forked from 0x2E/fusion
01cc024981
Resolves #53 This fixes a bug I accidentally introduced by misunderstanding the echo session package. I thought that calling session.Get would return an error if no session existed for the session token valule. It seems that instead, if a session doesn't exist, session.Get creates one on-demand. To fix this, we have to check the IsNew field of the session to see if calling session.Get created this session on-demand or if this was a session that was previously created in the Create function. I introduced this bug in #43.
88 lines
2.2 KiB
Go
88 lines
2.2 KiB
Go
package api
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
|
|
"github.com/0x2e/fusion/auth"
|
|
"github.com/labstack/echo-contrib/session"
|
|
"github.com/labstack/echo/v4"
|
|
)
|
|
|
|
type Session struct {
|
|
PasswordHash auth.HashedPassword
|
|
UseSecureCookie bool
|
|
}
|
|
|
|
// sessionKeyName is the name of the key in the session store, and it's also the
|
|
// client-visible name of the HTTP cookie for the session.
|
|
const sessionKeyName = "session-token"
|
|
|
|
func (s Session) Create(c echo.Context) error {
|
|
var req struct {
|
|
Password string `json:"password" validate:"required"`
|
|
}
|
|
|
|
if err := bindAndValidate(&req, c); err != nil {
|
|
return err
|
|
}
|
|
|
|
attemptedPasswordHash, err := auth.HashPassword(req.Password)
|
|
if err != nil {
|
|
return echo.NewHTTPError(http.StatusUnauthorized, "Invalid password")
|
|
}
|
|
|
|
if correctPasswordHash := s.PasswordHash; !attemptedPasswordHash.Equals(correctPasswordHash) {
|
|
return echo.NewHTTPError(http.StatusUnauthorized, "Wrong password")
|
|
}
|
|
|
|
sess, err := session.Get(sessionKeyName, c)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if !s.UseSecureCookie {
|
|
sess.Options.Secure = false
|
|
sess.Options.SameSite = http.SameSiteDefaultMode
|
|
}
|
|
|
|
if err := sess.Save(c.Request(), c.Response()); err != nil {
|
|
return c.NoContent(http.StatusInternalServerError)
|
|
}
|
|
|
|
return c.NoContent(http.StatusCreated)
|
|
}
|
|
|
|
func (s Session) Check(c echo.Context) error {
|
|
sess, err := session.Get(sessionKeyName, c)
|
|
if err != nil {
|
|
// If the session token is invalid, advise the client browser to delete the
|
|
// session token cookie.
|
|
sess.Options.MaxAge = -1
|
|
// Deliberately swallow the error because we're already returning a more
|
|
// important error.
|
|
sess.Save(c.Request(), c.Response())
|
|
return err
|
|
}
|
|
|
|
// If IsNew is true, it means that Get created a new session on-demand rather
|
|
// than retrieving a previously authenticated session.
|
|
if sess.IsNew {
|
|
return errors.New("invalid session")
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (s Session) Delete(c echo.Context) error {
|
|
sess, err := session.Get(sessionKeyName, c)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
sess.Options.MaxAge = -1
|
|
if err := sess.Save(c.Request(), c.Response()); err != nil {
|
|
return c.NoContent(http.StatusInternalServerError)
|
|
}
|
|
|
|
return c.NoContent(http.StatusNoContent)
|
|
}
|