github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-08-19 11:06:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: consolidate cookie config, correct documentation

Browse Source
This commit is contained in:
Trong Huu Nguyen
2024-11-05 21:24:25 +01:00
parent bfb4929dc7
commit d2e01b2ead
7 changed files with 25 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/wonderwall/main.go
+2 -2
View File
@@ -42,8 +42,8 @@ func run() error {
ctx, cancel := context.WithCancel(context.Background()) ctx, cancel := context.WithCancel(context.Background())
defer cancel() defer cancel()
if cfg.CookiePrefix != cookie.DefaultPrefix { if cfg.Cookie.Prefix != cookie.DefaultPrefix {
cookie.ConfigureCookieNamesWithPrefix(cfg.CookiePrefix) cookie.ConfigureCookieNamesWithPrefix(cfg.Cookie.Prefix)
} }
if cfg.SSO.Enabled { if cfg.SSO.Enabled {
docs/configuration.md
+9 -9
View File
@@ -14,8 +14,8 @@ The following flags are available:
| `auto-login` | boolean | Enforce authentication if the user does not have a valid session for all matching upstream paths. Automatically redirects HTTP navigation requests to login, otherwise responds with 401 with the Location header set. | `false` | | `auto-login` | boolean | Enforce authentication if the user does not have a valid session for all matching upstream paths. Automatically redirects HTTP navigation requests to login, otherwise responds with 401 with the Location header set. | `false` |
| `auto-login-ignore-paths` | strings | Comma separated list of absolute paths to ignore when `auto-login` is enabled. Supports basic wildcard matching with glob-style asterisks. Invalid patterns are ignored. | | | `auto-login-ignore-paths` | strings | Comma separated list of absolute paths to ignore when `auto-login` is enabled. Supports basic wildcard matching with glob-style asterisks. Invalid patterns are ignored. | |
| `bind-address` | string | Listen address for public connections. | `127.0.0.1:3000` | | `bind-address` | string | Listen address for public connections. | `127.0.0.1:3000` |
| `cookie-prefix` | string | Prefix for cookie names. | `io.nais.wonderwall` | | `cookie.prefix` | string | Prefix for cookie names. | `io.nais.wonderwall` |
| `cookie-same-site` | string | SameSite attribute for session cookies. One of [Strict, Lax, None]. | `Lax` | | `cookie.same-site` | string | SameSite attribute for session cookies. One of [Strict, Lax, None]. | `Lax` |
| `cookie.secure` | string | Set secure flag on session cookies. Can only be disabled when `ingress` only consist of localhost hosts. Generally, disabling this is only necessary when using Safari. | `true` | | `cookie.secure` | string | Set secure flag on session cookies. Can only be disabled when `ingress` only consist of localhost hosts. Generally, disabling this is only necessary when using Safari. | `true` |
| `encryption-key` | string | Base64 encoded 256-bit cookie encryption key; must be identical in instances that share session store. | | | `encryption-key` | string | Base64 encoded 256-bit cookie encryption key; must be identical in instances that share session store. | |
| `ingress` | strings | Comma separated list of ingresses used to access the main application. | | | `ingress` | strings | Comma separated list of ingresses used to access the main application. | |
@@ -25,20 +25,20 @@ The following flags are available:
| `openid.acr-values` | string | Space separated string that configures the default security level (`acr_values`) parameter for authorization requests. | | | `openid.acr-values` | string | Space separated string that configures the default security level (`acr_values`) parameter for authorization requests. | |
| `openid.audiences` | strings | List of additional trusted audiences (other than the client_id) for OpenID Connect id_token validation. | | | `openid.audiences` | strings | List of additional trusted audiences (other than the client_id) for OpenID Connect id_token validation. | |
| `openid.client-id` | string | Client ID for the OpenID client. | | | `openid.client-id` | string | Client ID for the OpenID client. | |
| `openid.client-jwk` | string | JWK containing the private key for the OpenID client in string format. If configured, this takes precedence over 'openid.client-secret'. | | | `openid.client-jwk` | string | JWK containing the private key for the OpenID client in string format. If configured, this takes precedence over `openid.client-secret`. | |
| `openid.client-secret` | string | Client secret for the OpenID client. Overridden by 'openid.client-jwk', if configured. | | | `openid.client-secret` | string | Client secret for the OpenID client. Overridden by `openid.client-jwk`, if configured. | |
| `openid.id-token-signing-alg` | string | Expected JWA value (as defined in RFC 7518) of public keys for validating id_token signatures. This only applies where the key's 'alg' header is not set. | `RS256` | | `openid.id-token-signing-alg` | string | Expected JWA value (as defined in RFC 7518) of public keys for validating id_token signatures. This only applies where the key's `alg` header is not set. | `RS256` |
