != http.MethodGet {
func (a *AutoLogin) NeedsLogin(r *http.Request, isAuthenticated bool) bool {
if isAuthenticated || !a.Enabled || r.Method != http.MethodGet {
return false
}

2
pkg/handler/error.go
View File

@@ -69,7 +69,7 @@ func (s *Standalone) respondError(w http.ResponseWriter, r *http.Request, status
incrementRetryAttempt(w, r, s.GetCookieOptions(r))
attempts, ok := getRetryAttempts(r)
if !ok || ok && attempts < MaxAutoRetryAttempts {
if !ok || (ok && attempts < MaxAutoRetryAttempts) {
loginCookie, err := openid.GetLoginCookie(r, s.Crypter)
if err != nil {
loginCookie = nil

7
pkg/handler/reverseproxy.go
View File

@@ -89,14 +89,13 @@ func (rp *ReverseProxy) Handler(src ReverseProxySource, w http.ResponseWriter, r
logger.Errorf("default: unauthenticated: unexpected error: %+v", err)
}
isAcrValid := true
err = src.GetAcrHandler().Validate(sess)
if err != nil {
isAcrValid = false
logger.Infof("default: acr: %+v; checking for autologin...", err)
isAuthenticated = false
logger.Infof("default: unauthenticated: acr: %+v; checking for autologin...", err)
}
if src.GetAutoLogin().NeedsLogin(r, isAuthenticated, isAcrValid) {
if src.GetAutoLogin().NeedsLogin(r, isAuthenticated) {
loginRedirect(src, w, r, "request matches autologin")
return
}