finn/forgejo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Reset Session ID on login (#18018)

Browse source 
* Reset Session ID on login

When logging in the SessionID should be reset and the session cleaned up.

Signed-off-by: Andrew Thornton <art27@cantab.net>

* with new session.RegenerateID function

Signed-off-by: Andrew Thornton <art27@cantab.net>

* update go-chi/session

Signed-off-by: Andrew Thornton <art27@cantab.net>

* Ensure that session id is changed after oauth data is set and between account linking pages too

Signed-off-by: Andrew Thornton <art27@cantab.net>

* placate lint

Signed-off-by: Andrew Thornton <art27@cantab.net>

* as per review

Signed-off-by: Andrew Thornton <art27@cantab.net>
This commit is contained in:
zeripath 2021-12-20 14:12:26 +00:00 • committed by GitHub
parent 2cd1479e77
commit bcc13f3889
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
9 changed files with 121 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

22
vendor/gitea.com/go-chi/session/session.go generated vendored
View file

@ -260,7 +260,7 @@ func Sessioner(options ...Options) func(next http.Handler) http.Handler {
return
}
if err = sess.Release(); err != nil {
if err = s.RawStore.Release(); err != nil {
panic("session(release): " + err.Error())
}
})
@ -274,6 +274,26 @@ func GetSession(req *http.Request) Store {
return sess
}
// RegenerateSession
func RegenerateSession(resp http.ResponseWriter, req *http.Request) (Store, error) {
sess, ok := GetSession(req).(*store)
if !ok {
return nil, fmt.Errorf("no session in request context")
}
oldRawStore := sess.RawStore
if err := oldRawStore.Release(); err != nil {
return nil, err
}
store, err := sess.RegenerateID(resp, req)
if err != nil {
return nil, err
}
sess.RawStore = store
return sess, nil
}
// Provider is the interface that provides session manipulations.
type Provider interface {
// Init initializes session provider.

2
vendor/modules.txt vendored
View file

@ -18,7 +18,7 @@ gitea.com/go-chi/cache/memcache
# gitea.com/go-chi/captcha v0.0.0-20211013065431-70641c1a35d5
## explicit
gitea.com/go-chi/captcha
# gitea.com/go-chi/session v0.0.0-20211013065435-7d334f340c09
# gitea.com/go-chi/session v0.0.0-20211218221615-e3605d8b28b8
## explicit
gitea.com/go-chi/session
gitea.com/go-chi/session/couchbase