SuperSeriousBusiness/GoToSocial
1
1
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial synced 2025-06-05 21:59:39 +02:00
Code Issues Projects Releases Wiki Activity

[feature] add 'state' oauth2 param to /oauth/authorize (#730)

Browse Source
This commit is contained in:
tobi
2022-07-28 16:43:27 +02:00
committed by GitHub
parent 7ca5bac7c6
commit 8106b69856
6 changed files with 35 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
internal/api/client/auth/callback.go
View File

@@ -45,26 +45,26 @@ func (m *Module) CallbackGETHandler(c *gin.Context) {
// check the query vs session state parameter to mitigate csrf
// https://auth0.com/docs/secure/attack-protection/state-parameters
state := c.Query(callbackStateParam)
if state == "" {
returnedInternalState := c.Query(callbackStateParam)
if returnedInternalState == "" {
m.clearSession(s)
err := fmt.Errorf("%s parameter not found on callback query", callbackStateParam)
api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet)
return
}
savedStateI := s.Get(sessionState)
savedState, ok := savedStateI.(string)
savedInternalStateI := s.Get(sessionInternalState)
savedInternalState, ok := savedInternalStateI.(string)
if !ok {
m.clearSession(s)
err := fmt.Errorf("key %s was not found in session", sessionState)
err := fmt.Errorf("key %s was not found in session", sessionInternalState)
api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet)
return
}
if state != savedState {
if returnedInternalState != savedInternalState {
m.clearSession(s)
err := errors.New("mismatch between query state and session state")
err := errors.New("mismatch between callback state and saved state")
api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet)
return
}