mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
626f5d2949
* [FEATURE] Remember Me Configuration * allow users to specify the duration of remember me using remember_me_duration in session config * setting the duration to 0 disables remember me * only render the remember me element if remember me is enabled * prevent malicious users from faking remember me functionality in the backend * add string to duration helper called ParseDurationString to parse a string into a duration * added tests to the helper function * use the SessionProvider to store the time.Duration instead of parsing it over and over again * add sec doc, adjust month/min, consistency * renamed internal/utils/constants.go to internal/utils/const.go to be consistent * added security measure docs * adjusted default remember me duration to be 1 month instead of 1 year * utilize default remember me duration in the autheliaCtx mock * adjust order of keys in session configuration examples * add notes on session security measures secret only being redis * add TODO items for duration notation for both Expiration and Inactivity (will be removed soon) * fix error text for Inactivity in the validator * add session validator tests * deref check bodyJSON.KeepMeLoggedIn and derive the value based on conf and user input and store it (DRY) * remove unnecessary regex for the simplified ParseDurationString utility * ParseDurationString only accepts decimals without leading zeros now * comprehensively test all unit types * remove unnecessary type unions in web * add test to check sanity of time duration consts, this is just so they can't be accidentally changed * simplify deref check and assignment * fix reset password padding/margins * adjust some doc wording * adjust the handler configuration suite test * actually run the handler configuration suite test (whoops) * reduce the number of regex's used by ParseDurationString to 1, thanks to Clement * adjust some error wording
123 lines
3.0 KiB
Go
123 lines
3.0 KiB
Go
package session
|
|
|
|
import (
|
|
"encoding/json"
|
|
"github.com/authelia/authelia/internal/utils"
|
|
"time"
|
|
|
|
"github.com/authelia/authelia/internal/configuration/schema"
|
|
fasthttpsession "github.com/fasthttp/session"
|
|
"github.com/valyala/fasthttp"
|
|
)
|
|
|
|
// Provider a session provider.
|
|
type Provider struct {
|
|
sessionHolder *fasthttpsession.Session
|
|
RememberMe time.Duration
|
|
}
|
|
|
|
// NewProvider instantiate a session provider given a configuration.
|
|
func NewProvider(configuration schema.SessionConfiguration) *Provider {
|
|
providerConfig := NewProviderConfig(configuration)
|
|
|
|
provider := new(Provider)
|
|
provider.sessionHolder = fasthttpsession.New(providerConfig.config)
|
|
duration, err := utils.ParseDurationString(configuration.RememberMeDuration)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
provider.RememberMe = duration
|
|
err = provider.sessionHolder.SetProvider(providerConfig.providerName, providerConfig.providerConfig)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
return provider
|
|
}
|
|
|
|
// GetSession return the user session from a request
|
|
func (p *Provider) GetSession(ctx *fasthttp.RequestCtx) (UserSession, error) {
|
|
store, err := p.sessionHolder.Get(ctx)
|
|
|
|
if err != nil {
|
|
return NewDefaultUserSession(), err
|
|
}
|
|
|
|
userSessionJSON, ok := store.Get(userSessionStorerKey).([]byte)
|
|
|
|
// If userSession is not yet defined we create the new session with default values
|
|
// and save it in the store.
|
|
if !ok {
|
|
userSession := NewDefaultUserSession()
|
|
store.Set(userSessionStorerKey, userSession)
|
|
return userSession, nil
|
|
}
|
|
|
|
var userSession UserSession
|
|
err = json.Unmarshal(userSessionJSON, &userSession)
|
|
|
|
if err != nil {
|
|
return NewDefaultUserSession(), err
|
|
}
|
|
|
|
return userSession, nil
|
|
}
|
|
|
|
// SaveSession save the user session.
|
|
func (p *Provider) SaveSession(ctx *fasthttp.RequestCtx, userSession UserSession) error {
|
|
store, err := p.sessionHolder.Get(ctx)
|
|
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
userSessionJSON, err := json.Marshal(userSession)
|
|
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
store.Set(userSessionStorerKey, userSessionJSON)
|
|
p.sessionHolder.Save(ctx, store)
|
|
return nil
|
|
}
|
|
|
|
// RegenerateSession regenerate a session ID.
|
|
func (p *Provider) RegenerateSession(ctx *fasthttp.RequestCtx) error {
|
|
_, err := p.sessionHolder.Regenerate(ctx)
|
|
return err
|
|
}
|
|
|
|
// DestroySession destroy a session ID and delete the cookie.
|
|
func (p *Provider) DestroySession(ctx *fasthttp.RequestCtx) error {
|
|
return p.sessionHolder.Destroy(ctx)
|
|
}
|
|
|
|
// UpdateExpiration update the expiration of the cookie and session.
|
|
func (p *Provider) UpdateExpiration(ctx *fasthttp.RequestCtx, expiration time.Duration) error {
|
|
store, err := p.sessionHolder.Get(ctx)
|
|
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
err = store.SetExpiration(expiration)
|
|
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
p.sessionHolder.Save(ctx, store)
|
|
return nil
|
|
}
|
|
|
|
// GetExpiration get the expiration of the current session.
|
|
func (p *Provider) GetExpiration(ctx *fasthttp.RequestCtx) (time.Duration, error) {
|
|
store, err := p.sessionHolder.Get(ctx)
|
|
|
|
if err != nil {
|
|
return time.Duration(0), err
|
|
}
|
|
|
|
return store.GetExpiration(), nil
|
|
}
|