// OAuthStart starts the authenticate process by redirecting to the identity provider.
// https://tools.ietf.org/html/rfc6749#section-4.2.1
OAuthStart starts the authenticate process by redirecting to the identity provider.
// OAuthStart starts the authenticate process by redirecting to the identity provider . // https : // tools . ietf . org / html / rfc6749#section - 4 . 2 . 1
func (a *Authenticate) OAuthStart(w http.ResponseWriter, r *http.Request) {
	authRedirectURL := a.RedirectURL.ResolveReference(r.URL)
	nonce := fmt.Sprintf("%x", cryptutil.GenerateKey())
	a.csrfStore.SetCSRF(w, r, nonce)
	if !middleware.SameSubdomain(authRedirectURL, a.RedirectURL) {
		httputil.ErrorResponse(w, r, "Invalid redirect parameter", http.StatusBadRequest)
		return
	}
	proxyRedirectURL, err := url.Parse(authRedirectURL.Query().Get("redirect_uri"))
	if err != nil || !middleware.SameSubdomain(proxyRedirectURL, a.RedirectURL) {
		httputil.ErrorResponse(w, r, "Invalid redirect parameter", http.StatusBadRequest)
		return
	}
	proxyRedirectSig := authRedirectURL.Query().Get("sig")
	ts := authRedirectURL.Query().Get("ts")
	if !middleware.ValidSignature(proxyRedirectURL.String(), proxyRedirectSig, ts, a.SharedKey) {
		httputil.ErrorResponse(w, r, "Invalid redirect parameter", http.StatusBadRequest)
		return
	}
	state := base64.URLEncoding.EncodeToString([]byte(fmt.Sprintf("%v:%v", nonce, authRedirectURL.String())))
	signInURL := a.provider.GetSignInURL(state)
	http.Redirect(w, r, signInURL, http.StatusFound)
}
func ( a * Authenticate ) OAuthStart ( w http . ResponseWriter , r * http . Request ) { authRedirectURL := a . RedirectURL . ResolveReference ( r . URL ) nonce := fmt . Sprintf ( " " , cryptutil . GenerateKey ( ) ) a . csrfStore . SetCSRF ( w , r , nonce ) if ! middleware . SameSubdomain ( authRedirectURL , a . RedirectURL ) { httputil . ErrorResponse ( w , r , " " , http . StatusBadRequest ) return } proxyRedirectURL , err := url . Parse ( authRedirectURL . Query ( ) . Get ( " " ) ) if err != nil || ! middleware . SameSubdomain ( proxyRedirectURL , a . RedirectURL ) { httputil . ErrorResponse ( w , r , " " , http . StatusBadRequest ) return } proxyRedirectSig := authRedirectURL . Query ( ) . Get ( " " ) ts := authRedirectURL . Query ( ) . Get ( " " ) if ! middleware . ValidSignature ( proxyRedirectURL . String ( ) , proxyRedirectSig , ts , a . SharedKey ) { httputil . ErrorResponse ( w , r , " " , http . StatusBadRequest ) return } state := base64 . URLEncoding . EncodeToString ( [ ] byte ( fmt . Sprintf ( " " , nonce , authRedirectURL . String ( ) ) ) ) signInURL := a . provider . GetSignInURL ( state ) http . Redirect ( w , r , signInURL , http . StatusFound ) }
OAuthStart starts the authenticate process by redirecting to the identity provider.
OAuthStart starts the authenticate process by redirecting to the identity provider .
// verify redirect uri is from the root domain // verify proxy url is from the root domain // get the signature and timestamp values then compare hmac // concat base64'd nonce and authenticate url to make state // build the provider sign in url