go-pkgz / auth / 42679643289

87%

master: 87%

push

github

Read the oauth handshake token from the cookie only (#329)

* fix: read the oauth handshake token from the cookie only

The oauth2, oauth1 and Apple callbacks read the handshake token with
TokenService.Get, which takes the JWT query parameter and header before
the cookie. A callback request could therefore carry a handshake that
the browser's own login step never set, and complete a login started
elsewhere.

* docs: backlog the full query kept in oauth callback error logs

* fix: reject oauth1 callback claims without a handshake

The oauth1 callback read Handshake.State without checking that the
claims carry a handshake. A session cookie on the callback, with GET in
XSRFIgnoreMethods, made the request panic. It now answers 403 like the
oauth2 and Apple callbacks.

* fix: reject expired oauth handshake tokens on the callback

The login step gives the handshake a 30 minute expiry, but Get skips the
expiry check for cookies, so the callbacks accepted a handshake of any
age. The cookie-only lookup now rejects a token whose exp has passed.
A token without exp is still accepted, the same in both modules.

19 of 19 new or added lines in 4 files covered. (100.0%)

3409 of 3914 relevant lines covered (87.1%)

10.52 hits per line