| `openid.post-logout-redirect-uri` | string | URI for redirecting the user after successful logout at the Identity Provider. | | | `openid.post-logout-redirect-uri` | string | URI for redirecting the user after successful logout at the Identity Provider. | |
| `openid.provider` | string | Provider configuration to load and use, either `openid`, `azure`, `idporten`. | `openid` | | `openid.provider` | string | Provider configuration to load and use, either `openid`, `azure`, `idporten`. | `openid` |
| `openid.resource-indicator` | string | OAuth2 resource indicator to include in authorization request for acquiring audience-restricted tokens. | | | `openid.resource-indicator` | string | OAuth2 resource indicator to include in authorization request for acquiring audience-restricted tokens. | |
| `openid.scopes` | strings | Comma separated list of additional scopes (other than `openid`) that should be used during the login flow. | | | `openid.scopes` | strings | Comma separated list of additional scopes (other than `openid`) that should be used during the login flow. | |
| `openid.ui-locales` | string | Space-separated string that configures the default UI locale (`ui_locales`) parameter for OAuth2 consent screen. | | | `openid.ui-locales` | string | Space-separated string that configures the default UI locale (`ui_locales`) parameter for OAuth2 consent screen. | |
| `openid.well-known-url` | string | URI to the well-known OpenID Configuration metadata document. | | | `openid.well-known-url` | string | URI to the well-known OpenID Configuration metadata document. | |
| `redis.address` | string | Address of the Redis instance (host:port). An empty value will use in-memory session storage. Does not override address set by `redis.uri`. | | | `redis.address` | string | Deprecated: prefer using `redis.uri`. Address of the Redis instance (host:port). An empty value will use in-memory session storage. Does not override address set by `redis.uri`. | |
| `redis.connection-idle-timeout` | int | Idle timeout for Redis connections, in seconds. If non-zero, the value should be less than the client timeout configured at the Redis server. A value of -1 disables timeout. If zero, the default value from go-redis is used (30 minutes). Overrides options set by `redis.uri`. | `0` | | `redis.connection-idle-timeout` | int | Idle timeout for Redis connections, in seconds. If non-zero, the value should be less than the client timeout configured at the Redis server. A value of -1 disables timeout. If zero, the default value from go-redis is used (30 minutes). Overrides options set by `redis.uri`. | `0` |
| `redis.password` | string | Password for Redis. Overrides password set by `redis.uri`. | | | `redis.password` | string | Password for Redis. Overrides password set by `redis.uri`. | |
| `redis.tls` | boolean | Whether or not to use TLS for connecting to Redis. Does not override TLS config set by `redis.uri`. | `true` | | `redis.tls` | boolean | Whether or not to use TLS for connecting to Redis. Does not override TLS config set by `redis.uri`. | `true` |
| `redis.uri` | string | Redis URI string. Prefer using this. An empty value will fall back to `redis-address`. | | | `redis.uri` | string | Redis URI string. An empty value will fall back to `redis-address`. | |
| `redis.username` | string | Username for Redis. Overrides username set by `redis.uri`. | | | `redis.username` | string | Username for Redis. Overrides username set by `redis.uri`. | |
| `session.inactivity` | boolean | Automatically expire user sessions if they have not refreshed their tokens within a given duration. | `false` | | `session.inactivity` | boolean | Automatically expire user sessions if they have not refreshed their tokens within a given duration. | `false` |
| `session.inactivity-timeout` | duration | Inactivity timeout for user sessions. | `30m` | | `session.inactivity-timeout` | duration | Inactivity timeout for user sessions. | `30m` |
@@ -54,8 +54,8 @@ The following flags are available:
| `sso.server-url` | string | The URL used by the proxy to point to the SSO server instance. | | | `sso.server-url` | string | The URL used by the proxy to point to the SSO server instance. | |
| `sso.session-cookie-name` | string | Session cookie name. Must be the same across all SSO Servers and Proxies that should share sessions. | | | `sso.session-cookie-name` | string | Session cookie name. Must be the same across all SSO Servers and Proxies that should share sessions. | |
| `upstream-host` | string | Address of upstream host. | `127.0.0.1:8080` | | `upstream-host` | string | Address of upstream host. | `127.0.0.1:8080` |
| `upstream-ip` | string | IP of upstream host. Overrides 'upstream-host' if set. | | | `upstream-ip` | string | IP of upstream host. Overrides `upstream-host` if set. | |
| `upstream-port` | int | Port of upstream host. Overrides 'upstream-host' if set. | `0` | | `upstream-port` | int | Port of upstream host. Overrides `upstream-host` if set. | `0` |
Boolean flags are by default set to `false` unless noted otherwise. Boolean flags are by default set to `false` unless noted otherwise.
