Skip to content

Commit bd54abd

Browse files
KN4CK3RKN4CK3R
committed
Decoupled code from DefaultSigningKey.
1 parent 4debb74 commit bd54abd

File tree

4 files changed

+26
-26
lines changed

4 files changed

+26
-26
lines changed

‎routers/web/user/oauth.go

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ type AccessTokenResponse struct {
133133
IDToken string `json:"id_token,omitempty"`
134134
}
135135

136-
func newAccessTokenResponse(grant *models.OAuth2Grant, signingKey oauth2.JWTSigningKey) (*AccessTokenResponse, *AccessTokenError) {
136+
func newAccessTokenResponse(grant *models.OAuth2Grant, serverKey, clientKey oauth2.JWTSigningKey) (*AccessTokenResponse, *AccessTokenError) {
137137
if setting.OAuth2.InvalidateRefreshTokens {
138138
if err := grant.IncreaseCounter(); err != nil {
139139
return nil, &AccessTokenError{
@@ -151,7 +151,7 @@ func newAccessTokenResponse(grant *models.OAuth2Grant, signingKey oauth2.JWTSign
151151
ExpiresAt: expirationDate.AsTime().Unix(),
152152
},
153153
}
154-
signedAccessToken, err := accessToken.SignToken()
154+
signedAccessToken, err := accessToken.SignToken(serverKey)
155155
if err != nil {
156156
return nil, &AccessTokenError{
157157
ErrorCode: AccessTokenErrorCodeInvalidRequest,
@@ -169,7 +169,7 @@ func newAccessTokenResponse(grant *models.OAuth2Grant, signingKey oauth2.JWTSign
169169
ExpiresAt: refreshExpirationDate,
170170
},
171171
}
172-
signedRefreshToken, err := refreshToken.SignToken()
172+
signedRefreshToken, err := refreshToken.SignToken(serverKey)
173173
if err != nil {
174174
return nil, &AccessTokenError{
175175
ErrorCode: AccessTokenErrorCodeInvalidRequest,
@@ -225,7 +225,7 @@ func newAccessTokenResponse(grant *models.OAuth2Grant, signingKey oauth2.JWTSign
225225
idToken.EmailVerified = user.IsActive
226226
}
227227

228-
signedIDToken, err = idToken.SignToken(signingKey)
228+
signedIDToken, err = idToken.SignToken(clientKey)
229229
if err != nil {
230230
return nil, &AccessTokenError{
231231
ErrorCode: AccessTokenErrorCodeInvalidRequest,
@@ -541,24 +541,25 @@ func AccessTokenOAuth(ctx *context.Context) {
541541
}
542542
}
543543

544-
signingKey := oauth2.DefaultSigningKey
545-
if signingKey.IsSymmetric() {
546-
clientKey, err := oauth2.CreateJWTSingingKey(signingKey.SigningMethod().Alg(), []byte(form.ClientSecret))
544+
serverKey := oauth2.DefaultSigningKey
545+
clientKey := serverKey
546+
if serverKey.IsSymmetric() {
547+
var err error
548+
clientKey, err = oauth2.CreateJWTSingingKey(serverKey.SigningMethod().Alg(), []byte(form.ClientSecret))
547549
if err != nil {
548550
handleAccessTokenError(ctx, AccessTokenError{
549551
ErrorCode: AccessTokenErrorCodeInvalidRequest,
550552
ErrorDescription: "Error creating signing key",
551553
})
552554
return
553555
}
554-
signingKey = clientKey
555556
}
556557

557558
switch form.GrantType {
558559
case "refresh_token":
559-
handleRefreshToken(ctx, form, signingKey)
560+
handleRefreshToken(ctx, form, serverKey, clientKey)
560561
case "authorization_code":
561-
handleAuthorizationCode(ctx, form, signingKey)
562+
handleAuthorizationCode(ctx, form, serverKey, clientKey)
562563
default:
563564
handleAccessTokenError(ctx, AccessTokenError{
564565
ErrorCode: AccessTokenErrorCodeUnsupportedGrantType,
@@ -567,8 +568,8 @@ func AccessTokenOAuth(ctx *context.Context) {
567568
}
568569
}
569570

