auth
auth/config.go
Implement CSRF prevention and pass info to confirmation. Implement CSRF prevention using the nosurf package. Note that the handler still needs to be wrapped before this will work. Pass info on the authorization being requested (namely the client and the scope) to the RenderConfirmation page so that the user can make an educated decision.
| paddy@6 | 1 package auth |
| paddy@0 | 2 |
| paddy@0 | 3 // AllowedAuthorizeType is a collection of allowed auth request types |
| paddy@0 | 4 type AllowedAuthorizeType []AuthorizeRequestType |
| paddy@0 | 5 |
| paddy@0 | 6 // Exists returns true if the auth type exists in the list |
| paddy@0 | 7 func (t AllowedAuthorizeType) Exists(rt AuthorizeRequestType) bool { |
| paddy@0 | 8 for _, k := range t { |
| paddy@0 | 9 if k == rt { |
| paddy@0 | 10 return true |
| paddy@0 | 11 } |
| paddy@0 | 12 } |
| paddy@0 | 13 return false |
| paddy@0 | 14 } |
| paddy@0 | 15 |
| paddy@0 | 16 // AllowedAccessType is a collection of allowed access request types |
| paddy@0 | 17 type AllowedAccessType []GrantType |
| paddy@0 | 18 |
| paddy@0 | 19 // Exists returns true if the access type exists in the list |
| paddy@0 | 20 func (t AllowedAccessType) Exists(rt GrantType) bool { |
| paddy@0 | 21 for _, k := range t { |
| paddy@0 | 22 if k == rt { |
| paddy@0 | 23 return true |
| paddy@0 | 24 } |
| paddy@0 | 25 } |
| paddy@0 | 26 return false |
| paddy@0 | 27 } |
| paddy@0 | 28 |
| paddy@0 | 29 // ServerConfig contains server configuration information |
| paddy@0 | 30 type ServerConfig struct { |
| paddy@0 | 31 // Authorization token expiration in seconds (default 5 minutes) |
| paddy@0 | 32 AuthorizationExpiration int32 |
| paddy@0 | 33 |
| paddy@0 | 34 // Access token expiration in seconds (default 1 hour) |
| paddy@0 | 35 AccessExpiration int32 |
| paddy@0 | 36 |
| paddy@0 | 37 // Token type to return |
| paddy@0 | 38 TokenType string |
| paddy@0 | 39 |
| paddy@0 | 40 // List of allowed authorize types (only CodeAuthRT by default) |
| paddy@0 | 41 AllowedAuthorizeTypes AllowedAuthorizeType |
| paddy@0 | 42 |
| paddy@0 | 43 // List of allowed access types (only AUTHORIZATION_CodeAuthRT by default) |
| paddy@0 | 44 AllowedAccessTypes AllowedAccessType |
| paddy@0 | 45 |
| paddy@0 | 46 // HTTP status code to return for errors - default 200 |
| paddy@0 | 47 // Only used if response was created from server |
| paddy@0 | 48 ErrorStatusCode int |
| paddy@0 | 49 |
| paddy@0 | 50 // If true allows client secret also in params, else only in |
| paddy@0 | 51 // Authorization header - default false |
| paddy@0 | 52 AllowClientSecretInParams bool |
| paddy@0 | 53 |
| paddy@0 | 54 // If true allows access request using GET, else only POST - default false |
| paddy@0 | 55 AllowGetAccessRequest bool |
| paddy@1 | 56 |
| paddy@1 | 57 // The base path of documentation |
| paddy@1 | 58 DocumentationDomain string |
| paddy@0 | 59 } |
| paddy@0 | 60 |
| paddy@0 | 61 // NewServerConfig returns a new ServerConfig with default configuration |
| paddy@0 | 62 func NewServerConfig() ServerConfig { |
| paddy@0 | 63 return ServerConfig{ |
| paddy@0 | 64 AuthorizationExpiration: 250, |
| paddy@0 | 65 AccessExpiration: 3600, |
| paddy@0 | 66 TokenType: "bearer", |
| paddy@0 | 67 AllowedAuthorizeTypes: AllowedAuthorizeType{CodeAuthRT}, |
| paddy@0 | 68 AllowedAccessTypes: AllowedAccessType{AuthorizationCodeGrant}, |
| paddy@0 | 69 ErrorStatusCode: 200, |
| paddy@0 | 70 AllowClientSecretInParams: false, |
| paddy@0 | 71 AllowGetAccessRequest: false, |
| paddy@0 | 72 } |
| paddy@0 | 73 } |