pkg/config/config.go
-7
View File
@@ -27,8 +27,6 @@ type Config struct {
AutoLogin bool `json:"auto-login"` AutoLogin bool `json:"auto-login"`
AutoLoginIgnorePaths []string `json:"auto-login-ignore-paths"` AutoLoginIgnorePaths []string `json:"auto-login-ignore-paths"`
Cookie Cookie `json:"cookie"` Cookie Cookie `json:"cookie"`
CookiePrefix string `json:"cookie-prefix"`
CookieSameSite SameSite `json:"cookie-same-site"`
EncryptionKey string `json:"encryption-key"` EncryptionKey string `json:"encryption-key"`
Ingresses []string `json:"ingress"` Ingresses []string `json:"ingress"`
LegacyCookie bool `json:"legacy-cookie"` LegacyCookie bool `json:"legacy-cookie"`
@@ -136,11 +134,6 @@ func (c *Config) Validate() error {
return err return err
} }
// TODO: move this into Cookie
if err := c.CookieSameSite.Validate(); err != nil {
return err
}
if err := c.OpenID.Validate(); err != nil { if err := c.OpenID.Validate(); err != nil {
return err return err
} }
pkg/config/config_test.go
+2 -2
View File
@@ -35,9 +35,9 @@ func TestConfig_Validate(t *testing.T) {
run("default", base, []test{ run("default", base, []test{
{ {
"invalid value for cookie-same-site", "invalid value for cookie.same-site",
func(cfg *config.Config) { func(cfg *config.Config) {
cfg.CookieSameSite = "invalid" cfg.Cookie.SameSite = "invalid"
}, },
}, },
{ {
pkg/config/cookie.go
+9 -3
View File
@@ -11,10 +11,16 @@ import (
) )
type Cookie struct { type Cookie struct {
Secure bool `json:"secure"` Prefix string `json:"prefix"`
SameSite SameSite `json:"same-site"`
Secure bool `json:"secure"`
} }
func (c *Cookie) Validate(cfg *Config) error { func (c *Cookie) Validate(cfg *Config) error {
if err := c.SameSite.Validate(); err != nil {
return err
}
if c.Secure { if c.Secure {
return nil return nil
} }
@@ -72,8 +78,8 @@ func (s SameSite) Validate() error {
} }
const ( const (
CookiePrefix = "cookie-prefix" CookiePrefix = "cookie.prefix"
CookieSameSite = "cookie-same-site" CookieSameSite = "cookie.same-site"
CookieSecure = "cookie.secure" CookieSecure = "cookie.secure"
EncryptionKey = "encryption-key" EncryptionKey = "encryption-key"
LegacyCookie = "legacy-cookie" LegacyCookie = "legacy-cookie"
pkg/config/redis.go
+2 -2
View File
@@ -66,8 +66,8 @@ const (
) )
func redisFlags() { func redisFlags() {
flag.String(RedisURI, "", "Redis URI string. Prefer using this. An empty value will fall back to 'redis-address'.") flag.String(RedisURI, "", "Redis URI string. An empty value will fall back to 'redis-address'.")
flag.String(RedisAddress, "", "Address of the Redis instance (host:port). An empty value will use in-memory session storage. Does not override address set by 'redis.uri'.") flag.String(RedisAddress, "", "Deprecated: prefer using 'redis.uri'. Address of the Redis instance (host:port). An empty value will use in-memory session storage. Does not override address set by 'redis.uri'.")
flag.String(RedisPassword, "", "Password for Redis. Overrides password set by 'redis.uri'.") flag.String(RedisPassword, "", "Password for Redis. Overrides password set by 'redis.uri'.")
flag.Bool(RedisTLS, true, "Whether or not to use TLS for connecting to Redis. Does not override TLS config set by 'redis.uri'.") flag.Bool(RedisTLS, true, "Whether or not to use TLS for connecting to Redis. Does not override TLS config set by 'redis.uri'.")
flag.String(RedisUsername, "", "Username for Redis. Overrides username set by 'redis.uri'.") flag.String(RedisUsername, "", "Username for Redis. Overrides username set by 'redis.uri'.")
pkg/handler/handler_sso_server.go
+1 -1
View File
@@ -25,7 +25,7 @@ func NewSSOServer(cfg *config.Config, handler *Standalone) (*SSOServer, error) {
handler.CookieOptions = cookie.DefaultOptions(). handler.CookieOptions = cookie.DefaultOptions().
WithPath("/"). WithPath("/").
WithDomain(cfg.SSO.Domain). WithDomain(cfg.SSO.Domain).
WithSameSite(cfg.CookieSameSite.ToHttp()). WithSameSite(cfg.Cookie.SameSite.ToHttp()).
WithSecure(cfg.Cookie.Secure) WithSecure(cfg.Cookie.Secure)
return &SSOServer{Standalone: handler}, nil return &SSOServer{Standalone: handler}, nil