Trong Huu Nguyen
1fdbe75c9e
feat(sso/proxy): implement login handler
2023-02-10 14:58:11 +01:00
Trong Huu Nguyen
c3c0c01926
feat(sso): partially implement handlers
2023-02-10 14:58:09 +01:00
Trong Huu Nguyen
a4e4fc752e
refactor(handler): remove provider name getter from handler
2023-02-10 14:57:57 +01:00
Trong Huu Nguyen
3d08d0b4b0
feat: initial skeleton setup for SSO mode
2023-02-10 14:57:56 +01:00
Trong Huu Nguyen
bd748b9cef
refactor(openid/provider): use name from config instead of indirection layer
2023-02-10 14:57:56 +01:00
Trong Huu Nguyen
2f6a3682d9
fix(all): use url.ParseRequestURI instead of just url.Parse where necessary
2023-02-10 14:57:55 +01:00
Trong Huu Nguyen
f4bba075a6
refactor(handler/error): reduce log severity for context canceled errors
2023-02-10 14:57:55 +01:00
Trong Huu Nguyen
61a7a8f161
refactor: clean up errors and reverseproxy logging
2023-02-10 14:57:53 +01:00
Trong Huu Nguyen
ce177fb4a5
refactor(handler/url): remove unneeded redirect parameter encoding
2023-02-10 14:57:52 +01:00
Trong Huu Nguyen
07fc0e24dd
perf(handler/autologin): cache NeedsLogin results
2023-02-10 14:57:51 +01:00
Trong Huu Nguyen
bd53417f8b
refactor(handler): move handler tests to separate files
2023-02-10 14:57:48 +01:00
Trong Huu Nguyen
f51fe97b23
refactor(handler): flatten handler modules
2023-02-10 14:57:48 +01:00
Trong Huu Nguyen
6a142cf5a5
refactor(handler): use session cookie for frontchannel logout if available, clean up logout handlers
2023-02-10 14:57:48 +01:00
Trong Huu Nguyen
67d3977cc1
refactor(handler/sessionrefresh): use found session key instead of looking up key again
2023-02-10 14:57:47 +01:00
Trong Huu Nguyen
c3a5033968
test(handler): add test for authorization headers, ensure upstream validates token
2023-02-10 14:57:45 +01:00
Trong Huu Nguyen
0485074829
refactor(handler/reverseproxy): reduce log severity for invalid auth state
2022-12-16 14:53:35 +01:00
Trong Huu Nguyen
1d754baabe
feat(handler/reverseproxy): preserve incoming authorization for unauthenticated sessions
2022-12-16 14:53:27 +01:00
Trong Huu Nguyen
185485a6fe
feat(handler/autologin): use doublestar library for nested path matching
...
Fixes #54 .
2022-11-24 11:36:54 +01:00
Trong Huu Nguyen
e7244df4d5
feat: add local logout endpoint
2022-11-24 11:36:49 +01:00
Trong Huu Nguyen
002e4ac8ea
feat(handler/error): automatically retry errors before displaying error page
2022-10-11 10:55:14 +02:00
Trong Huu Nguyen
bdec8c662c
refactor(router): correct HTTP verb for session refresh endpoint
...
Since this changes the state for a user's session, a POST is more
appropriate than just a GET - even though the POST body is empty.
We keep the GET route temporarily to allow any consumers to migrate.
2022-10-11 09:22:03 +02:00
Trong Huu Nguyen
b651db40e4
refactor(handler/url): remove support for Referer header
...
The header isn't guaranteed to be set or sent with requests, and all of
our users prefer the `redirect` query parameter anyways.
2022-09-22 13:59:37 +02:00
Trong Huu Nguyen
aaaaaaa38d
feat(session): add session inactivity timeout feature
...
Fixes #52 .
2022-09-22 10:03:17 +02:00
Trong Huu Nguyen
843bf5dfcd
refactor(handler/error): rename config variable to match intention
2022-09-21 09:39:57 +02:00
Trong Huu Nguyen
f093fd549e
fix(autologin): ignore trailing slash in request paths during matching
2022-09-21 08:41:13 +02:00
Trong Huu Nguyen
f6cf60a013
refactor(handler/reverseproxy): improve log messages
2022-09-20 08:00:57 +02:00
Trong Huu Nguyen
e5a285887c
refactor(handler/url): extract redirect url decoder method
2022-09-19 21:14:22 +02:00
Trong Huu Nguyen
80738f2a4b
fix(handler/url): use base64 encoding for redirects to preserve query parameters
...
