mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-28 18:06:34 +02:00
b7896b3153
Consolidate all logic specific to the stateless authenticate flow into a a new Stateless type in a new package internal/authenticateflow. This is in preparation for adding a new Stateful type implementing the older stateful authenticate flow (from Pomerium v0.20 and previous). This change is intended as a pure refactoring of existing logic, with no changes in functionality.
33 lines
1.1 KiB
Go
33 lines
1.1 KiB
Go
package authenticate
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/pomerium/pomerium/internal/httputil"
|
|
"github.com/pomerium/pomerium/internal/urlutil"
|
|
)
|
|
|
|
// requireValidSignatureOnRedirect validates the pomerium_signature if a redirect_uri or pomerium_signature
|
|
// is present on the query string.
|
|
func (a *Authenticate) requireValidSignatureOnRedirect(next httputil.HandlerFunc) http.Handler {
|
|
return httputil.HandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
|
|
if r.FormValue(urlutil.QueryRedirectURI) != "" || r.FormValue(urlutil.QueryHmacSignature) != "" {
|
|
err := a.state.Load().flow.VerifyAuthenticateSignature(r)
|
|
if err != nil {
|
|
return httputil.NewError(http.StatusBadRequest, err)
|
|
}
|
|
}
|
|
return next(w, r)
|
|
})
|
|
}
|
|
|
|
// requireValidSignature validates the pomerium_signature.
|
|
func (a *Authenticate) requireValidSignature(next httputil.HandlerFunc) http.Handler {
|
|
return httputil.HandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
|
|
err := a.state.Load().flow.VerifyAuthenticateSignature(r)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return next(w, r)
|
|
})
|
|
}
|