github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-05-08 17:37:01 +00:00
Code Issues Packages Projects Releases Wiki Activity
380 Commits 2 Branches 0 Tags
f093fd549ea759e7880cd8666e04a95fa8fd5cc3
Commit Graph

380 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Trong Huu Nguyen
f093fd549e fix(autologin): ignore trailing slash in request paths during matching 2022-09-21 08:41:13 +02:00
Trong Huu Nguyen
4a0f41e8c2 fix(loginstatus): clear more cookies on logout 2022-09-20 10:06:42 +02:00
Trong Huu Nguyen
f6cf60a013 refactor(handler/reverseproxy): improve log messages 2022-09-20 08:00:57 +02:00
Trong Huu Nguyen
e5a285887c refactor(handler/url): extract redirect url decoder method 2022-09-19 21:14:22 +02:00
Trong Huu Nguyen
80738f2a4b fix(handler/url): use base64 encoding for redirects to preserve query parameters 
Load balancers or reverse proxies may rewrite or modify the Location
header and unescape its value, which would result in redirects not
preserving the original set of query parameters. This was especially
evident for autologins where we need to redirect to `/oauth2/login` with
the `redirect` parameter containing the original requested URL so that
the end-user ultimately ends up at the latter URL.

We avoid this issue by base64-encoding the original URL, before passing
it along as the intended redirect for the login route.
To preserve existing behaviour, we use a separate query parameter
for the `/oauth2/login`-endpoint that accepts and handles base64-encoded
values.
 2022-09-19 11:51:30 +02:00
Trong Huu Nguyen
97d2a88bb1 fix(handler/url): ensure that parameters for original url aren't dropped 2022-09-19 08:41:25 +02:00
Trong Huu Nguyen
ed56aac3d0 style: follow conventions for error variable names 2022-09-19 08:41:23 +02:00
Trong Huu Nguyen
b8785b7414 style: use shorthand time functions where possible 2022-09-19 08:41:21 +02:00
Trong Huu Nguyen
d718c36595 style(openid/client): remove unused struct field 2022-09-19 08:41:20 +02:00
Trong Huu Nguyen
d732a5b3cd test(session/store): add missing assertion 2022-09-19 08:41:18 +02:00
Trong Huu Nguyen
62f0359438 fix(handler/autologin): ensure path has prefix 2022-09-19 08:41:17 +02:00
Trong Huu Nguyen
9af867bf91 chore: bump deps 2022-09-19 08:41:14 +02:00
Trong Huu Nguyen
889e0c8edf feat(middleware/correlationid): use x-request-id header if found in request 2022-09-19 08:41:14 +02:00
Trong Huu Nguyen
b68877b963 fix(ingress): also use X-Forwarded-Host for match operation 2022-09-19 08:41:09 +02:00
Jan-Kåre Solbakken
5a385622d8 Merge pull request #51 from nais/dependabot/go_modules/github.com/spf13/viper-1.13.0 
build(deps): bump github.com/spf13/viper from 1.12.0 to 1.13.0
 2022-09-19 08:33:43 +02:00
Jan-Kåre Solbakken
4fddbaa4df Merge branch 'master' into dependabot/go_modules/github.com/spf13/viper-1.13.0 2022-09-19 08:11:47 +02:00
dependabot[bot]
2fd76001d8 build(deps): bump github.com/spf13/viper from 1.12.0 to 1.13.0 
Bumps [github.com/spf13/viper](https://github.com/spf13/viper) from 1.12.0 to 1.13.0.
- [Release notes](https://github.com/spf13/viper/releases)
- [Commits](https://github.com/spf13/viper/compare/v1.12.0...v1.13.0)

