3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-07-01 00:48:17 +02:00
Code Issues Projects Releases Packages Wiki Activity

fix webauthn url (#3983)

Browse source
This commit is contained in:
Caleb Doxsey 2023-02-17 06:58:43 -07:00 • committed by github-actions[bot]
parent df8afa29f6
commit dda84ee742
1 changed files with 3 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

16
authorize/check_response.go
View file

@ -225,24 +225,16 @@ func (a *Authorize) requireWebAuthnResponse(
) (*envoy_service_auth_v3.CheckResponse, error) { ) (*envoy_service_auth_v3.CheckResponse, error) {
opts := a.currentOptions.Load() opts := a.currentOptions.Load()
state := a.state.Load() state := a.state.Load()
authenticateURL, err := opts.GetAuthenticateURL()
if err != nil {
return nil, err
}
if !a.shouldRedirect(in) { if !a.shouldRedirect(in) {
return a.deniedResponse(ctx, in, http.StatusUnauthorized, http.StatusText(http.StatusUnauthorized), nil) return a.deniedResponse(ctx, in, http.StatusUnauthorized, http.StatusText(http.StatusUnauthorized), nil)
} }
signinURL := authenticateURL.ResolveReference(&url.URL{
Path: "/.pomerium/webauthn",
})
q := signinURL.Query()
// always assume https scheme // always assume https scheme
checkRequestURL := getCheckRequestURL(in) checkRequestURL := getCheckRequestURL(in)
checkRequestURL.Scheme = "https" checkRequestURL.Scheme = "https"
q := url.Values{}
if deviceType, ok := result.Allow.AdditionalData["device_type"].(string); ok { if deviceType, ok := result.Allow.AdditionalData["device_type"].(string); ok {
q.Set(urlutil.QueryDeviceType, deviceType) q.Set(urlutil.QueryDeviceType, deviceType)
} else if deviceType, ok := result.Deny.AdditionalData["device_type"].(string); ok { } else if deviceType, ok := result.Deny.AdditionalData["device_type"].(string); ok {
@ -256,11 +248,9 @@ func (a *Authorize) requireWebAuthnResponse(
return nil, err return nil, err
} }
q.Set(urlutil.QueryIdentityProviderID, idp.GetId()) q.Set(urlutil.QueryIdentityProviderID, idp.GetId())
signinURL.RawQuery = q.Encode() signinURL := urlutil.WebAuthnURL(getHTTPRequestFromCheckRequest(in), &checkRequestURL, state.sharedKey, q)
redirectTo := urlutil.NewSignedURL(state.sharedKey, signinURL).String()
return a.deniedResponse(ctx, in, http.StatusFound, "Login", map[string]string{ return a.deniedResponse(ctx, in, http.StatusFound, "Login", map[string]string{
"Location": redirectTo, "Location": signinURL,
}) })
} }