github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-05-07 08:57:07 +00:00
Code Issues Packages Projects Releases Wiki Activity
107 Commits 2 Branches 0 Tags
5e113f428435c6f3a2aa88a2f20d00a30bc363db
Commit Graph

83 Commits

Author SHA1 Message Date
Trong Huu Nguyen
5e113f4284 refactor: use common cookie name across all instances 
This will attempt to mitigate cases where many instances
of Wonderwall on the same domain set cookies which will
exceed the header size for Cookies.

Generally, this should result in decryption failures when
transitioning from one app to another, which should omit the
Authorization header and have a new session triggered by the
downstream application.

Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-04 13:17:12 +02:00
Trong Huu Nguyen
f73b4605a1 refactor: use encrypted cookie as session fallback 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-04 13:17:04 +02:00
Trong Huu Nguyen
80c7abd70a refactor: update jwx; now infers alg from keys where missing 2021-10-01 12:22:49 +02:00
Morten Lied Johansen
43dd8d7926 More, correct, metrics 
Co-authored-by: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
Co-authored-by: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-01 10:28:44 +02:00
Morten Lied Johansen
c70c7d7267 Increase login cookie lifetime 
Co-authored-by: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
Co-authored-by: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-01 09:46:54 +02:00
Trong Huu Nguyen
03eec9d2b8 refactor: robustify logout routes 
Co-authored-by: Morten Lied Johansen <morten.lied.johansen@nav.no>
Co-authored-by: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-01 09:35:28 +02:00
Trong Huu Nguyen
cc8ba980ca refactor: deduplicate crypto operations for sessions 2021-09-30 18:27:53 +02:00
Trong Huu Nguyen
8f9cb671c6 fix: set jwt ID for client assertion to prevent token replay 2021-09-30 15:38:23 +02:00
Trong Huu Nguyen
2ec1b7ace9 feat: encrypt session data 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-09-30 13:47:29 +02:00
Trong Huu Nguyen
cf7ca9c5b8 refactor: separate login param generation 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-09-30 12:13:38 +02:00
Trong Huu Nguyen
dbc0a47a46 refactor: ensure session lifetime does not exceed access token lifetime 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-09-30 12:08:23 +02:00
Trong Huu Nguyen
b2e89f32fa refactor: ensure cookies are properly disposed of 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-09-30 10:05:49 +02:00
Morten Lied Johansen
aad2a49591 Register the metrics we collect 2021-09-29 22:01:00 +02:00
Morten Lied Johansen
bf7d877183 Merge pull request #3 from nais/metrics 
Metrics and dashboard
 2021-09-29 15:06:54 +02:00
Trong Huu Nguyen
25221added rename callbackparams to logincookie for clarity, ensure logincookie is deleted when no longer needed 2021-09-29 13:27:30 +02:00
Morten Lied Johansen
f551386113 Add Redis latency metrics 
Co-authored-by: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-09-29 10:50:27 +02:00
Morten Lied Johansen
b60db493ac Add ClientID to cookie names 
Co-authored-by: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-09-29 10:20:11 +02:00
Trong Huu Nguyen
28b750517b wip: cookies 2021-09-29 10:00:42 +02:00
Trong Huu Nguyen
5160987978 feat: allow user-defined post_logout_redirect_uri 2021-09-10 14:46:28 +02:00
Trong Huu Nguyen
acc32fe893 fix: log actual errors for callback route 2021-09-08 09:26:26 +02:00
Trong Huu Nguyen
c7040b0284 feat: add feature toggle for authorization locale; allow user-supplied parameter 2021-09-08 09:17:08 +02:00
