Skip to content

Commit 1ebba7f

Browse files
lakhansamanilakhansamani
authored
Merge pull request #343 from authorizerdev/fix/session-storage
fix: session storage
2 parents c8fe05e + 428a0be commit 1ebba7f

26 files changed

+365
-167
lines changed

‎server/go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ require (
2121
github.com/joho/godotenv v1.3.0
2222
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
2323
github.com/pelletier/go-toml/v2 v2.0.5 // indirect
24+
github.com/redis/go-redis/v9 v9.0.3 // indirect
2425
github.com/robertkrimen/otto v0.0.0-20211024170158-b87d35c0b86f
2526
github.com/sirupsen/logrus v1.8.1
2627
github.com/stretchr/testify v1.8.0

‎server/go.sum‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,15 @@ github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932 h1:mXoPYz/Ul5HYE
5858
github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k=
5959
github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
6060
github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
61+
github.com/bsm/ginkgo/v2 v2.7.0/go.mod h1:AiKlXPm7ItEHNc/2+OkrNG4E0ITzojb9/xWzvQ9XZ9w=
62+
github.com/bsm/gomega v1.26.0/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
6163
github.com/cenkalti/backoff/v4 v4.1.2 h1:6Yo7N8UP2K6LWZnW94DLVSSrbobcWdVzAYOisuDPIFo=
6264
github.com/cenkalti/backoff/v4 v4.1.2/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
6365
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
6466
github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
6567
github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
68+
github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
69+
github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
6670
github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
6771
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
6872
github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -295,6 +299,8 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
295299
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
296300
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
297301
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
302+
github.com/redis/go-redis/v9 v9.0.3 h1:+7mmR26M0IvyLxGZUHxu4GiBkJkVDid0Un+j4ScYu4k=
303+
github.com/redis/go-redis/v9 v9.0.3/go.mod h1:WqMKv5vnQbRuZstUwxQI195wHy+t4PuXDOjzMvcuQHk=
298304
github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 h1:OdAsTTz6OkFY5QxjkYwrChwuRruF69c169dPK26NUlk=
299305
github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
300306
github.com/robertkrimen/otto v0.0.0-20211024170158-b87d35c0b86f h1:a7clxaGmmqtdNTXyvrp/lVO/Gnkzlhc/+dLs5v965GM=

‎server/handlers/authorize.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ func AuthorizeHandler() gin.HandlerFunc {
194194
// rollover the session for security
195195
go memorystore.Provider.DeleteUserSession(sessionKey, claims.Nonce)
196196
if responseType == constants.ResponseTypeCode {
197-
newSessionTokenData, newSessionToken, err := token.CreateSessionToken(user, nonce, claims.Roles, scope, claims.LoginMethod)
197+
newSessionTokenData, newSessionToken, newSessionExpiresAt, err := token.CreateSessionToken(user, nonce, claims.Roles, scope, claims.LoginMethod)
198198
if err != nil {
199199
log.Debug("CreateSessionToken failed: ", err)
200200
handleResponse(gc, responseMode, loginURL, redirectURI, loginError, http.StatusOK)
@@ -215,7 +215,7 @@ func AuthorizeHandler() gin.HandlerFunc {
215215
return
216216
}
217217

218-
if err := memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+newSessionTokenData.Nonce, newSessionToken); err != nil {
218+
if err := memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+newSessionTokenData.Nonce, newSessionToken, newSessionExpiresAt); err != nil {
219219
log.Debug("SetUserSession failed: ", err)
220220
handleResponse(gc, responseMode, loginURL, redirectURI, loginError, http.StatusOK)
221221
return
@@ -271,13 +271,13 @@ func AuthorizeHandler() gin.HandlerFunc {
271271
return
272272
}
273273

274-
if err := memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+nonce, authToken.FingerPrintHash); err != nil {
274+
if err := memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+nonce, authToken.FingerPrintHash, authToken.SessionTokenExpiresAt); err != nil {
275275
log.Debug("SetUserSession failed: ", err)
276276
handleResponse(gc, responseMode, loginURL, redirectURI, loginError, http.StatusOK)
277277
return
278278
}
279279

