mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-30 19:06:33 +02:00
8d1732582e
authenticate: unmarshal and verify state from jwt, instead of middleware
authorize: embed opa policy using statik
authorize: have IsAuthorized handle authorization for all routes
authorize: if no signing key is provided, one is generated
authorize: remove IsAdmin grpc endpoint
authorize/client: return authorize decision struct
cmd/pomerium: main logger no longer contains email and group
cryptutil: add ECDSA signing methods
dashboard: have impersonate form show up for all users, but have api gated by authz
docs: fix typo in signed jwt header
encoding/jws: remove unused es256 signer
frontend: namespace static web assets
internal/sessions: remove leeway to match authz policy
proxy: move signing functionality to authz
proxy: remove jwt attestation from proxy (authZ does now)
proxy: remove non-signed headers from headers
proxy: remove special handling of x-forwarded-host
sessions: do not verify state in middleware
sessions: remove leeway from state to match authz
sessions/{all}: store jwt directly instead of state
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
71 lines
2 KiB
Go
71 lines
2 KiB
Go
// Package queryparam provides a query param based implementation of a both
|
|
// as session store and loader.
|
|
package queryparam // import "github.com/pomerium/pomerium/internal/sessions/queryparam"
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/pomerium/pomerium/internal/encoding"
|
|
"github.com/pomerium/pomerium/internal/sessions"
|
|
)
|
|
|
|
var _ sessions.SessionStore = &Store{}
|
|
var _ sessions.SessionLoader = &Store{}
|
|
|
|
const (
|
|
defaultQueryParamKey = "pomerium_session"
|
|
)
|
|
|
|
// Store implements the load session store interface using http
|
|
// query strings / query parameters.
|
|
type Store struct {
|
|
queryParamKey string
|
|
encoder encoding.Marshaler
|
|
decoder encoding.Unmarshaler
|
|
}
|
|
|
|
// NewStore returns a new query param store for loading sessions from
|
|
// query strings / query parameters.
|
|
//
|
|
// NOTA BENE: By default, most servers _DO_ log query params, the leaking or
|
|
// accidental logging of which should be considered a security issue.
|
|
func NewStore(enc encoding.MarshalUnmarshaler, qp string) *Store {
|
|
if qp == "" {
|
|
qp = defaultQueryParamKey
|
|
}
|
|
return &Store{
|
|
queryParamKey: qp,
|
|
encoder: enc,
|
|
decoder: enc,
|
|
}
|
|
}
|
|
|
|
// LoadSession tries to retrieve the token string from URL query parameters.
|
|
func (qp *Store) LoadSession(r *http.Request) (string, error) {
|
|
jwt := r.URL.Query().Get(qp.queryParamKey)
|
|
if jwt == "" {
|
|
return "", sessions.ErrNoSessionFound
|
|
}
|
|
|
|
return jwt, nil
|
|
}
|
|
|
|
// ClearSession clears the session cookie from a request's query param key `pomerium_session`.
|
|
func (qp *Store) ClearSession(w http.ResponseWriter, r *http.Request) {
|
|
params := r.URL.Query()
|
|
params.Del(qp.queryParamKey)
|
|
r.URL.RawQuery = params.Encode()
|
|
}
|
|
|
|
// SaveSession sets a session to a request's query param key `pomerium_session`
|
|
func (qp *Store) SaveSession(w http.ResponseWriter, r *http.Request, x interface{}) error {
|
|
data, err := qp.encoder.Marshal(x)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
r.URL.Query().Get(qp.queryParamKey)
|
|
params := r.URL.Query()
|
|
params.Set(qp.queryParamKey, string(data))
|
|
r.URL.RawQuery = params.Encode()
|
|
return nil
|
|
}
|