570-
func handleRefreshToken(ctx *context.Context, form forms.AccessTokenForm, signingKey oauth2.JWTSigningKey) {
571-
token, err := oauth2.ParseToken(form.RefreshToken)
571+
func handleRefreshToken(ctx *context.Context, form forms.AccessTokenForm, serverKey, clientKey oauth2.JWTSigningKey) {
572+
token, err := oauth2.ParseToken(form.RefreshToken, serverKey)
572573
if err != nil {
573574
handleAccessTokenError(ctx, AccessTokenError{
574575
ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
@@ -595,15 +596,15 @@ func handleRefreshToken(ctx *context.Context, form forms.AccessTokenForm, signin
595596
log.Warn("A client tried to use a refresh token for grant_id = %d was used twice!", grant.ID)
596597
return
597598
}
598-
accessToken, tokenErr := newAccessTokenResponse(grant, signingKey)
599+
accessToken, tokenErr := newAccessTokenResponse(grant, serverKey, clientKey)
599600
if tokenErr != nil {
600601
handleAccessTokenError(ctx, *tokenErr)
601602
return
602603
}
603604
ctx.JSON(http.StatusOK, accessToken)
604605
}
605606

606-
func handleAuthorizationCode(ctx *context.Context, form forms.AccessTokenForm, signingKey oauth2.JWTSigningKey) {
607+
func handleAuthorizationCode(ctx *context.Context, form forms.AccessTokenForm, serverKey, clientKey oauth2.JWTSigningKey) {
607608
app, err := models.GetOAuth2ApplicationByClientID(form.ClientID)
608609
if err != nil {
609610
handleAccessTokenError(ctx, AccessTokenError{
@@ -657,7 +658,7 @@ func handleAuthorizationCode(ctx *context.Context, form forms.AccessTokenForm, s
657658
ErrorDescription: "cannot proceed your request",
658659
})
659660
}
660-
resp, tokenErr := newAccessTokenResponse(authorizationCode.Grant, signingKey)
661+
resp, tokenErr := newAccessTokenResponse(authorizationCode.Grant, serverKey, clientKey)
661662
if tokenErr != nil {
662663
handleAccessTokenError(ctx, *tokenErr)
663664
return

‎routers/web/user/oauth_test.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,8 @@ func createAndParseToken(t *testing.T, grant *models.OAuth2Grant) *oauth2.OIDCTo
1818
signingKey, err := oauth2.CreateJWTSingingKey("HS256", make([]byte, 32))
1919
assert.NoError(t, err)
2020
assert.NotNil(t, signingKey)
21-
oauth2.DefaultSigningKey = signingKey
2221

23-
response, terr := newAccessTokenResponse(grant, signingKey)
22+
response, terr := newAccessTokenResponse(grant, signingKey, signingKey)
2423
assert.Nil(t, terr)
2524
assert.NotNil(t, response)
2625

‎services/auth/oauth2.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,9 @@ func CheckOAuthAccessToken(accessToken string) int64 {
2929
if !strings.Contains(accessToken, ".") {
3030
return 0
3131
}
32-
token, err := oauth2.ParseToken(accessToken)
32+
token, err := oauth2.ParseToken(accessToken, oauth2.DefaultSigningKey)
3333
if err != nil {
34-
log.Trace("ParseOAuth2Token: %v", err)
34+
log.Trace("oauth2.ParseToken: %v", err)
3535
return 0
3636
}
3737
var grant *models.OAuth2Grant

‎services/auth/source/oauth2/token.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,12 @@ type Token struct {
4040
}
4141

4242
// ParseToken parses a signed jwt string
43-
func ParseToken(jwtToken string) (*Token, error) {
43+
func ParseToken(jwtToken string, signingKey JWTSigningKey) (*Token, error) {
4444
parsedToken, err := jwt.ParseWithClaims(jwtToken, &Token{}, func(token *jwt.Token) (interface{}, error) {
45-
if token.Method == nil || token.Method.Alg() != DefaultSigningKey.SigningMethod().Alg() {
45+
if token.Method == nil || token.Method.Alg() != signingKey.SigningMethod().Alg() {
4646
return nil, fmt.Errorf("unexpected signing algo: %v", token.Header["alg"])
4747
}
48-
return DefaultSigningKey.VerifyKey(), nil
48+
return signingKey.VerifyKey(), nil
4949
})
5050
if err != nil {
5151
return nil, err
@@ -59,11 +59,11 @@ func ParseToken(jwtToken string) (*Token, error) {
5959
}
6060

6161
// SignToken signs the token with the JWT secret
62-
func (token *Token) SignToken() (string, error) {
62+
func (token *Token) SignToken(signingKey JWTSigningKey) (string, error) {
6363
token.IssuedAt = time.Now().Unix()
64-
jwtToken := jwt.NewWithClaims(DefaultSigningKey.SigningMethod(), token)
65-
DefaultSigningKey.PreProcessToken(jwtToken)
66-
return jwtToken.SignedString(DefaultSigningKey.SignKey())
64+
jwtToken := jwt.NewWithClaims(signingKey.SigningMethod(), token)
65+
signingKey.PreProcessToken(jwtToken)
66+
return jwtToken.SignedString(signingKey.SignKey())
6767
}
6868

6969
// OIDCToken represents an OpenID Connect id_token

0 commit comments

Comments
 (0)