Skip to content

Commit e61dc2f

Browse files
lakhansamanilakhansamani
committed
fix: oauth login
1 parent 07552bc commit e61dc2f

File tree

5 files changed

+83
-31
lines changed

5 files changed

+83
-31
lines changed

‎server/handlers/authorize.go‎

Lines changed: 53 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,10 @@ import (
44
"net/http"
55
"strings"
66

7+
"github.com/authorizerdev/authorizer/server/constants"
78
"github.com/authorizerdev/authorizer/server/cookie"
89
"github.com/authorizerdev/authorizer/server/db"
10+
"github.com/authorizerdev/authorizer/server/envstore"
911
"github.com/authorizerdev/authorizer/server/sessionstore"
1012
"github.com/authorizerdev/authorizer/server/token"
1113
"github.com/gin-gonic/gin"
@@ -27,12 +29,38 @@ func AuthorizeHandler() gin.HandlerFunc {
2729
state := strings.TrimSpace(gc.Query("state"))
2830
codeChallenge := strings.TrimSpace(gc.Query("code_challenge"))
2931
scopeString := strings.TrimSpace(gc.Query("scope"))
30-
scope := []string{}
32+
clientID := strings.TrimSpace(gc.Query("client_id"))
3133
template := "authorize.tmpl"
3234

35+
if clientID == "" {
36+
gc.HTML(http.StatusOK, template, gin.H{
37+
"target_origin": redirectURI,
38+
"authorization_response": map[string]interface{}{
39+
"type": "authorization_response",
40+
"response": map[string]string{
41+
"error": "client_id is required",
42+
},
43+
},
44+
})
45+
return
46+
}
47+
48+
if clientID != envstore.EnvStoreObj.GetStringStoreEnvVariable(constants.EnvKeyClientID) {
49+
gc.HTML(http.StatusOK, template, gin.H{
50+
"target_origin": redirectURI,
51+
"authorization_response": map[string]interface{}{
52+
"type": "authorization_response",
53+
"response": map[string]string{
54+
"error": "invalid_client_id",
55+
},
56+
},
57+
})
58+
return
59+
}
60+
3361
if redirectURI == "" {
3462
gc.HTML(http.StatusOK, template, gin.H{
35-
"target_origin": nil,
63+
"target_origin": redirectURI,
3664
"authorization_response": map[string]interface{}{
3765
"type": "authorization_response",
3866
"response": map[string]string{
@@ -45,7 +73,7 @@ func AuthorizeHandler() gin.HandlerFunc {
4573

4674
if state == "" {
4775
gc.HTML(http.StatusOK, template, gin.H{
48-
"target_origin": nil,
76+
"target_origin": redirectURI,
4977
"authorization_response": map[string]interface{}{
5078
"type": "authorization_response",
5179
"response": map[string]string{
@@ -60,16 +88,19 @@ func AuthorizeHandler() gin.HandlerFunc {
6088
responseType = "token"
6189
}
6290

91+
var scope []string
6392
if scopeString == "" {
6493
scope = []string{"openid", "profile", "email"}
94+
} else {
95+
scope = strings.Split(scopeString, " ")
6596
}
6697

6798
isResponseTypeCode := responseType == "code"
6899
isResponseTypeToken := responseType == "token"
69100

