136 lines
3.0 KiB
Go
136 lines
3.0 KiB
Go
package auth
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"fmt"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
const defaultTTL = 7 * 24 * time.Hour
|
|
|
|
type Session struct {
|
|
secret []byte
|
|
cookieName string
|
|
path string
|
|
ttl time.Duration
|
|
}
|
|
|
|
func NewSession(secret, cookieName, path string) *Session {
|
|
return &Session{
|
|
secret: []byte(secret),
|
|
cookieName: cookieName,
|
|
path: path,
|
|
ttl: defaultTTL,
|
|
}
|
|
}
|
|
|
|
func (s *Session) Create(value string) (string, error) {
|
|
exp := time.Now().Add(s.ttl).Unix()
|
|
payload := fmt.Sprintf("%s|%d", value, exp)
|
|
sig := s.sign(payload)
|
|
return base64.URLEncoding.EncodeToString([]byte(payload + "|" + sig)), nil
|
|
}
|
|
|
|
func (s *Session) Validate(token string) (string, bool) {
|
|
raw, err := base64.URLEncoding.DecodeString(token)
|
|
if err != nil {
|
|
return "", false
|
|
}
|
|
parts := strings.Split(string(raw), "|")
|
|
if len(parts) != 3 {
|
|
return "", false
|
|
}
|
|
value, expStr, sig := parts[0], parts[1], parts[2]
|
|
payload := value + "|" + expStr
|
|
if !hmac.Equal([]byte(sig), []byte(s.sign(payload))) {
|
|
return "", false
|
|
}
|
|
exp, err := strconv.ParseInt(expStr, 10, 64)
|
|
if err != nil || time.Now().Unix() > exp {
|
|
return "", false
|
|
}
|
|
return value, true
|
|
}
|
|
|
|
func (s *Session) SetCookie(w http.ResponseWriter, r *http.Request, token string) {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: s.cookieName,
|
|
Value: token,
|
|
Path: s.path,
|
|
HttpOnly: true,
|
|
Secure: isSecure(r),
|
|
SameSite: http.SameSiteLaxMode,
|
|
MaxAge: int(s.ttl.Seconds()),
|
|
})
|
|
}
|
|
|
|
func (s *Session) ClearCookie(w http.ResponseWriter, r *http.Request) {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: s.cookieName,
|
|
Value: "",
|
|
Path: s.path,
|
|
HttpOnly: true,
|
|
Secure: isSecure(r),
|
|
MaxAge: -1,
|
|
})
|
|
}
|
|
|
|
func (s *Session) FromRequest(r *http.Request) (string, bool) {
|
|
c, err := r.Cookie(s.cookieName)
|
|
if err != nil {
|
|
return "", false
|
|
}
|
|
return s.Validate(c.Value)
|
|
}
|
|
|
|
func (s *Session) EnsureKey(w http.ResponseWriter, r *http.Request) string {
|
|
if key, ok := s.FromRequest(r); ok && key != "" {
|
|
return key
|
|
}
|
|
key := uuid.New().String()
|
|
token, _ := s.Create(key)
|
|
s.SetCookie(w, r, token)
|
|
return key
|
|
}
|
|
|
|
func (s *Session) sign(payload string) string {
|
|
mac := hmac.New(sha256.New, s.secret)
|
|
mac.Write([]byte(payload))
|
|
return base64.URLEncoding.EncodeToString(mac.Sum(nil))
|
|
}
|
|
|
|
func isSecure(r *http.Request) bool {
|
|
if r.TLS != nil {
|
|
return true
|
|
}
|
|
return strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https")
|
|
}
|
|
|
|
func UserIDFromSession(s *Session, r *http.Request) (int, bool) {
|
|
val, ok := s.FromRequest(r)
|
|
if !ok {
|
|
return 0, false
|
|
}
|
|
if !strings.HasPrefix(val, "user:") {
|
|
return 0, false
|
|
}
|
|
id, err := strconv.Atoi(strings.TrimPrefix(val, "user:"))
|
|
return id, err == nil && id > 0
|
|
}
|
|
|
|
func SetUserSession(s *Session, w http.ResponseWriter, r *http.Request, userID int) error {
|
|
token, err := s.Create(fmt.Sprintf("user:%d", userID))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
s.SetCookie(w, r, token)
|
|
return nil
|
|
}
|