auth

Paddy 2014-08-16 Parent:7a6f64db7246

16:13568ac73ac3 Go to Latest

auth/README.md

Note the potential for CSRF attacks. Our auth provider probably shouldn't have security vulnerabilities. Add TODOs to ensure that logging in and authorizing a grant are not susceptible to CSRF attacks, or it becomes pretty easy for an attacker to gain access to user data or to gain access to a user account.

Download raw file
View source Diff to previous Annotate
History
1 OSIN
2 ====
3
4 Golang OAuth2 server library
5 ----------------------------
6
7 OSIN is an OAuth2 server library for the Go language, as specified at
8 http://tools.ietf.org/html/rfc6749 and http://tools.ietf.org/html/draft-ietf-oauth-v2-10.
9
10 Using it, you can build your own OAuth2 authentication service.
11
12 The library implements the majority of the specification, like authorization and token endpoints, and authorization code, implicit, resource owner and client credentials grant types.
13
14 ### Dependencies
15
16 * go-uuid (http://code.google.com/p/go-uuid)
17
18 ### Example Server
19
20 ````go
21 import "github.com/RangelReale/osin"
22
23 // TestStorage implements the "osin.Storage" interface
24 server := osin.NewServer(osin.NewServerConfig(), &TestStorage{})
25
26 // Authorization code endpoint
27 http.HandleFunc("/authorize", func(w http.ResponseWriter, r *http.Request) {
28 resp := server.NewResponse()
29 if ar := server.HandleAuthorizeRequest(resp, r); ar != nil {
30
31 // HANDLE LOGIN PAGE HERE
32
33 ar.Authorized = true
34 server.FinishAuthorizeRequest(resp, r, ar)
35 }
36 osin.OutputJSON(resp, w, r)
37 })
38
39 // Access token endpoint
40 http.HandleFunc("/token", func(w http.ResponseWriter, r *http.Request) {
41 resp := server.NewResponse()
42 if ar := server.HandleAccessRequest(resp, r); ar != nil {
43 ar.Authorized = true
44 server.FinishAccessRequest(resp, r, ar)
45 }
46 osin.OutputJSON(resp, w, r)
47 })
48
49 http.ListenAndServe(":14000", nil)
50 ````
51
52 ### Example Access
53
54 Open in your web browser:
55
56 ````
57 http://localhost:14000/authorize?response_type=code&client_id=1234&redirect_url=http%3A%2F%2Flocalhost%3A14000%2Fappauth%2Fcode
58 ````
59
60 ### License
61
62 The code is licensed using "New BSD" license.
63
64 ### Author
65
66 Rangel Reale