Load balancers or reverse proxies may rewrite or modify the Location
header and unescape its value, which would result in redirects not
preserving the original set of query parameters. This was especially
evident for autologins where we need to redirect to `/oauth2/login` with
the `redirect` parameter containing the original requested URL so that
the end-user ultimately ends up at the latter URL.
We avoid this issue by base64-encoding the original URL, before passing
it along as the intended redirect for the login route.
To preserve existing behaviour, we use a separate query parameter
for the `/oauth2/login`-endpoint that accepts and handles base64-encoded
values.
2022-09-19 11:51:30 +02:00
Trong Huu Nguyen
97d2a88bb1
fix(handler/url): ensure that parameters for original url aren't dropped
2022-09-19 08:41:25 +02:00
Trong Huu Nguyen
ed56aac3d0
style: follow conventions for error variable names
2022-09-19 08:41:23 +02:00
Trong Huu Nguyen
62f0359438
fix(handler/autologin): ensure path has prefix
2022-09-19 08:41:17 +02:00
Trong Huu Nguyen
b4eecfc663
fix(handler/autologin): only trigger for GET requests
2022-09-12 12:33:42 +02:00
Trong Huu Nguyen
43c39c89ad
refactor(handler/reverseproxy): skip logging for client context cancellation
2022-09-12 12:32:37 +02:00
Trong Huu Nguyen
fcc6a7472c
fix(handler/autologin): return http 303 for autologin redirects
2022-09-09 14:38:46 +02:00
Trong Huu Nguyen
a4ceaeaacc
feat(handler/autologin): add favicon.ico and robots.txt to default ignorelist
2022-09-09 13:09:36 +02:00
Trong Huu Nguyen
69ebd9270f
refactor(handler/reverseproxy): improve log messages
2022-09-09 10:18:39 +02:00
Trong Huu Nguyen
84d521e968
feat(reverseproxy): configure errorlog to use logrus implementation
2022-09-06 15:34:32 +02:00
Trong Huu Nguyen
00b39276df
debug(handler/reverseproxy): log proxy errors
2022-09-06 08:46:41 +02:00
Trong Huu Nguyen
b22c130e60
fix(session/handler): invalidate session state if refresh attempt is a client error
...
A client error response for the refresh grant is assumed to be an
irrecoverable error; e.g. the refresh token is invalid, the
authorization is invalid, user is logged out, etc. In such cases we will
consider the session state to be invalid, and a new authorization grant
should be performed.
2022-09-04 17:15:40 +02:00
Trong Huu Nguyen
989aa1e998
refactor(middleware/logentry): add fields to default logger
2022-09-03 20:05:28 +02:00
Trong Huu Nguyen
08eefbf1d5
refactor(openid): clean up client and provider
2022-09-02 18:08:36 +02:00
Trong Huu Nguyen
92ee6313c5
refactor: remove unnecessary interfaces
2022-09-02 17:39:27 +02:00
Trong Huu Nguyen
c8f48335d4
refactor(openid/config): extract getter for ingresses
2022-09-02 15:17:36 +02:00
Trong Huu Nguyen
9144056e28
refactor(handler): split up request handlers into separate modules
2022-09-02 14:53:11 +02:00
Trong Huu Nguyen
5d00d132dd
refactor: decouple handler implementation from router and middleware
2022-09-01 19:39:47 +02:00
Trong Huu Nguyen
d9cc60c4cc
refactor: move autologin to handler pkg
2022-09-01 19:35:58 +02:00
Trong Huu Nguyen
619ae52d45
refactor: separate refresh-specific fields from session info; enable endpoint without refresh feature
2022-09-01 19:35:48 +02:00
Trong Huu Nguyen
cdd07838f4
refactor(session/data): separate into object groups
2022-08-29 08:35:03 +02:00
Trong Huu Nguyen
5ec969981d
fix(session/handler): ensure access token is not expired before proxying
2022-08-26 17:58:39 +02:00
Trong Huu Nguyen
d5bbca9897
feat: rudimentary support for refresh tokens
2022-08-26 14:32:39 +02:00
