github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-08-23 21:16:14 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,332 Commits 2 Branches 0 Tags
master
Commit Graph
669 Commits
Author SHA1 Message Date
Trong Huu Nguyen c147a5a19e refactor(openid): extract request params for remaining grants, minor cleanups 2025-01-24 08:07:54 +01:00
Trong Huu Nguyen 062e7b09ce fix(openid/client): prompt parameter is optional 2025-01-24 08:07:54 +01:00
Trong Huu Nguyen 0b32d8839c test(openid/client): add negative assertions for unwanted parameters 2025-01-24 08:07:52 +01:00
Trong Huu Nguyenandsindrerh2 110dd64750 refactor(openid/client): extract authorization code parameters 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-23 12:03:42 +01:00
Trong Huu Nguyenandsindrerh2 642457b950 refactor(openid/client): extract oauth request method 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-23 10:17:13 +01:00
Trong Huu Nguyenandsindrerh2 ab418c456c fix(handler/reverseproxy): add nil check for session 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-23 10:16:13 +01:00
Trong Huu Nguyen 837323d728 refactor(mock): use oauth error response for all idp errors 2025-01-23 09:02:19 +01:00
Sindre Rødseth Hansenandtronghn ade44f0950 refactor: remove indirection layer for login client 
Co-authored-by: tronghn <trong.huu.nguyen@nav.no>
 2025-01-23 08:48:32 +01:00
Sindre Rødseth Hansenandtronghn c442000be4 feat: implement PAR for relying party 
Fixes #235

Co-authored-by: tronghn <trong.huu.nguyen@nav.no>
 2025-01-23 08:48:32 +01:00
Trong Huu Nguyenandsindrerh2 6be5a1ebe5 wip: implement PAR for relying party 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-23 08:48:32 +01:00
Trong Huu Nguyenandsindrerh2 909060d8fd feat(mock): implement PAR for identity provider 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-23 08:48:28 +01:00
Trong Huu Nguyen f2def8d00d fix(session/data): next refresh time should account for inactivity timeouts 
The default auto-refresh behaviour occurs 5 minutes before tokens
expire, at the earliest. Without inactivity however, tokens are still
refreshed at any point after this, as long as the session has not ended.

This however, means that refreshes don't occur often enough when inactivity
timeouts are enabled. In practice, the session is only refreshed if a
request is received within the 5 minute leeway window between a token's expiry
and the inactivity timeout.

This commit will apply auto-refreshes at the half-life of the inactivity
timeout instead, so that users' sessions and timeouts are properly
extended on activity.
 2025-01-22 15:58:53 +01:00
Trong Huu Nguyenandsindrerh2 c1dd4f1177 refactor(handler/login): improve logging when rate limiting 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-22 12:03:01 +01:00
Trong Huu Nguyenandsindrerh2 b6bfb817a4 feat(handler/login): add rate limit to prevent redirect loops 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-22 09:46:45 +01:00
Trong Huu Nguyenandsindrerh2 64e9167e05 refactor(openid/client): remove indirection layer for login callback 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-21 09:39:23 +01:00
Trong Huu Nguyenandsindrerh2 75f98debc5 feat(openid/client): validate iss parameter if provider declares authorization_response_iss_parameter_supported 
Fixes #306.

Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-21 09:39:21 +01:00
Sindre Rødseth Hansenandtronghn 2feb6a3b77 feat: Add option for propagating id_token to upstream app 
Fixes #315

Co-authored-by: tronghn <trong.huu.nguyen@nav.no>
 2025-01-20 13:07:54 +01:00
Trong Huu Nguyen 3a4f656f33 style: make fmt [ci skip] 2025-01-17 14:22:48 +01:00
Trong Huu Nguyen 3e42d001f0 feat(handler/forwardauth): reduce log severity for not-existent sessions 2025-01-17 14:19:00 +01:00
Trong Huu Nguyen 3143940b08 feat: remove feature flags for session refresh 
These feature flags were enabled by default. We specifically disallowed
the use of automatic refresh with the SSO mode, though this poses some
complexity if using the forward-auth feature.

To simplify configuration and code, we remove the flags in their
entirety as session refresh behaviour is mostly already handled by the
implementation of GetSession() in the handlers. Specifically:

- the Standalone handler needs to refresh sessions when reverse-proxying
  to the upstream.
- the SSO server handler needs to refresh sessions only when using the
  forward-auth feature. It does not have an upstream to reverse proxy
  to.
- the SSO proxy handler is a read-only upstream proxy and does not
  possess the ability to refresh sessions itself, though it will
  delegate traffic for the session endpoints to the configured SSO server.

