3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-06-05 12:23:03 +02:00
Code Issues Projects Releases Packages Wiki Activity

crypto: use actual bytes of shared secret, not the base64 encoded representation (#2075)

Browse source 
* crypto: use actual bytes of shared secret, not the base64 encoded representation

* return errors

* return errors
This commit is contained in:
Caleb Doxsey 2021-04-08 20:04:01 -06:00 • committed by GitHub
parent 7a04b16163
commit 6d1d2bec54
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 71 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

7
authenticate/handlers.go
View file

@ -79,7 +79,7 @@ func (a *Authenticate) mountDashboard(r *mux.Router) {
c := cors.New(cors.Options{
AllowOriginRequestFunc: func(r *http.Request, _ string) bool {
state := a.state.Load()
err := middleware.ValidateRequestURL(r, state.sharedSecret)
err := middleware.ValidateRequestURL(r, state.sharedKey)
if err != nil {
log.FromRequest(r).Info().Err(err).Msg("authenticate: origin blocked")
}
@ -175,7 +175,6 @@ func (a *Authenticate) SignIn(w http.ResponseWriter, r *http.Request) error {
ctx, span := trace.StartSpan(r.Context(), "authenticate.SignIn")
defer span.End()
options := a.options.Load()
state := a.state.Load()
redirectURL, err := urlutil.ParseAndValidateURL(r.FormValue(urlutil.QueryRedirectURI))
@ -243,7 +242,7 @@ func (a *Authenticate) SignIn(w http.ResponseWriter, r *http.Request) error {
// build our hmac-d redirect URL with our session, pointing back to the
// proxy's callback URL which is responsible for setting our new route-session
uri := urlutil.NewSignedURL([]byte(options.SharedKey), callbackURL)
uri := urlutil.NewSignedURL(state.sharedKey, callbackURL)
httputil.Redirect(w, r, uri.String(), http.StatusFound)
return nil
}
@ -606,5 +605,5 @@ func (a *Authenticate) getSignOutURL(r *http.Request) (*url.URL, error) {
urlutil.QueryRedirectURI: {redirectURI},
}).Encode()
}
return urlutil.NewSignedURL([]byte(a.options.Load().SharedKey), uri).Sign(), nil
return urlutil.NewSignedURL(a.state.Load().sharedKey, uri).Sign(), nil
}