barbercollie/tinyauth
1
0
Fork 1
mirror of https://github.com/steveiliop56/tinyauth.git synced 2025-10-29 05:05:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: don't store oauth token in cookie

Browse Source
This commit is contained in:
Stavros
2025-01-26 11:05:11 +02:00
parent 389248cfe1
commit 682a918812
2 changed files with 4 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
internal/api/api.go
View File

@@ -291,7 +291,7 @@ func (api *API) SetupRoutes() {
return return
} }
token, tokenErr := provider.ExchangeToken(code) _, tokenErr := provider.ExchangeToken(code)
if handleApiError(c, "Failed to exchange token", tokenErr) { if handleApiError(c, "Failed to exchange token", tokenErr) {
return return
@@ -315,7 +315,7 @@ func (api *API) SetupRoutes() {
} }
session := sessions.Default(c) session := sessions.Default(c)
session.Set("tinyauth_sid", fmt.Sprintf("%s:%s", providerName.Provider, token)) session.Set("tinyauth_sid", fmt.Sprintf("%s:%s", providerName.Provider, email))
session.Save() session.Save()
redirectURI, redirectURIErr := c.Cookie("tinyauth_redirect_uri") redirectURI, redirectURIErr := c.Cookie("tinyauth_redirect_uri")

20
internal/hooks/hooks.go
View File

@@ -8,7 +8,6 @@ import (
"github.com/gin-contrib/sessions" "github.com/gin-contrib/sessions"
"github.com/gin-gonic/gin" "github.com/gin-gonic/gin"
"golang.org/x/oauth2"
) )
func NewHooks(auth *auth.Auth, providers *providers.Providers) *Hooks { func NewHooks(auth *auth.Auth, providers *providers.Providers) *Hooks {
@@ -90,22 +89,7 @@ func (hooks *Hooks) UseUserContext(c *gin.Context) (types.UserContext, error) {
}, nil }, nil
} }
provider.Token = &oauth2.Token{ if !hooks.Auth.EmailWhitelisted(sessionValue) {
AccessToken: sessionValue,
}
email, emailErr := hooks.Providers.GetUser(sessionType)
if emailErr != nil {
return types.UserContext{
Email: "",
IsLoggedIn: false,
OAuth: false,
Provider: "",
}, nil
}
if !hooks.Auth.EmailWhitelisted(email) {
session.Delete("tinyauth_sid") session.Delete("tinyauth_sid")
session.Save() session.Save()
return types.UserContext{ return types.UserContext{
@@ -117,7 +101,7 @@ func (hooks *Hooks) UseUserContext(c *gin.Context) (types.UserContext, error) {
} }
return types.UserContext{ return types.UserContext{
Email: email, Email: sessionValue,
IsLoggedIn: true, IsLoggedIn: true,
OAuth: true, OAuth: true,
Provider: sessionType, Provider: sessionType,