github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-05-08 17:37:01 +00:00
Code Issues Packages Projects Releases Wiki Activity
117 Commits 2 Branches 0 Tags
b8a62826ad7bc66b09c3f0ff718faf856492f481
Commit Graph

79 Commits

Author SHA1 Message Date
Trong Huu Nguyen
b8a62826ad fix: remove debug error 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-06 14:54:30 +02:00
sindrerh2
1f939d603d feat: add configurable redirect to custom error page 
Co-authored-by: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
 2021-10-06 14:49:04 +02:00
Trong Huu Nguyen
7979bb09fb refactor: move request related utilities to own pkg 2021-10-06 12:39:08 +02:00
sindrerh2
fb4adc9cc5 feat: add templated error page 
Co-authored-by: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
 2021-10-05 14:09:09 +02:00
Trong Huu Nguyen
77d0438411 feat: use latest go-chi v5, add middlewares for panic recovery and logging 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-05 11:45:42 +02:00
Trong Huu Nguyen
70516c3efb refactor: more cleanups; split up route handlers 2021-10-04 19:10:19 +02:00
Trong Huu Nguyen
569855cef2 refactor: minor cleanups for middleware 2021-10-04 18:45:40 +02:00
Trong Huu Nguyen
788ef1278a refactor: add correlation ID for error response logs 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-04 14:36:54 +02:00
Trong Huu Nguyen
ce8d8c6460 refactor: clean up error handling 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-04 14:07:15 +02:00
Trong Huu Nguyen
5e113f4284 refactor: use common cookie name across all instances 
This will attempt to mitigate cases where many instances
of Wonderwall on the same domain set cookies which will
exceed the header size for Cookies.

Generally, this should result in decryption failures when
transitioning from one app to another, which should omit the
Authorization header and have a new session triggered by the
downstream application.

Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-04 13:17:12 +02:00
Trong Huu Nguyen
f73b4605a1 refactor: use encrypted cookie as session fallback 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-04 13:17:04 +02:00
Trong Huu Nguyen
80c7abd70a refactor: update jwx; now infers alg from keys where missing 2021-10-01 12:22:49 +02:00
Morten Lied Johansen
43dd8d7926 More, correct, metrics 
Co-authored-by: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
Co-authored-by: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-01 10:28:44 +02:00
Morten Lied Johansen
c70c7d7267 Increase login cookie lifetime 
Co-authored-by: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
Co-authored-by: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-01 09:46:54 +02:00
Trong Huu Nguyen
03eec9d2b8 refactor: robustify logout routes 
Co-authored-by: Morten Lied Johansen <morten.lied.johansen@nav.no>
Co-authored-by: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-10-01 09:35:28 +02:00
Trong Huu Nguyen
cc8ba980ca refactor: deduplicate crypto operations for sessions 2021-09-30 18:27:53 +02:00
Trong Huu Nguyen
2ec1b7ace9 feat: encrypt session data 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-09-30 13:47:29 +02:00
Trong Huu Nguyen
cf7ca9c5b8 refactor: separate login param generation 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-09-30 12:13:38 +02:00
Trong Huu Nguyen
dbc0a47a46 refactor: ensure session lifetime does not exceed access token lifetime 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-09-30 12:08:23 +02:00
Trong Huu Nguyen
b2e89f32fa refactor: ensure cookies are properly disposed of 
Co-Authored-By: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-09-30 10:05:49 +02:00
Trong Huu Nguyen
25221added rename callbackparams to logincookie for clarity, ensure logincookie is deleted when no longer needed 2021-09-29 13:27:30 +02:00
Morten Lied Johansen
b60db493ac Add ClientID to cookie names 
Co-authored-by: Sindre Rødseth Hansen <sindre.rodseth.hansen@nav.no>
 2021-09-29 10:20:11 +02:00
Trong Huu Nguyen
28b750517b wip: cookies 2021-09-29 10:00:42 +02:00
Trong Huu Nguyen
5160987978 feat: allow user-defined post_logout_redirect_uri 2021-09-10 14:46:28 +02:00
Trong Huu Nguyen
acc32fe893 fix: log actual errors for callback route 2021-09-08 09:26:26 +02:00
Trong Huu Nguyen
c7040b0284 feat: add feature toggle for authorization locale; allow user-supplied parameter 2021-09-08 09:17:08 +02:00
Trong Huu Nguyen
55002e3cfe refactor: separate parsing and validation of id_token 2021-09-07 21:30:38 +02:00
Trong Huu Nguyen
09bbc35df7 fix: ensure acr claim exists if security level is enabled 2021-09-06 11:35:55 +02:00
Trong Huu Nguyen
4237e84de3 feat: add feature toggle for security level; allow user-defined levels 2021-09-06 11:05:19 +02:00
Kim Tore Jensen
081921d0fa add http request metrics 2021-09-02 11:16:45 +02:00
Kim Tore Jensen
1aa134ecf0 redirect after successful oauth2 flow - to user-defined location, or referer 2021-08-26 12:54:40 +02:00
Kim Tore Jensen
c1660ad1d0 also unset x-pwned-by when un-authenticated 2021-08-26 12:21:21 +02:00
Trong Huu Nguyen
da4f6dc6a7 use correct session ID for front-channel logout 2021-08-26 10:35:45 +02:00
Kim Tore Jensen
c76daf61f7 don't set x-pwned-by header for end-users; only upstream 2021-08-25 17:29:09 +02:00
Kim Tore Jensen
679566977e forward host header correctly 2021-08-25 17:28:46 +02:00
Kent Daleng
8ee87a8a84 get ingresses from naiserator to build router correctly 
Co-Authored-By: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
Co-Authored-By: Kim Tore Jensen <kim.tore.jensen@nav.no>
 2021-08-25 13:15:26 +02:00
Trong Huu Nguyen
5da34f0139 fix: include id_token_hint on self-initiated logout 
This is required when including the post_logout_redirect_uri
parameter.
 2021-08-25 11:55:36 +02:00
Trong Huu Nguyen
e83542b046 fix: prefix local session keys to prevent collisions 
`sid` is a key that refers to the user's unique SSO session at the
Identity Provider, and the same key is present in all tokens
acquired by any Relying Party (such as Wonderwall) during that session.
Thus, we cannot assume that the value of `sid` to uniquely identify the
pair of (user, application session) if using a shared session store.
 2021-08-25 11:26:24 +02:00
Trong Huu Nguyen
cb514c2294 refactor: make SessionMaxLifetime configurable 2021-08-25 10:55:53 +02:00
Trong Huu Nguyen
700b6732d7 fix: add acceptable skew for id_token validation 2021-08-25 09:31:21 +02:00
Trong Huu Nguyen
f63bade2b9 chore: remove obsolete fixme, redundant type conversion 2021-08-25 09:29:01 +02:00
Trong Huu Nguyen
de619c6e89 refactor: add constructor for routing handler to deduplicate config 2021-08-25 09:21:40 +02:00
Trong Huu Nguyen
03a14eb2bd refactor: clean up id_token validation 2021-08-25 08:22:34 +02:00
Kim Tore Jensen
55f26fb54c incorporate new session storage code 2021-08-24 12:58:16 +02:00
Trong Huu Nguyen
2becde51b9 add front-channel logout test 
Co-Authored-By: Kim Tore Jensen <kim.tore.jensen@nav.no>
 2021-08-24 10:52:00 +02:00
Trong Huu Nguyen
b7dbb000aa test self-initiated logout 
Co-Authored-By: Kim Tore Jensen <kim.tore.jensen@nav.no>
 2021-08-24 10:31:49 +02:00
Kent Daleng
1f58b5ae15 write callback test 
Co-Authored-By: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
 2021-08-24 10:02:21 +02:00
Trong Huu Nguyen
cf8b4d56cc fix: set path for cookies 2021-08-24 08:49:57 +02:00
Trong Huu Nguyen
43cb01ad00 wip: idporten mock server 2021-08-24 07:44:05 +02:00
Kim Tore Jensen
9354ee7629 wip: mock authorization server 2021-08-23 15:12:47 +02:00