3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-03 16:59:22 +02:00
Code Issues Projects Releases Packages Wiki Activity

authenticate: only use csrf none for apple (#3979)

Browse source
This commit is contained in:
Caleb Doxsey 2023-02-16 08:52:39 -07:00 • committed by GitHub
parent 3f2a3d6f23
commit b62efeb16c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
authenticate/handlers.go
View file

@ -20,6 +20,7 @@ import (
"github.com/pomerium/pomerium/internal/handlers"
"github.com/pomerium/pomerium/internal/httputil"
"github.com/pomerium/pomerium/internal/identity"
"github.com/pomerium/pomerium/internal/identity/oauth/apple"
"github.com/pomerium/pomerium/internal/identity/oidc"
"github.com/pomerium/pomerium/internal/log"
"github.com/pomerium/pomerium/internal/middleware"
@ -45,8 +46,7 @@ func (a *Authenticate) Mount(r *mux.Router) {
options := a.options.Load()
state := a.state.Load()
csrfKey := fmt.Sprintf("%s_csrf", options.CookieName)
return csrf.Protect(
state.cookieSecret,
csrfOptions := []csrf.Option{
csrf.Secure(options.CookieSecure),
csrf.Path("/"),
csrf.UnsafePaths(
@ -56,12 +56,19 @@ func (a *Authenticate) Mount(r *mux.Router) {
csrf.FormValueName("state"), // rfc6749#section-10.12
csrf.CookieName(csrfKey),
csrf.FieldName(csrfKey),
csrf.ErrorHandler(httputil.HandlerFunc(httputil.CSRFFailureHandler)),
}
if options.Provider == apple.Name {
// csrf.SameSiteLaxMode will cause browsers to reset
// the session on POST. This breaks Appleid being able
// to verify the csrf token.
csrf.SameSite(csrf.SameSiteNoneMode),
csrf.ErrorHandler(httputil.HandlerFunc(httputil.CSRFFailureHandler)),
)(h)
csrfOptions = append(csrfOptions, csrf.SameSite(csrf.SameSiteNoneMode))
} else {
csrfOptions = append(csrfOptions, csrf.SameSite(csrf.SameSiteLaxMode))
}
return csrf.Protect(state.cookieSecret, csrfOptions...)(h)
})
// redirect / to /.pomerium/