auth
auth/context.go
Implement CSRF prevention and pass info to confirmation. Implement CSRF prevention using the nosurf package. Note that the handler still needs to be wrapped before this will work. Pass info on the authorization being requested (namely the client and the scope) to the RenderConfirmation page so that the user can make an educated decision.
1.1 --- a/context.go Sat Aug 16 06:18:09 2014 -0400 1.2 +++ b/context.go Sat Aug 16 18:05:10 2014 -0400 1.3 @@ -5,6 +5,9 @@ 1.4 "html/template" 1.5 "io" 1.6 "log" 1.7 + "net/http" 1.8 + 1.9 + "github.com/justinas/nosurf" 1.10 ) 1.11 1.12 type Context struct { 1.13 @@ -60,26 +63,30 @@ 1.14 } 1.15 } 1.16 1.17 -func (c Context) RenderConfirmation(w io.Writer) { 1.18 +func (c Context) RenderConfirmation(w io.Writer, r *http.Request, req AuthRequest) { 1.19 if c.Templates.Confirmation == nil { 1.20 log.Println("Confirmation template is nil, can't render confirmation.") 1.21 return 1.22 } 1.23 - // TODO: CSRF prevention 1.24 - err := c.Templates.Confirmation.Execute(w, nil) 1.25 + err := c.Templates.Confirmation.Execute(w, map[string]interface{}{ 1.26 + "scope": req.Scope, 1.27 + "client": req.Client, 1.28 + "csrf_token": nosurf.Token(r), 1.29 + }) 1.30 if err != nil { 1.31 log.Printf("Error executing confirmation template: %s\n", err) 1.32 return 1.33 } 1.34 } 1.35 1.36 -func (c Context) RenderLogin(w io.Writer) { 1.37 +func (c Context) RenderLogin(w io.Writer, r *http.Request) { 1.38 if c.Templates.Login == nil { 1.39 log.Println("Login template is nil, can't render confirmation.") 1.40 return 1.41 } 1.42 - // TODO: CSRF prevention 1.43 - err := c.Templates.Login.Execute(w, nil) 1.44 + err := c.Templates.Login.Execute(w, map[string]interface{}{ 1.45 + "csrf_token": nosurf.Token(r), 1.46 + }) 1.47 if err != nil { 1.48 log.Printf("Error executing login template: %s\n", err) 1.49 return