Download this file
| 1 | package home |
| 2 | |
| 3 | import ( |
| 4 | "amadan.net/oficina/home/handoff" |
| 5 | "encoding/base64" |
| 6 | json "github.com/go-json-experiment/json" |
| 7 | "net/http" |
| 8 | "time" |
| 9 | ) |
| 10 | |
| 11 | // readAssertionIntent shares the same sealed, bounded intent between the |
| 12 | // credential handoff and the first-factor choice during reauthentication. |
| 13 | func (a *App) readAssertionIntent(r *http.Request, now time.Time) (assertionIntent, bool) { |
| 14 | value := "" |
| 15 | count := 0 |
| 16 | for _, cookie := range r.Cookies() { |
| 17 | if cookie.Name == assertionIntentCookie { |
| 18 | count++ |
| 19 | value = cookie.Value |
| 20 | } |
| 21 | } |
| 22 | if count != 1 || len(value) > 2048 { |
| 23 | return assertionIntent{}, false |
| 24 | } |
| 25 | sealed, err := base64.RawURLEncoding.Strict().DecodeString(value) |
| 26 | if err != nil || base64.RawURLEncoding.EncodeToString(sealed) != value { |
| 27 | return assertionIntent{}, false |
| 28 | } |
| 29 | plain, err := a.secrets.Sealer.Open("assertion.intent", sealed) |
| 30 | if err != nil { |
| 31 | return assertionIntent{}, false |
| 32 | } |
| 33 | var intent assertionIntent |
| 34 | if json.Unmarshal(plain, &intent, json.RejectUnknownMembers(true)) != nil || intent.Expires <= now.Unix() || intent.Expires > now.Unix()+600 || !handoff.ValidNonce(intent.Nonce) || (intent.MaxAge != 0 && intent.MaxAge != 300) || (intent.MaxAge == 0 && intent.Subject != "") { |
| 35 | return assertionIntent{}, false |
| 36 | } |
| 37 | return intent, true |
| 38 | } |
| 39 | |
amadan