Automatic refreshing is thus only disabled when running in SSO mode
without the forward-auth feature.
 2025-01-16 10:14:15 +01:00
Trong Huu Nguyen 0258ce7cfd feat: add handler for forward-auth 2025-01-14 13:44:49 +01:00
Trong Huu Nguyen c96e457675 test: assert unauthenticated response for session endpoints 2025-01-14 13:33:35 +01:00
Trong Huu Nguyen 724132e51c test: correct description for secure cookie test 2024-11-06 10:17:11 +01:00
Trong Huu Nguyen 2d5d99f5ee fix(openid): don't ignore existence check for key mutator 2024-11-06 09:40:56 +01:00
Trong Huu Nguyen b4b38f30ef test(openid): add missing token validation cases 2024-11-06 09:27:27 +01:00
Trong Huu Nguyen 3761d40bf6 feat(crypto): log warning for ephemeral encryption key 2024-11-06 08:47:05 +01:00
Trong Huu Nguyen 5c63a2a743 refactor(openid/client): inline unnecessary variables 2024-11-05 22:15:48 +01:00
Trong Huu Nguyen b7b43e9793 refactor(openid): remove more indirection layers 2024-11-05 21:58:38 +01:00
Trong Huu Nguyen d2e01b2ead refactor: consolidate cookie config, correct documentation 2024-11-05 21:24:25 +01:00
Trong Huu Nguyen bfb4929dc7 feat: allow disabling secure cookies for localhost 
This is geerally only necessary when using Safari.
Most other browsers respect the Secure attribute when using localhost.
 2024-11-05 21:14:14 +01:00
Trong Huu Nguyen 6b46d57422 refactor(openid): consolidate validation and verification of id_tokens 
Also remove some indirection layers.
 2024-11-05 21:10:44 +01:00
Trong Huu Nguyen e6297750d6 feat(openid): set expected default public JWK algorithm if the OP doesn't set them 
This allows us to verify signatures without relying on heuristics used
by jws.WithInferAlgorithmFromKey() that may introduce security and
performance implications.
 2024-11-05 21:08:46 +01:00
Trong Huu Nguyen db060a4caf feat(handler): do not automatically retry token redemption failures 2024-11-05 19:57:48 +01:00
Trong Huu Nguyen 4c2d1f4813 docs(config): clarify description of openid.scopes flag 2024-11-05 11:44:45 +01:00
Trong Huu Nguyen 192b196d3f refactor(config): inline samesite options 2024-11-05 08:48:46 +01:00
Trong Huu Nguyen 7c2d6d3f71 feat(templates): clean up error page after feedback 2024-10-16 12:46:29 +02:00
Trong Huu NguyenandMorten Lied Johansen a4b832839c feat(templates): make error page more generic and ✨ responsive ✨ 
Co-authored-by: Morten Lied Johansen <morten.lied.johansen@nav.no>
 2024-10-09 08:58:36 +02:00
Trong Huu Nguyen df5c78b821 feat(openid/client): add support for the client_secret_post authentication method 2024-10-08 09:19:38 +02:00
Trong Huu Nguyen 5ae325ca3d fix(retry): correct usage of MaxDuration, remove unused code 2024-09-20 11:47:49 +02:00
Trong Huu Nguyen d6b57a6b7d refactor(handler/sso/proxy): correct variable name 2024-09-11 09:27:13 +02:00
Trong Huu Nguyen 9e78ba78be fix(handler/sso/proxy): avoid duplicate headers when proxying to server 2024-09-03 12:08:38 +02:00
Trong Huu Nguyen 155ebc745b docs: clarify forwarded headers 2024-08-23 13:56:21 +02:00
Trong Huu Nguyen 57376643ba build: go 1.23 2024-08-23 13:56:19 +02:00
Trong Huu Nguyen 3876820aee refactor(retry): use DoValue 2024-08-23 13:55:51 +02:00
Trong Huu Nguyen 3465d8aef3 refactor(config): clean up tests 2024-08-23 13:55:49 +02:00
Trong Huu Nguyen f9761c3437 test(config): add some more cases, remove unneeded parameter 2024-07-02 21:58:14 +02:00
Trong Huu Nguyen 1906024da0 feat(openid/acr): remove old values and backward compatibility for new idporten 
We no longer expect nor accept tokens with old acr values during
validation as ID-porten no longer issues tokens with these values.

This also removes backward compatibility in cases where configured
values targeted the new ID-porten while using old ID-porten.

We still maintain an internal mapping from old values to new values
for forward compatibilty when using old values provided in the login
parameter and the `openid.acr-values` flag.
 2024-06-27 12:34:16 +02:00
Trong Huu Nguyen f94d81aed7 test(config): add missing tests 2024-06-27 09:54:29 +02:00
Trong Huu Nguyen d7b0d93f11 refactor: split out config again 2024-06-26 15:32:38 +02:00
Trong Huu Nguyen d69cf79664 refactor: reduce noisy config logs 
Fixes #262.
 2024-06-26 14:51:05 +02:00