280-
if err := memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+nonce, authToken.AccessToken.Token); err != nil {
280+
if err := memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+nonce, authToken.AccessToken.Token, authToken.AccessToken.ExpiresAt); err != nil {
281281
log.Debug("SetUserSession failed: ", err)
282282
handleResponse(gc, responseMode, loginURL, redirectURI, loginError, http.StatusOK)
283283
return
@@ -305,7 +305,7 @@ func AuthorizeHandler() gin.HandlerFunc {
305305
if authToken.RefreshToken != nil {
306306
res["refresh_token"] = authToken.RefreshToken.Token
307307
params += "&refresh_token=" + authToken.RefreshToken.Token
308-
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+authToken.FingerPrint, authToken.RefreshToken.Token)
308+
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+authToken.FingerPrint, authToken.RefreshToken.Token, authToken.RefreshToken.ExpiresAt)
309309
}
310310

311311
if responseMode == constants.ResponseModeQuery {

‎server/handlers/logout.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,14 @@ func LogoutHandler() gin.HandlerFunc {
4747
return
4848
}
4949

50-
memorystore.Provider.DeleteUserSession(sessionData.Subject, sessionData.Nonce)
50+
userID := sessionData.Subject
51+
loginMethod := sessionData.LoginMethod
52+
sessionToken := userID
53+
if loginMethod != "" {
54+
sessionToken = loginMethod + ":" + userID
55+
}
56+
57+
memorystore.Provider.DeleteUserSession(sessionToken, sessionData.Nonce)
5158
cookie.DeleteSession(gc)
5259

5360
if redirectURL != "" {

‎server/handlers/oauth_callback.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -249,12 +249,12 @@ func OAuthCallbackHandler() gin.HandlerFunc {
249249

250250
sessionKey := provider + ":" + user.ID
251251
cookie.SetSession(ctx, authToken.FingerPrintHash)
252-
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+authToken.FingerPrint, authToken.FingerPrintHash)
253-
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+authToken.FingerPrint, authToken.AccessToken.Token)
252+
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+authToken.FingerPrint, authToken.FingerPrintHash, authToken.SessionTokenExpiresAt)
253+
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+authToken.FingerPrint, authToken.AccessToken.Token, authToken.AccessToken.ExpiresAt)
254254

255255
if authToken.RefreshToken != nil {
256256
params += `&refresh_token=` + authToken.RefreshToken.Token
257-
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+authToken.FingerPrint, authToken.RefreshToken.Token)
257+
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+authToken.FingerPrint, authToken.RefreshToken.Token, authToken.RefreshToken.ExpiresAt)
258258
}
259259

260260
go func() {

‎server/handlers/token.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -247,8 +247,8 @@ func TokenHandler() gin.HandlerFunc {
247247
return
248248
}
249249

250-
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+authToken.FingerPrint, authToken.FingerPrintHash)
251-
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+authToken.FingerPrint, authToken.AccessToken.Token)
250+
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+authToken.FingerPrint, authToken.FingerPrintHash, authToken.SessionTokenExpiresAt)
251+
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+authToken.FingerPrint, authToken.AccessToken.Token, authToken.AccessToken.ExpiresAt)
252252
cookie.SetSession(gc, authToken.FingerPrintHash)
253253

254254
expiresIn := authToken.AccessToken.ExpiresAt - time.Now().Unix()
@@ -266,7 +266,7 @@ func TokenHandler() gin.HandlerFunc {
266266

267267
if authToken.RefreshToken != nil {
268268
res["refresh_token"] = authToken.RefreshToken.Token
269-
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+authToken.FingerPrint, authToken.RefreshToken.Token)
269+
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+authToken.FingerPrint, authToken.RefreshToken.Token, authToken.RefreshToken.ExpiresAt)
270270
}
271271

272272
gc.JSON(http.StatusOK, res)

‎server/handlers/verify_email.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -154,12 +154,12 @@ func VerifyEmailHandler() gin.HandlerFunc {
154154

155155
sessionKey := loginMethod + ":" + user.ID
156156
cookie.SetSession(c, authToken.FingerPrintHash)
157-
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+authToken.FingerPrint, authToken.FingerPrintHash)
158-
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+authToken.FingerPrint, authToken.AccessToken.Token)
157+
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeSessionToken+"_"+authToken.FingerPrint, authToken.FingerPrintHash, authToken.SessionTokenExpiresAt)
158+
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+authToken.FingerPrint, authToken.AccessToken.Token, authToken.AccessToken.ExpiresAt)
159159

