happyDomain/happyDomain
happyDomain
/
happyDomain
1
0
Fork 0
Code Issues 1 Pull Requests 4 Releases Activity

Force cookie refresh during auth check in NO_AUTH context
continuous-integration/drone/push Build is passing Details 

Bug: https://github.com/happyDomain/happydomain/issues/1
This commit is contained in:
nemunaire 2023-09-07 10:20:50 +02:00
parent 4e17658d88
commit 653a8c02e2
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
api/auth.go
View File

@ -167,6 +167,10 @@ func authMiddleware(opts *config.Options, optional bool) gin.HandlerFunc {
return []byte(opts.JWTSecretKey), nil
}, jwt.WithValidMethods([]string{signingMethod.Name}))
if err != nil {
if opts.NoAuth {
claims = displayNotAuthToken(opts, c)
}
log.Printf("%s provide a bad JWT claims: %s", c.ClientIP(), err.Error())
c.SetCookie(COOKIE_NAME, "", -1, opts.BaseURL+"/", "", opts.DevProxy == "", true)
requireLogin(opts, c, "Something went wrong with your session. Please reconnect.")
@ -174,7 +178,7 @@ func authMiddleware(opts *config.Options, optional bool) gin.HandlerFunc {
}
// Check that required fields are filled
if len(claims.Profile.UserId) == 0 {
if claims == nil || len(claims.Profile.UserId) == 0 {
log.Printf("%s: no UserId found in JWT claims", c.ClientIP())
c.SetCookie(COOKIE_NAME, "", -1, opts.BaseURL+"/", "", opts.DevProxy == "", true)
requireLogin(opts, c, "Something went wrong with your session. Please reconnect.")

8
api/user_auth.go
View File

@ -110,10 +110,10 @@ func displayAuthToken(c *gin.Context) {
c.JSON(http.StatusOK, currentUser(user))
}
func displayNotAuthToken(opts *config.Options, c *gin.Context) {
func displayNotAuthToken(opts *config.Options, c *gin.Context) *UserClaims {
if !opts.NoAuth {
requireLogin(opts, c, "Authorization required")
return
return nil
}
claims, err := completeAuth(opts, c, UserProfile{
@ -124,7 +124,7 @@ func displayNotAuthToken(opts *config.Options, c *gin.Context) {
if err != nil {
log.Printf("%s %s", c.ClientIP(), err.Error())
c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"errmsg": "Something went wrong during your authentication. Please retry in a few minutes"})
return
return nil
}
realUser, err := retrieveUserFromClaims(claims)
@ -133,6 +133,8 @@ func displayNotAuthToken(opts *config.Options, c *gin.Context) {
} else {
c.JSON(http.StatusOK, currentUser(realUser))
}
return claims
}
// logout closes the user session.