70101
if !isResponseTypeCode && !isResponseTypeToken {
71102
gc.HTML(http.StatusOK, template, gin.H{
72-
"target_origin": nil,
103+
"target_origin": redirectURI,
73104
"authorization_response": map[string]interface{}{
74105
"type": "authorization_response",
75106
"response": map[string]string{
@@ -83,7 +114,7 @@ func AuthorizeHandler() gin.HandlerFunc {
83114
if isResponseTypeCode {
84115
if codeChallenge == "" {
85116
gc.HTML(http.StatusBadRequest, template, gin.H{
86-
"target_origin": nil,
117+
"target_origin": redirectURI,
87118
"authorization_response": map[string]interface{}{
88119
"type": "authorization_response",
89120
"response": map[string]string{
@@ -98,7 +129,7 @@ func AuthorizeHandler() gin.HandlerFunc {
98129
sessionToken, err := cookie.GetSession(gc)
99130
if err != nil {
100131
gc.HTML(http.StatusOK, template, gin.H{
101-
"target_origin": nil,
132+
"target_origin": redirectURI,
102133
"authorization_response": map[string]interface{}{
103134
"type": "authorization_response",
104135
"response": map[string]string{
@@ -114,7 +145,7 @@ func AuthorizeHandler() gin.HandlerFunc {
114145
claims, err := token.ValidateBrowserSession(gc, sessionToken)
115146
if err != nil {
116147
gc.HTML(http.StatusOK, template, gin.H{
117-
"target_origin": nil,
148+
"target_origin": redirectURI,
118149
"authorization_response": map[string]interface{}{
119150
"type": "authorization_response",
120151
"response": map[string]string{
@@ -129,7 +160,7 @@ func AuthorizeHandler() gin.HandlerFunc {
129160
user, err := db.Provider.GetUserByID(userID)
130161
if err != nil {
131162
gc.HTML(http.StatusOK, template, gin.H{
132-
"target_origin": nil,
163+
"target_origin": redirectURI,
133164
"authorization_response": map[string]interface{}{
134165
"type": "authorization_response",
135166
"response": map[string]string{
@@ -150,7 +181,7 @@ func AuthorizeHandler() gin.HandlerFunc {
150181
newSessionTokenData, newSessionToken, err := token.CreateSessionToken(user, nonce, claims.Roles, scope)
151182
if err != nil {
152183
gc.HTML(http.StatusOK, template, gin.H{
153-
"target_origin": nil,
184+
"target_origin": redirectURI,
154185
"authorization_response": map[string]interface{}{
155186
"type": "authorization_response",
156187
"response": map[string]string{
@@ -168,9 +199,12 @@ func AuthorizeHandler() gin.HandlerFunc {
168199
sessionstore.SetState(codeChallenge, code+"@"+newSessionToken)
169200
gc.HTML(http.StatusOK, template, gin.H{
170201
"target_origin": redirectURI,
171-
"authorization_response": map[string]string{
172-
"code": code,
173-
"state": state,
202+
"authorization_response": map[string]interface{}{
203+
"type": "authorization_response",
204+
"response": map[string]string{
205+
"code": code,
206+
"state": state,
207+
},
174208
},
175209
})
176210
return
@@ -181,7 +215,7 @@ func AuthorizeHandler() gin.HandlerFunc {
181215
authToken, err := token.CreateAuthToken(gc, user, claims.Roles, scope)
182216
if err != nil {
183217
gc.HTML(http.StatusOK, template, gin.H{
184-
"target_origin": nil,
218+
"target_origin": redirectURI,
185219
"authorization_response": map[string]interface{}{
186220
"type": "authorization_response",
187221
"response": map[string]string{
@@ -213,15 +247,18 @@ func AuthorizeHandler() gin.HandlerFunc {
213247
}
214248

215249
gc.HTML(http.StatusOK, template, gin.H{
216-
"target_origin": redirectURI,
217-
"authorization_response": res,
250+
"target_origin": redirectURI,
251+
"authorization_response": map[string]interface{}{
252+
"type": "authorization_response",
253+
"response": res,
254+
},
218255
})
219256
return
220257
}
221258

222259
// by default return with error
223260
gc.HTML(http.StatusOK, template, gin.H{
224-
"target_origin": nil,
261+
"target_origin": redirectURI,
225262
"authorization_response": map[string]interface{}{
226263
"type": "authorization_response",
227264
"response": map[string]string{

‎server/handlers/oauth_callback.go‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"github.com/authorizerdev/authorizer/server/utils"
2222
"github.com/coreos/go-oidc/v3/oidc"
2323
"github.com/gin-gonic/gin"
24+
"github.com/google/uuid"
2425
"golang.org/x/oauth2"
2526
)
2627

