Merge pull request #7 from pyrho/feat/auth-headers

feat: add auth headers to request

.go-version

@@ -0,0 +1 @@
+1.23.2

.traefik.yml

@@ -6,6 +6,6 @@ import: github.com/fosrl/badger
 summary: Middleware auth bouncer for Pangolin
 
 testData:
-    apiBaseUrl: http://localhost:3001/api/v1
+    apiBaseUrl: "http://localhost:3001/api/v1"
-    userSessionCookieName: session
+    userSessionCookieName: "p_session_token"
-    resourceSessionCookieName: resource_session
+    resourceSessionRequestParam: "p_session_request"

README.md

@@ -8,8 +8,6 @@ This plugin is **required** to be configured alongside [Pangolin](https://github
 
 Learn how to set up [Pangolin](https://github.com/fosrl/pangolin) and Badger in the [Pangolin Documentation](https://github.com/fosrl/pangolin).
 
----
-
 ## Configuration
 
 Badger requires the following configuration parameters to be specified in your [Traefik configuration file](https://doc.traefik.io/traefik/getting-started/configuration-overview/). These coincide with the separate [Pangolin](https://github.com/fosrl/pangolin) configuration file.
@@ -18,18 +16,10 @@ Badger requires the following configuration parameters to be specified in your [
 
 ```yaml
 apiBaseUrl: "http://localhost:3001/api/v1"
-userSessionCookieName: "session"
+userSessionCookieName: "p_session_token"
-resourceSessionCookieName: "resource_session"
+resourceSessionRequestParam: "p_session_request"
 ```
 
----
-
 ## License
 
 This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
-
----
-
-## Contact
-
-Please contact us at [support@fossorial.io](mailto:support@fossorial.io).

SECURITY.md

@@ -0,0 +1,14 @@
+# Security Policy
+
+If you discover a security vulnerability, please follow the steps below to responsibly disclose it to us:
+
+1. **Do not create a public GitHub issue or discussion post.** This could put the security of other users at risk.
+2. Send a detailed report to [security@fossorial.io](mailto:security@fossorial.io) or send a **private** message to a maintainer on [Discord](https://discord.gg/HCJR8Xhme4). Include:
+
+- Description and location of the vulnerability.
+- Potential impact of the vulnerability.
+- Steps to reproduce the vulnerability.
+- Potential solutions to fix the vulnerability.
+- Your name/handle and a link for recognition (optional).
+
+We aim to address the issue as soon as possible.

main.go

@@ -10,9 +10,17 @@ import (
 )
 
 type Config struct {
-	APIBaseUrl                string `json:"apiBaseUrl"`
+	APIBaseUrl                  string `json:"apiBaseUrl"`
-	UserSessionCookieName     string `json:"userSessionCookieName"`
+	UserSessionCookieName       string `json:"userSessionCookieName"`
-	ResourceSessionCookieName string `json:"resourceSessionCookieName"`
+	ResourceSessionRequestParam string `json:"resourceSessionRequestParam"`
+}
+
+type Badger struct {
+	next                        http.Handler
+	name                        string
+	apiBaseUrl                  string
+	userSessionCookieName       string
+	resourceSessionRequestParam string
 }
 
 type VerifyBody struct {
@@ -23,21 +31,34 @@ type VerifyBody struct {
 	RequestPath        *string           `json:"path"`
 	RequestMethod      *string           `json:"method"`
 	TLS                bool              `json:"tls"`
+	RequestIP          *string           `json:"requestIp,omitempty"`
+	Headers            map[string]string `json:"headers,omitempty"`
+	Query              map[string]string `json:"query,omitempty"`
 }
 
 type VerifyResponse struct {
 	Data struct {
-		Valid       bool    `json:"valid"`
+		Valid           bool              `json:"valid"`
-		RedirectURL *string `json:"redirectUrl"`
+		RedirectURL     *string           `json:"redirectUrl"`
+		Username        *string           `json:"username,omitempty"`
+		Email           *string           `json:"email,omitempty"`
+		Name            *string           `json:"name,omitempty"`
+		ResponseHeaders map[string]string `json:"responseHeaders,omitempty"`
 	} `json:"data"`
 }
 
-type Badger struct {
+type ExchangeSessionBody struct {
-	next                      http.Handler
+	RequestToken *string `json:"requestToken"`
-	name                      string
+	RequestHost  *string `json:"host"`
-	apiBaseUrl                string
+	RequestIP    *string `json:"requestIp,omitempty"`
-	userSessionCookieName     string
+}
-	resourceSessionCookieName string
+
+type ExchangeSessionResponse struct {
+	Data struct {
+		Valid           bool              `json:"valid"`
+		Cookie          *string           `json:"cookie"`
+		ResponseHeaders map[string]string `json:"responseHeaders,omitempty"`
+	} `json:"data"`
 }
 
 func CreateConfig() *Config {
@@ -46,19 +67,90 @@ func CreateConfig() *Config {
 
 func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
 	return &Badger{
-		next:                      next,
+		next:                        next,
-		name:                      name,
+		name:                        name,
-		apiBaseUrl:                config.APIBaseUrl,
+		apiBaseUrl:                  config.APIBaseUrl,
-		userSessionCookieName:     config.UserSessionCookieName,
+		userSessionCookieName:       config.UserSessionCookieName,
-		resourceSessionCookieName: config.ResourceSessionCookieName,
+		resourceSessionRequestParam: config.ResourceSessionRequestParam,
 	}, nil
 }
 
 func (p *Badger) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	cookies := p.extractCookies(req)
 
