57 lines
1.7 KiB
Go
57 lines
1.7 KiB
Go
|
package web
|
||
|
|
|
||
|
|
import "net/http"
|
||
|
|
|
||
|
|
// HandleAuthRequest is an nginx auth_request endpoint. It validates the
|
||
|
|
// session cookie and, on success, returns the authenticated user's identity
|
||
|
|
// as response headers that nginx forwards to the upstream application.
|
||
|
|
//
|
||
|
|
// Expected usage in nginx:
|
||
|
|
//
|
||
|
|
// location / {
|
||
|
|
// auth_request /auth;
|
||
|
|
// auth_request_set $webauth_user $upstream_http_x_webauth_user;
|
||
|
|
// auth_request_set $webauth_email $upstream_http_x_webauth_email;
|
||
|
|
// auth_request_set $webauth_display_name $upstream_http_x_webauth_display_name;
|
||
|
|
// proxy_set_header X-WEBAUTH-USER $webauth_user;
|
||
|
|
// proxy_set_header X-WEBAUTH-EMAIL $webauth_email;
|
||
|
|
// proxy_set_header X-WEBAUTH-DISPLAY-NAME $webauth_display_name;
|
||
|
|
// proxy_pass http://backend;
|
||
|
|
// }
|
||
|
|
//
|
||
|
|
// location = /auth {
|
||
|
|
// internal;
|
||
|
|
// proxy_pass http://backend/auth;
|
||
|
|
// proxy_pass_request_body off;
|
||
|
|
// proxy_set_header Content-Length "";
|
||
|
|
// proxy_set_header X-Original-URI $request_uri;
|
||
|
|
// }
|
||
|
|
func (s *WebService) HandleAuthRequest(w http.ResponseWriter, r *http.Request) {
|
||
|
|
cookie, err := r.Cookie(SessionCookieName)
|
||
|
|
if err != nil {
|
||
|
|
w.WriteHeader(http.StatusUnauthorized)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
session, err := s.auths.GetSessionByToken(r.Context(), cookie.Value)
|
||
|
|
if err != nil {
|
||
|
|
w.WriteHeader(http.StatusUnauthorized)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if !session.IsValid() {
|
||
|
|
w.WriteHeader(http.StatusUnauthorized)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
user, err := s.users.GetUserById(r.Context(), session.UserId)
|
||
|
|
if err != nil {
|
||
|
|
w.WriteHeader(http.StatusUnauthorized)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
w.Header().Set("X-WEBAUTH-USER", user.Login)
|
||
|
|
w.Header().Set("X-WEBAUTH-EMAIL", user.Login)
|
||
|
|
w.Header().Set("X-WEBAUTH-DISPLAY-NAME", user.EffectiveDisplayName())
|
||
|
|
w.WriteHeader(http.StatusOK)
|
||
|
|
}
|