@@ -146,10 +147,14 @@ func OAuthCallbackHandler() gin.HandlerFunc {
146147

147148
// TODO use query param
148149
scope := []string{"openid", "email", "profile"}
149-
authToken, _ := token.CreateAuthToken(c, user, inputRoles, scope)
150+
nonce := uuid.New().String()
151+
_, newSessionToken, err := token.CreateSessionToken(user, nonce, inputRoles, scope)
152+
if err != nil {
153+
c.JSON(500, gin.H{"error": err.Error()})
154+
}
150155

151-
sessionstore.SetState(authToken.FingerPrint, user.ID)
152-
cookie.SetSession(c, authToken.FingerPrintHash)
156+
sessionstore.SetState(newSessionToken, nonce+"@"+user.ID)
157+
cookie.SetSession(c, newSessionToken)
153158
go utils.SaveSessionInDB(c, user.ID)
154159
c.Redirect(http.StatusTemporaryRedirect, redirectURL)
155160
}

‎server/handlers/token.go‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,10 @@ import (
66
"net/http"
77
"strings"
88

9+
"github.com/authorizerdev/authorizer/server/constants"
910
"github.com/authorizerdev/authorizer/server/cookie"
1011
"github.com/authorizerdev/authorizer/server/db"
12+
"github.com/authorizerdev/authorizer/server/envstore"
1113
"github.com/authorizerdev/authorizer/server/sessionstore"
1214
"github.com/authorizerdev/authorizer/server/token"
1315
"github.com/gin-gonic/gin"
@@ -26,7 +28,23 @@ func TokenHandler() gin.HandlerFunc {
2628

2729
codeVerifier := strings.TrimSpace(reqBody["code_verifier"])
2830
code := strings.TrimSpace(reqBody["code"])
29-
redirectURI := strings.TrimSpace(reqBody["redirect_uri"])
31+
clientID := strings.TrimSpace(reqBody["client_id"])
32+
33+
if clientID == "" {
34+
gc.JSON(http.StatusBadRequest, gin.H{
35+
"error": "client_id_required",
36+
"error_description": "The client id is required",
37+
})
38+
return
39+
}
40+
41+
if clientID != envstore.EnvStoreObj.GetStringStoreEnvVariable(constants.EnvKeyClientID) {
42+
gc.JSON(http.StatusBadRequest, gin.H{
43+
"error": "invalid_client_id",
44+
"error_description": "The client id is invalid",
45+
})
46+
return
47+
}
3048

3149
if codeVerifier == "" {
3250
gc.JSON(http.StatusBadRequest, gin.H{
@@ -44,14 +62,6 @@ func TokenHandler() gin.HandlerFunc {
4462
return
4563
}
4664

47-
if redirectURI == "" {
48-
gc.JSON(http.StatusBadRequest, gin.H{
49-
"error": "invalid_redirect_uri",
50-
"error_description": "The redirect URI is required",
51-
})
52-
return
53-
}
54-
5565
hash := sha256.New()
5666
hash.Write([]byte(codeVerifier))
5767
encryptedCode := strings.ReplaceAll(base64.URLEncoding.EncodeToString(hash.Sum(nil)), "+", "-")

‎server/routes/routes.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ func InitRouter() *gin.Engine {
2626
router.GET("/authorize", handlers.AuthorizeHandler())
2727
router.GET("/userinfo", handlers.UserInfoHandler())
2828
router.GET("/logout", handlers.LogoutHandler())
29-
router.POST("/token", handlers.TokenHandler())
29+
router.POST("/oauth/token", handlers.TokenHandler())
3030

3131
router.LoadHTMLGlob("templates/*")
3232
// login page app related routes.

‎templates/authorize.tmpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
(function (window, document) {
99
var targetOrigin = {{.target_origin}};
1010
var authorizationResponse = {{.authorization_response}};
11-
var mainWin = window.parent;
12-
mainWin.postMessage(authorizationResponse, targetOrigin);
11+
console.log({targetOrigin})
12+
window.parent.postMessage(authorizationResponse, targetOrigin);
1313
})(this, this.document);
1414
</script>
1515
</body>

0 commit comments

Comments
 (0)