forked from pydio/cells
-
Notifications
You must be signed in to change notification settings - Fork 0
/
session.go
127 lines (111 loc) · 3.6 KB
/
session.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
package frontend
import (
"context"
"encoding/base64"
"net/http"
"net/url"
"strings"
"sync"
"github.com/gorilla/securecookie"
"github.com/gorilla/sessions"
"go.uber.org/zap"
"github.com/pydio/cells/common"
"github.com/pydio/cells/common/auth"
"github.com/pydio/cells/common/config"
"github.com/pydio/cells/common/log"
"github.com/pydio/cells/common/utils/net"
)
var (
sessionStores map[string]*sessions.CookieStore
sessionStoresLock *sync.Mutex
knownKey []byte
)
func init() {
sessionStores = make(map[string]*sessions.CookieStore)
sessionStoresLock = &sync.Mutex{}
}
func loadKey() []byte {
if knownKey != nil {
return knownKey
}
val := config.Get("frontend", "session", "secureKey").String()
if val != "" {
if kk, e := base64.StdEncoding.DecodeString(val); e == nil {
knownKey = kk
return knownKey
} else {
log.Logger(context.Background()).Error("Failed loading secure key from config, session may not be persisted after restart!", zap.Error(e))
}
}
knownKey = securecookie.GenerateRandomKey(64)
val = base64.StdEncoding.EncodeToString(knownKey)
config.Get("frontend", "session", "secureKey").Set(val)
if e := config.Save(common.PydioSystemUsername, "Generating session random key"); e != nil {
log.Logger(context.Background()).Error("Failed saving secure key to config, session will not be persisted after restart!", zap.Error(e))
}
return knownKey
}
func storeForUrl(u *url.URL) sessions.Store {
key := u.Scheme + "://" + u.Hostname()
sessionStoresLock.Lock()
defer sessionStoresLock.Unlock()
if ss, o := sessionStores[key]; o {
return ss
}
pKey := loadKey()
ss := sessions.NewCookieStore(pKey)
timeout := config.Get("frontend", "plugin", "gui.ajax", "SESSION_TIMEOUT").Default(60).Int()
ss.Options = &sessions.Options{
Path: "/a/frontend",
MaxAge: 60 * timeout,
HttpOnly: true,
}
if u.Scheme == "https" {
ss.Options.Secure = true
}
ss.Options.Domain = u.Hostname()
sessionStores[key] = ss
return ss
}
func GetSessionStore(req *http.Request) sessions.Store {
u := net.ExternalDomainFromRequest(req)
return storeForUrl(u)
}
// NewSessionWrapper creates a Http middleware checking if a cookie is passed
// along and if this cookie contains a proper JWT.
// The excludes parameter may be used to namely ignore specific "METHOD:/URI“ for this check.
func NewSessionWrapper(h http.Handler, excludes ...string) http.Handler {
jwtVerifier := auth.DefaultJWTVerifier()
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
for _, excluded := range excludes {
split := strings.Split(excluded, ":")
method := split[0]
uri := split[1]
if strings.ToLower(method) == strings.ToLower(r.Method) && strings.HasPrefix(r.RequestURI, uri) {
log.Logger(r.Context()).Debug("Skipping session wrapper by exclusion:" + excluded)
h.ServeHTTP(w, r)
return
}
}
sessionName := "pydio"
if h, ok := r.Header["X-Pydio-Minisite"]; ok {
sessionName = sessionName + "-" + strings.Join(h, "")
}
if h, ok := r.Header[common.XPydioFrontendSessionUuid]; ok {
sessionName = sessionName + "-" + strings.Join(h, "")
}
session, err := GetSessionStore(r).Get(r, sessionName)
if err != nil && !strings.Contains(err.Error(), "securecookie: the value is not valid") {
log.Logger(r.Context()).Error("Cannot retrieve session", zap.Error(err))
}
if value, ok := session.Values["access_token"]; ok {
ctx := r.Context()
if ctx, _, err = jwtVerifier.Verify(ctx, value.(string)); err == nil {
// Update context
log.Logger(ctx).Debug("Found token in session " + sessionName)
r = r.WithContext(ctx)
}
}
h.ServeHTTP(w, r)
})
}