3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-06 10:21:05 +02:00
Code Issues Projects Releases Packages Wiki Activity

authenticate: only use csrf none for apple (#3979)

Browse source
This commit is contained in:
Caleb Doxsey 2023-02-16 08:52:39 -07:00 • committed by GitHub
parent 3f2a3d6f23
commit b62efeb16c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
authenticate/handlers.go
View file

@ -20,6 +20,7 @@ import (
"github.com/pomerium/pomerium/internal/handlers" "github.com/pomerium/pomerium/internal/handlers"
"github.com/pomerium/pomerium/internal/httputil" "github.com/pomerium/pomerium/internal/httputil"
"github.com/pomerium/pomerium/internal/identity" "github.com/pomerium/pomerium/internal/identity"
"github.com/pomerium/pomerium/internal/identity/oauth/apple"
"github.com/pomerium/pomerium/internal/identity/oidc" "github.com/pomerium/pomerium/internal/identity/oidc"
"github.com/pomerium/pomerium/internal/log" "github.com/pomerium/pomerium/internal/log"
"github.com/pomerium/pomerium/internal/middleware" "github.com/pomerium/pomerium/internal/middleware"
@ -45,8 +46,7 @@ func (a *Authenticate) Mount(r *mux.Router) {
options := a.options.Load() options := a.options.Load()
state := a.state.Load() state := a.state.Load()
csrfKey := fmt.Sprintf("%s_csrf", options.CookieName) csrfKey := fmt.Sprintf("%s_csrf", options.CookieName)
return csrf.Protect( csrfOptions := []csrf.Option{
state.cookieSecret,
csrf.Secure(options.CookieSecure), csrf.Secure(options.CookieSecure),
csrf.Path("/"), csrf.Path("/"),
csrf.UnsafePaths( csrf.UnsafePaths(
@ -56,12 +56,19 @@ func (a *Authenticate) Mount(r *mux.Router) {
csrf.FormValueName("state"), // rfc6749#section-10.12 csrf.FormValueName("state"), // rfc6749#section-10.12
csrf.CookieName(csrfKey), csrf.CookieName(csrfKey),
csrf.FieldName(csrfKey), csrf.FieldName(csrfKey),
csrf.ErrorHandler(httputil.HandlerFunc(httputil.CSRFFailureHandler)),
}
if options.Provider == apple.Name {
// csrf.SameSiteLaxMode will cause browsers to reset // csrf.SameSiteLaxMode will cause browsers to reset
// the session on POST. This breaks Appleid being able // the session on POST. This breaks Appleid being able
// to verify the csrf token. // to verify the csrf token.
csrf.SameSite(csrf.SameSiteNoneMode), csrfOptions = append(csrfOptions, csrf.SameSite(csrf.SameSiteNoneMode))
csrf.ErrorHandler(httputil.HandlerFunc(httputil.CSRFFailureHandler)), } else {
)(h) csrfOptions = append(csrfOptions, csrf.SameSite(csrf.SameSiteLaxMode))
}
return csrf.Protect(state.cookieSecret, csrfOptions...)(h)
}) })
// redirect / to /.pomerium/ // redirect / to /.pomerium/