forked from openshift/osin
-
Notifications
You must be signed in to change notification settings - Fork 0
/
util.go
123 lines (110 loc) · 3.23 KB
/
util.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
package osin
import (
"encoding/base64"
"errors"
"strings"
"github.com/valyala/fasthttp"
)
// Parse basic authentication header
type BasicAuth struct {
Username string
Password string
}
// Parse bearer authentication header
type BearerAuth struct {
Code string
}
// CheckClientSecret determines whether the given secret matches a secret held by the client.
// Public clients return true for a secret of ""
func CheckClientSecret(client Client, secret string) bool {
switch client := client.(type) {
case ClientSecretMatcher:
// Prefer the more secure method of giving the secret to the client for comparison
return client.ClientSecretMatches(secret)
}
// Fallback to the less secure method of extracting the plain text secret from the client for comparison
return client.GetSecret() == secret
}
// Return authorization header data
func CheckBasicAuth(r *fasthttp.RequestCtx) (*BasicAuth, error) {
if getFormValue(r, "Authorization") == "" {
return nil, nil
}
s := strings.SplitN(getFormValue(r, "Authorization"), " ", 2)
if len(s) != 2 || s[0] != "Basic" {
return nil, errors.New("Invalid authorization header")
}
b, err := base64.StdEncoding.DecodeString(s[1])
if err != nil {
return nil, err
}
pair := strings.SplitN(string(b), ":", 2)
if len(pair) != 2 {
return nil, errors.New("Invalid authorization message")
}
return &BasicAuth{Username: pair[0], Password: pair[1]}, nil
}
// Return "Bearer" token from request. The header has precedence over query string.
func CheckBearerAuth(r *fasthttp.RequestCtx) *BearerAuth {
authHeader := getFormValue(r, "Authorization")
authForm := getFormValue(r, "code")
if authHeader == "" && authForm == "" {
return nil
}
token := authForm
if authHeader != "" {
s := strings.SplitN(authHeader, " ", 2)
if (len(s) != 2 || strings.ToLower(s[0]) != "bearer") && token == "" {
return nil
}
//Use authorization header token only if token type is bearer else query string access token would be returned
if len(s) > 0 && strings.ToLower(s[0]) == "bearer" {
token = s[1]
}
}
return &BearerAuth{Code: token}
}
// getClientAuth checks client basic authentication in params if allowed,
// otherwise gets it from the header.
// Sets an error on the response if no auth is present or a server error occurs.
func getClientAuth(w *Response, r *fasthttp.RequestCtx, allowQueryParams bool) *BasicAuth {
if allowQueryParams {
// Allow for auth without password
client_secret := getFormValue(r, "client_secret")
if client_secret != "" {
auth := &BasicAuth{
Username: getFormValue(r, "client_id"),
Password: client_secret,
}
if auth.Username != "" {
return auth
}
}
}
auth, err := CheckBasicAuth(r)
if err != nil {
w.SetError(E_INVALID_REQUEST, "")
w.InternalError = err
return nil
}
if auth == nil {
w.SetError(E_INVALID_REQUEST, "")
w.InternalError = errors.New("Client authentication not sent")
return nil
}
return auth
}
func getFormValue(r *fasthttp.RequestCtx, key string) string {
ret := r.FormValue(key)
//ret := r.QueryArgs().Peek(key)
//if ret == nil {
// r.FormValue(key)
// ret = r.PostArgs().Peek(key)
//}
if ret == nil {
println("getFormValue ", key, ":")
return ""
}
println("getFormValue ", key, ":", string(ret))
return string(ret)
}