Trong Huu Nguyen
b99a00479d
fix: annotate reviewed gosec findings
...
Each finding was reviewed individually; the annotations record why the
flagged code is safe rather than suppressing the rules globally.
- G101: viper configuration keys, not credentials
- G117: the marshalled value is the plaintext input to the encryption
that immediately follows, or a token endpoint response that is
required to carry tokens
- G118: the background deletion must outlive the request, so the
request context deliberately is not used
- G124: cookie attributes are validated in config.Cookie.Validate
- G710: the redirect targets are relative by construction, validated by
the url validators, or read from the provider's metadata document
2026-07-28 12:52:34 +02:00
Trong Huu Nguyen
c6e711cd85
refactor: drop redundant embedded field selectors
...
Satisfies staticcheck QF1008.
2026-07-28 09:04:42 +02:00
Trong Huu Nguyen
5febe7c766
feat: remove support for legacy cookie
2025-12-03 13:54:11 +01:00
Trong Huu Nguyen and sindrerh2
787b54beeb
refactor(crypto): move to internal
...
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no >
2025-01-30 14:03:36 +01:00
Trong Huu Nguyen and sindrerh2
b6bfb817a4
feat(handler/login): add rate limit to prevent redirect loops
...
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no >
2025-01-22 09:46:45 +01:00
Trong Huu Nguyen
41f4354ce4
revert: "feat(handler/error): remove automatic retry"
...
This reverts commit 083cb54df7
2023-12-20 11:17:51 +01:00
Trong Huu Nguyen
9c2d1cb520
feat(cookie): remove expiry options
...
Always create session cookies instead of
persistent cookies with expiry.
2023-12-19 08:46:08 +01:00
Trong Huu Nguyen
e00832016b
feat(handler/login): remove legacy cookie
...
We don't really need to set an additional cookie without SameSite
as we now use SameSite=Lax for the login cookie.
2023-12-19 08:46:08 +01:00
Trong Huu Nguyen
083cb54df7
feat(handler/error): remove automatic retry
2023-12-19 08:46:06 +01:00
Trong Huu Nguyen
273eb3604a
feat(cookie): use samesite lax instead of none for callback
2023-12-19 08:46:03 +01:00
Trong Huu Nguyen
390cd78e9f
feat(handler): set legacy cookie for sso server
2023-05-12 08:47:26 +02:00
Trong Huu Nguyen
350d7ff780
feat(cookie): allow configuration of name prefix
...
This is to alleviate issues with deployments on different
subdomains using overlapping cookie names where browsers
behave unpredictably.
2023-05-08 10:23:27 +02:00
Trong Huu Nguyen
6ebc95a8e0
feat: add logout cookie
2023-05-03 09:05:42 +02:00
Trong Huu Nguyen
07cf8e12b3
feat(cookie): support overriding session cookie name
2023-03-01 11:27:26 +01:00
Trong Huu Nguyen
afc8fd6962
style: formatting
2023-02-21 15:37:48 +01:00
Trong Huu Nguyen
2c5d964983
refactor(handler/reverseproxy): reduce log severity for cookie decrypt failures
2023-02-15 08:43:25 +01:00
Trong Huu Nguyen
5a56c24bcc
refactor(crypto): replace aes-256-gcm with xchacha20-poly1305
2023-02-13 21:48:23 +01:00
Trong Huu Nguyen
ce2698f2bb
refactor(cookie): use rawurlencoding for base64
2023-02-13 20:15:12 +01:00
Trong Huu Nguyen
473e4a95a7
refactor: remove loginstatus
...
Loginstatus is no longer needed with the SSO setup.
Fixes #50 .
2023-02-10 14:58:17 +01:00
Trong Huu Nguyen
61a7a8f161
refactor: clean up errors and reverseproxy logging
2023-02-10 14:57:53 +01:00
Trong Huu Nguyen
002e4ac8ea
feat(handler/error): automatically retry errors before displaying error page
2022-10-11 10:55:14 +02:00
Trong Huu Nguyen
3e62683cad
refactor: use pointer receivers when possible
2022-07-19 19:24:28 +02:00
Trong Huu Nguyen
66cf08e602
refactor(openid/logout): simplify logout logic
...
As we already clear any local sessions before redirecting to the
Identity Provider, and the callback always redirects to a pre-configured URL,
there isn't really any need to maintain and verify state in the logout
callback.
In other words, the logout callback handler is simply a redirect handler.
2022-07-12 15:09:49 +02:00
Trong Huu Nguyen
31eb0d5a1e
refactor(router/cookies): move related functions to cookies pkg
2022-07-04 15:18:38 +02:00
Trong Huu Nguyen
9cc9bd72b9
refactor(middleware/logentry): only include relevant cookies
2022-06-13 15:43:02 +02:00
Trong Huu Nguyen
9c114f198a
feat: set path for cookies for ingresses with subpaths
2022-02-14 13:18:29 +01:00
fcba6815b9
feat: add feature toggled support for loginstatus
...
Co-Authored-By: Youssef Bel Mekki <youssef.bel.mekki@nav.no >
Co-Authored-By: Tommy Trøen <tommy.troen@nav.no >
2022-02-03 11:41:40 +01:00
Trong Huu Nguyen
7432f86b64
refactor(cookie): set expires to epoch zero time on deletion
2022-01-07 15:29:49 +01:00
Trong Huu Nguyen
05e2509fac
refactor: separate cookie operations to own package
2022-01-07 11:03:22 +01:00
Trong Huu Nguyen
3a35584a21
refactor: restructure and group related packages into subpackages
2021-10-20 09:03:14 +02:00
Trong Huu Nguyen and Sindre Rødseth Hansen
399a8175c8
refactor: user-friendly retry URI for default error page
...
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no >
2021-10-07 10:26:32 +02:00
Trong Huu Nguyen
