mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-07-18 15:37:48 +00:00
0211c1eace
The session cookie has no Max-Age, so it is lost when the browser closes. The password flow compensates via a "Remember me" checkbox issuing an LTA cookie; OAuth2/OIDC sign-in had no such UI. Issuing a regular LTA cookie after an OAuth callback would skip the IdP for LOGIN_REMEMBER_DAYS. Instead, this introduces a separate LongTermAuthorizationSSO purpose: the cookie is opt-in via the existing "Remember me" checkbox, and when presented without a session, autoSignIn redirects through the IdP with OIDC prompt=none for silent re-auth. On login_required / interaction_required / consent_required / account_selection_required we transparently fall back to interactive sign-in. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12321 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> Reviewed-by: Gusted <gusted@noreply.codeberg.org>
68 lines
2.2 KiB
Go
68 lines
2.2 KiB
Go
// Copyright 2023 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package context
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
auth_model "forgejo.org/models/auth"
|
|
user_model "forgejo.org/models/user"
|
|
"forgejo.org/modules/optional"
|
|
"forgejo.org/modules/setting"
|
|
"forgejo.org/modules/timeutil"
|
|
"forgejo.org/modules/web/middleware"
|
|
)
|
|
|
|
const CookieNameFlash = "flash"
|
|
|
|
func removeSessionCookieHeader(w http.ResponseWriter) {
|
|
cookies := w.Header()["Set-Cookie"]
|
|
w.Header().Del("Set-Cookie")
|
|
for _, cookie := range cookies {
|
|
if strings.HasPrefix(cookie, setting.SessionConfig.CookieName+"=") {
|
|
continue
|
|
}
|
|
w.Header().Add("Set-Cookie", cookie)
|
|
}
|
|
}
|
|
|
|
// SetSiteCookie convenience function to set most cookies consistently
|
|
// CSRF and a few others are the exception here
|
|
func (ctx *Context) SetSiteCookie(name, value string, maxAge int) {
|
|
middleware.SetSiteCookie(ctx.Resp, name, value, maxAge)
|
|
}
|
|
|
|
// DeleteSiteCookie convenience function to delete most cookies consistently
|
|
// CSRF and a few others are the exception here
|
|
func (ctx *Context) DeleteSiteCookie(name string) {
|
|
middleware.SetSiteCookie(ctx.Resp, name, "", -1)
|
|
}
|
|
|
|
// GetSiteCookie returns given cookie value from request header.
|
|
func (ctx *Context) GetSiteCookie(name string) string {
|
|
return middleware.GetSiteCookie(ctx.Req, name)
|
|
}
|
|
|
|
// SetLTACookie will generate a LTA token and add it as an cookie.
|
|
func (ctx *Context) SetLTACookie(u *user_model.User) error {
|
|
days := 86400 * setting.LogInRememberDays
|
|
lookup, validator, err := auth_model.GenerateAuthToken(ctx, u.ID, optional.None[int64](), timeutil.TimeStampNow().Add(int64(days)), auth_model.LongTermAuthorization)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
ctx.SetSiteCookie(setting.CookieRememberName, lookup+":"+validator, days)
|
|
return nil
|
|
}
|
|
|
|
// SetSSOLTACookie sets a long-term-auth cookie bound to the given OAuth2/OIDC source.
|
|
func (ctx *Context) SetSSOLTACookie(u *user_model.User, loginSourceID int64) error {
|
|
days := 86400 * setting.LogInRememberDays
|
|
lookup, validator, err := auth_model.GenerateAuthToken(ctx, u.ID, optional.Some(loginSourceID), timeutil.TimeStampNow().Add(int64(days)), auth_model.LongTermAuthorizationSSO)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
ctx.SetSiteCookie(setting.CookieRememberName, lookup+":"+validator, days)
|
|
return nil
|
|
}
|