+	queryValues := req.URL.Query()
+
+	if sessionRequestValue := queryValues.Get(p.resourceSessionRequestParam); sessionRequestValue != "" {
+		body := ExchangeSessionBody{
+			RequestToken: &sessionRequestValue,
+			RequestHost:  &req.Host,
+			RequestIP:    &req.RemoteAddr,
+		}
+
+		jsonData, err := json.Marshal(body)
+		if err != nil {
+			http.Error(rw, "Internal Server Error", http.StatusInternalServerError)
+			return
+		}
+
+		verifyURL := fmt.Sprintf("%s/badger/exchange-session", p.apiBaseUrl)
+		resp, err := http.Post(verifyURL, "application/json", bytes.NewBuffer(jsonData))
+		if err != nil {
+			http.Error(rw, "Internal Server Error", http.StatusInternalServerError)
+			return
+		}
+		defer resp.Body.Close()
+
+		var result ExchangeSessionResponse
+		err = json.NewDecoder(resp.Body).Decode(&result)
+		if err != nil {
+			http.Error(rw, "Internal Server Error", http.StatusInternalServerError)
+			return
+		}
+
+		if result.Data.Cookie != nil && *result.Data.Cookie != "" {
+			rw.Header().Add("Set-Cookie", *result.Data.Cookie)
+
+			queryValues.Del(p.resourceSessionRequestParam)
+			cleanedQuery := queryValues.Encode()
+			originalRequestURL := fmt.Sprintf("%s://%s%s", p.getScheme(req), req.Host, req.URL.Path)
+			if cleanedQuery != "" {
+				originalRequestURL = fmt.Sprintf("%s?%s", originalRequestURL, cleanedQuery)
+			}
+
+			if result.Data.ResponseHeaders != nil {
+				for key, value := range result.Data.ResponseHeaders {
+					rw.Header().Add(key, value)
+				}
+			}
+
+			fmt.Println("Got exchange token, redirecting to", originalRequestURL)
+			http.Redirect(rw, req, originalRequestURL, http.StatusFound)
+			return
+		}
+	}
+
+	cleanedQuery := queryValues.Encode()
+	originalRequestURL := fmt.Sprintf("%s://%s%s", p.getScheme(req), req.Host, req.URL.Path)
+	if cleanedQuery != "" {
+		originalRequestURL = fmt.Sprintf("%s?%s", originalRequestURL, cleanedQuery)
+	}
+
 	verifyURL := fmt.Sprintf("%s/badger/verify-session", p.apiBaseUrl)
-	originalRequestURL := fmt.Sprintf("%s://%s%s", p.getScheme(req), req.Host, req.URL.RequestURI())
+
+	headers := make(map[string]string)
+	for name, values := range req.Header {
+		if len(values) > 0 {
+			headers[name] = values[0] // Send only the first value for simplicity
+		}
+	}
+
+	queryParams := make(map[string]string)
+	for key, values := range queryValues {
+		if len(values) > 0 {
+			queryParams[key] = values[0]
+		}
+	}
 
 	cookieData := VerifyBody{
 		Sessions:           cookies,
@@ -68,6 +160,9 @@ func (p *Badger) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		RequestPath:        &req.URL.Path,
 		RequestMethod:      &req.Method,
 		TLS:                req.TLS != nil,
+		RequestIP:          &req.RemoteAddr,
+		Headers:            headers,
+		Query:              queryParams,
 	}
 
 	jsonData, err := json.Marshal(cookieData)
@@ -83,6 +178,10 @@ func (p *Badger) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	}
 	defer resp.Body.Close()
 
+	for _, setCookie := range resp.Header["Set-Cookie"] {
+		rw.Header().Add("Set-Cookie", setCookie)
+	}
+
 	if resp.StatusCode != http.StatusOK {
 		http.Error(rw, "Internal Server Error", http.StatusInternalServerError)
 		return
@@ -95,24 +194,49 @@ func (p *Badger) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		return
 	}
 
+	if result.Data.ResponseHeaders != nil {
+		for key, value := range result.Data.ResponseHeaders {
+			rw.Header().Add(key, value)
+		}
+	}
+
 	if result.Data.RedirectURL != nil && *result.Data.RedirectURL != "" {
+		fmt.Println("Badger: Redirecting to", *result.Data.RedirectURL)
 		http.Redirect(rw, req, *result.Data.RedirectURL, http.StatusFound)
 		return
 	}
 
-	if !result.Data.Valid {
+	if result.Data.Valid {
-		http.Error(rw, "Unauthorized", http.StatusUnauthorized)
+
+		if result.Data.Username != nil {
+			req.Header.Add("Remote-User", *result.Data.Username)
+		}
+
+		if result.Data.Email != nil {
+			req.Header.Add("Remote-Email", *result.Data.Email)
+		}
+
+		if result.Data.Name != nil {
+			req.Header.Add("Remote-Name", *result.Data.Name)
+		}
+
+		fmt.Println("Badger: Valid session")
+		p.next.ServeHTTP(rw, req)
 		return
 	}
 
-	p.next.ServeHTTP(rw, req)
+	http.Error(rw, "Unauthorized", http.StatusUnauthorized)
 }
 
 func (p *Badger) extractCookies(req *http.Request) map[string]string {
 	cookies := make(map[string]string)
+	isSecureRequest := req.TLS != nil
 
 	for _, cookie := range req.Cookies() {
-		if strings.HasPrefix(cookie.Name, p.userSessionCookieName) || strings.HasPrefix(cookie.Name, p.resourceSessionCookieName) {
+		if strings.HasPrefix(cookie.Name, p.userSessionCookieName) {
+			if cookie.Secure && !isSecureRequest {
+				continue
+			}
 			cookies[cookie.Name] = cookie.Value
 		}
 	}