Trong Huu Nguyen
55002e3cfe refactor: separate parsing and validation of id_token 2021-09-07 21:30:38 +02:00
Trong Huu Nguyen
09bbc35df7 fix: ensure acr claim exists if security level is enabled 2021-09-06 11:35:55 +02:00
Trong Huu Nguyen
4237e84de3 feat: add feature toggle for security level; allow user-defined levels 2021-09-06 11:05:19 +02:00
Trong Huu Nguyen
e819cc0de1 use host-agnostic path for default zero-config ingress 2021-09-02 12:23:32 +02:00
Kim Tore Jensen
081921d0fa add http request metrics 2021-09-02 11:16:45 +02:00
Kim Tore Jensen
e0662efa66 default zero-config ingress for testing 2021-08-30 11:50:15 +02:00
Kim Tore Jensen
1aa134ecf0 redirect after successful oauth2 flow - to user-defined location, or referer 2021-08-26 12:54:40 +02:00
Kim Tore Jensen
c1660ad1d0 also unset x-pwned-by when un-authenticated 2021-08-26 12:21:21 +02:00
Trong Huu Nguyen
da4f6dc6a7 use correct session ID for front-channel logout 2021-08-26 10:35:45 +02:00
Kim Tore Jensen
c76daf61f7 don't set x-pwned-by header for end-users; only upstream 2021-08-25 17:29:09 +02:00
Kim Tore Jensen
679566977e forward host header correctly 2021-08-25 17:28:46 +02:00
Kent Daleng
8ee87a8a84 get ingresses from naiserator to build router correctly 
Co-Authored-By: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
Co-Authored-By: Kim Tore Jensen <kim.tore.jensen@nav.no>
 2021-08-25 13:15:26 +02:00
Trong Huu Nguyen
5da34f0139 fix: include id_token_hint on self-initiated logout 
This is required when including the post_logout_redirect_uri
parameter.
 2021-08-25 11:55:36 +02:00
Trong Huu Nguyen
e83542b046 fix: prefix local session keys to prevent collisions 
`sid` is a key that refers to the user's unique SSO session at the
Identity Provider, and the same key is present in all tokens
acquired by any Relying Party (such as Wonderwall) during that session.
Thus, we cannot assume that the value of `sid` to uniquely identify the
pair of (user, application session) if using a shared session store.
 2021-08-25 11:26:24 +02:00
Trong Huu Nguyen
cb514c2294 refactor: make SessionMaxLifetime configurable 2021-08-25 10:55:53 +02:00
Trong Huu Nguyen
6e45fa804c refactor: use keygen from liberator 2021-08-25 10:15:45 +02:00
Trong Huu Nguyen
700b6732d7 fix: add acceptable skew for id_token validation 2021-08-25 09:31:21 +02:00
Trong Huu Nguyen
f63bade2b9 chore: remove obsolete fixme, redundant type conversion 2021-08-25 09:29:01 +02:00
Trong Huu Nguyen
de619c6e89 refactor: add constructor for routing handler to deduplicate config 2021-08-25 09:21:40 +02:00
Trong Huu Nguyen
03a14eb2bd refactor: clean up id_token validation 2021-08-25 08:22:34 +02:00
Kim Tore Jensen
f414470910 support entering encryption key as environment variable 2021-08-24 15:46:55 +02:00
Kim Tore Jensen
097f4fd5b2 make redis support configurable 2021-08-24 13:07:57 +02:00
Kim Tore Jensen
55f26fb54c incorporate new session storage code 2021-08-24 12:58:16 +02:00
Kim Tore Jensen
15a7c14324 redis and in-memory session store 2021-08-24 12:49:23 +02:00
Trong Huu Nguyen
2becde51b9 add front-channel logout test 
Co-Authored-By: Kim Tore Jensen <kim.tore.jensen@nav.no>
 2021-08-24 10:52:00 +02:00
Trong Huu Nguyen
b7dbb000aa test self-initiated logout 
Co-Authored-By: Kim Tore Jensen <kim.tore.jensen@nav.no>
 2021-08-24 10:31:49 +02:00
Kent Daleng
1f58b5ae15 write callback test 
Co-Authored-By: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
 2021-08-24 10:02:21 +02:00
Trong Huu Nguyen
cf8b4d56cc fix: set path for cookies 2021-08-24 08:49:57 +02:00
Trong Huu Nguyen
43cb01ad00 wip: idporten mock server 2021-08-24 07:44:05 +02:00