160160
if authToken.RefreshToken != nil {
161161
params = params + `&refresh_token=` + authToken.RefreshToken.Token
162-
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+authToken.FingerPrint, authToken.RefreshToken.Token)
162+
memorystore.Provider.SetUserSession(sessionKey, constants.TokenTypeRefreshToken+"_"+authToken.FingerPrint, authToken.RefreshToken.Token, authToken.RefreshToken.ExpiresAt)
163163
}
164164

165165
if redirectURL == "" {

‎server/memorystore/providers/inmemory/provider_test.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
package inmemory
2+
3+
import (
4+
"testing"
5+
6+
"github.com/authorizerdev/authorizer/server/memorystore/providers"
7+
"github.com/stretchr/testify/assert"
8+
)
9+
10+
func TestInMemoryProvider(t *testing.T) {
11+
p, err := NewInMemoryProvider()
12+
assert.NoError(t, err)
13+
providers.ProviderTests(t, p)
14+
}

‎server/memorystore/providers/inmemory/store.go‎

Lines changed: 11 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -8,45 +8,31 @@ import (
88
)
99

1010
// SetUserSession sets the user session for given user identifier in form recipe:user_id
11-
func (c *provider) SetUserSession(userId, key, token string) error {
12-
c.sessionStore.Set(userId, key, token)
11+
func (c *provider) SetUserSession(userId, key, token string, expiration int64) error {
12+
c.sessionStore.Set(userId, key, token, expiration)
1313
return nil
1414
}
1515

16-
// GetAllUserSessions returns all the user sessions token from the in-memory store.
17-
func (c *provider) GetAllUserSessions(userId string) (map[string]string, error) {
18-
data := c.sessionStore.GetAll(userId)
19-
return data, nil
20-
}
21-
2216
// GetUserSession returns value for given session token
2317
func (c *provider) GetUserSession(userId, sessionToken string) (string, error) {
24-
return c.sessionStore.Get(userId, sessionToken), nil
18+
val := c.sessionStore.Get(userId, sessionToken)
19+
if val == "" {
20+
return "", fmt.Errorf("Not found")
21+
}
22+
return val, nil
2523
}
2624

2725
// DeleteAllUserSessions deletes all the user sessions from in-memory store.
2826
func (c *provider) DeleteAllUserSessions(userId string) error {
29-
namespaces := []string{
30-
constants.AuthRecipeMethodBasicAuth,
31-
constants.AuthRecipeMethodMagicLinkLogin,
32-
constants.AuthRecipeMethodApple,
33-
constants.AuthRecipeMethodFacebook,
34-
constants.AuthRecipeMethodGithub,
35-
constants.AuthRecipeMethodGoogle,
36-
constants.AuthRecipeMethodLinkedIn,
37-
constants.AuthRecipeMethodTwitter,
38-
constants.AuthRecipeMethodMicrosoft,
39-
}
40-
41-
for _, namespace := range namespaces {
42-
c.sessionStore.RemoveAll(namespace + ":" + userId)
43-
}
27+
c.sessionStore.RemoveAll(userId)
4428
return nil
4529
}
4630

4731
// DeleteUserSession deletes the user session from the in-memory store.
4832
func (c *provider) DeleteUserSession(userId, sessionToken string) error {
49-
c.sessionStore.Remove(userId, sessionToken)
33+
c.sessionStore.Remove(userId, constants.TokenTypeSessionToken+"_"+sessionToken)
34+
c.sessionStore.Remove(userId, constants.TokenTypeAccessToken+"_"+sessionToken)
35+
c.sessionStore.Remove(userId, constants.TokenTypeRefreshToken+"_"+sessionToken)
5036
return nil
5137
}
5238

‎server/memorystore/providers/inmemory/stores/env_store.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,15 @@ func (e *EnvStore) UpdateStore(store map[string]interface{}) {
3131

3232
// GetStore returns the env store
3333
func (e *EnvStore) GetStore() map[string]interface{} {
34+
e.mutex.Lock()
35+
defer e.mutex.Unlock()
3436
return e.store
3537
}
3638

3739
// Get returns the value of the key in evn store
3840
func (e *EnvStore) Get(key string) interface{} {
41+
e.mutex.Lock()
42+
defer e.mutex.Unlock()
3943
return e.store[key]
4044
}
4145

0 commit comments

Comments
 (0)