---
updated-dependencies:
- dependency-name: github.com/spf13/viper
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-09-12 19:24:24 +00:00
Trong Huu Nguyen
b4eecfc663 fix(handler/autologin): only trigger for GET requests 2022-09-12 12:33:42 +02:00
Trong Huu Nguyen
43c39c89ad refactor(handler/reverseproxy): skip logging for client context cancellation 2022-09-12 12:32:37 +02:00
Trong Huu Nguyen
fcc6a7472c fix(handler/autologin): return http 303 for autologin redirects 2022-09-09 14:38:46 +02:00
Trong Huu Nguyen
a4ceaeaacc feat(handler/autologin): add favicon.ico and robots.txt to default ignorelist 2022-09-09 13:09:36 +02:00
Trong Huu Nguyen
7f93c62604 fix(openid/client): handle missing redirect uri for callbacks 2022-09-09 12:31:17 +02:00
Trong Huu Nguyen
27d2bc2c26 fix(session/handler): log errors for lock release failures 2022-09-09 10:19:22 +02:00
Trong Huu Nguyen
69ebd9270f refactor(handler/reverseproxy): improve log messages 2022-09-09 10:18:39 +02:00
Trong Huu Nguyen
f830ff575c docs: clarify session refresh cooldown mechanism 2022-09-08 16:42:11 +02:00
Trong Huu Nguyen
84d521e968 feat(reverseproxy): configure errorlog to use logrus implementation 2022-09-06 15:34:32 +02:00
Trong Huu Nguyen
00b39276df debug(handler/reverseproxy): log proxy errors 2022-09-06 08:46:41 +02:00
Trong Huu Nguyen
3f24537b36 fix(openid/client): set iat for assertion in the past to alleviate clock skew 2022-09-06 08:46:35 +02:00
Trong Huu Nguyen
b22c130e60 fix(session/handler): invalidate session state if refresh attempt is a client error 
A client error response for the refresh grant is assumed to be an
irrecoverable error; e.g. the refresh token is invalid, the
authorization is invalid, user is logged out, etc. In such cases we will
consider the session state to be invalid, and a new authorization grant
should be performed.
 2022-09-04 17:15:40 +02:00
Trong Huu Nguyen
c0138f4b49 feat(session): use locks for refreshing 
One of the changes in OAuth 2.1 addresses attacks with refresh token
replays by recommending the use of one-time use tokens. A refresh token
is thus rotated and invalid after exactly one use, returning a new token
for each successful grant. Any further attempts must thus use the most
recently acquired refresh token. Reusing a refresh token may also
cause the authorization server to invalidate the current active refresh
token, requiring a refresh authorization grant to be reacquired for
further refresh token usage.

The use of locks prevents multiple refresh grant attempts for a given
session from happening across concurrent requests.
 2022-09-04 17:14:35 +02:00
Trong Huu Nguyen
989aa1e998 refactor(middleware/logentry): add fields to default logger 2022-09-03 20:05:28 +02:00
Trong Huu Nguyen
c78674e54a fix(session/store): check for existence before update 2022-09-03 16:48:37 +02:00
Trong Huu Nguyen
2a80bd7765 refactor(mock/openid): use interface for handler 2022-09-02 18:43:59 +02:00
Trong Huu Nguyen
08eefbf1d5 refactor(openid): clean up client and provider 2022-09-02 18:08:36 +02:00
Trong Huu Nguyen
92ee6313c5 refactor: remove unnecessary interfaces 2022-09-02 17:39:27 +02:00
Trong Huu Nguyen
c8f48335d4 refactor(openid/config): extract getter for ingresses 2022-09-02 15:17:36 +02:00
Trong Huu Nguyen
9144056e28 refactor(handler): split up request handlers into separate modules 2022-09-02 14:53:11 +02:00
Trong Huu Nguyen
5d00d132dd refactor: decouple handler implementation from router and middleware 2022-09-01 19:39:47 +02:00
Trong Huu Nguyen
d9cc60c4cc refactor: move autologin to handler pkg 2022-09-01 19:35:58 +02:00
Trong Huu Nguyen
619ae52d45 refactor: separate refresh-specific fields from session info; enable endpoint without refresh feature 2022-09-01 19:35:48 +02:00
Trong Huu Nguyen
06b71cf56d docs: clarify endpoint usage, add notes on session management and refresh tokens 2022-09-01 19:33:22 +02:00
Trong Huu Nguyen
9d7732fc25 deps: bump em 2022-08-31 08:50:09 +02:00
Trong Huu Nguyen
cdba90bc5b test(session/data): add missing tests 2022-08-29 14:48:39 +02:00
Trong Huu Nguyen
af48778bf7 fix(session/handler): lock metadata operations behind feature gate until rollout 2022-08-29 10:00:43 +02:00
Trong Huu Nguyen
cdd07838f4 refactor(session/data): separate into object groups 2022-08-29 08:35:03 +02:00
Trong Huu Nguyen
1d9339e139 refactor(session/handler): extract predicates for readability 2022-08-26 18:09:40 +02:00
Trong Huu Nguyen
5ec969981d fix(session/handler): ensure access token is not expired before proxying 2022-08-26 17:58:39 +02:00
Trong Huu Nguyen
d5bbca9897 feat: rudimentary support for refresh tokens 2022-08-26 14:32:39 +02:00
Trong Huu Nguyen
dc0741f79f refactor(middleware): extract handlers for consistency 2022-08-26 08:34:07 +02:00
Trong Huu Nguyen
4d7502a4be refactor(middleware/logentry): strip query and fragment from referer logs 2022-08-25 22:31:01 +02:00