// OAuthCallback validates the cookie sent back from the authenticate service. This function will
// contain an error, or it will contain a `code`; the code can be used to fetch an access token, and
// other metadata, from the authenticator.
// finish the oauth cycle
OAuthCallback validates the cookie sent back from the authenticate service. This function will
contain an error, or it will contain a `code`; the code can be used to fetch an access token, and
other metadata, from the authenticator.
finish the oauth cycle
// OAuthCallback validates the cookie sent back from the authenticate service . This function will // contain an error or it will contain a ` code ` ; the code can be used to fetch an access token and // other metadata from the authenticator . // finish the oauth cycle
func (p *Proxy) OAuthCallback(w http.ResponseWriter, r *http.Request) {
	err := r.ParseForm()
	if err != nil {
		log.FromRequest(r).Error().Err(err).Msg("proxy: failed parsing request form")
		httputil.ErrorResponse(w, r, err.Error(), http.StatusInternalServerError)
		return
	}
	errorString := r.Form.Get("error")
	if errorString != "" {
		httputil.ErrorResponse(w, r, errorString, http.StatusForbidden)
		return
	}
	session, err := p.AuthenticateClient.Redeem(r.Context(), r.Form.Get("code"))
	if err != nil {
		log.FromRequest(r).Error().Err(err).Msg("proxy: error redeeming authorization code")
		httputil.ErrorResponse(w, r, "Internal error", http.StatusInternalServerError)
		return
	}
	encryptedState := r.Form.Get("state")
	stateParameter := &StateParameter{}
	err = p.cipher.Unmarshal(encryptedState, stateParameter)
	if err != nil {
		log.FromRequest(r).Error().Err(err).Msg("proxy: could not unmarshal state")
		httputil.ErrorResponse(w, r, "Internal error", http.StatusInternalServerError)
		return
	}
	c, err := p.csrfStore.GetCSRF(r)
	if err != nil {
		log.FromRequest(r).Error().Err(err).Msg("proxy: failed parsing csrf cookie")
		httputil.ErrorResponse(w, r, err.Error(), http.StatusBadRequest)
		return
	}
	p.csrfStore.ClearCSRF(w, r)
	encryptedCSRF := c.Value
	csrfParameter := &StateParameter{}
	err = p.cipher.Unmarshal(encryptedCSRF, csrfParameter)
	if err != nil {
		log.FromRequest(r).Error().Err(err).Msg("proxy: couldn't unmarshal CSRF")
		httputil.ErrorResponse(w, r, "Internal error", http.StatusInternalServerError)
		return
	}
	if encryptedState == encryptedCSRF {
		log.FromRequest(r).Error().Msg("encrypted state and CSRF should not be equal")
		httputil.ErrorResponse(w, r, "Bad request", http.StatusBadRequest)
		return
	}
	if !reflect.DeepEqual(stateParameter, csrfParameter) {
		log.FromRequest(r).Error().Msg("state and CSRF should be equal")
		httputil.ErrorResponse(w, r, "Bad request", http.StatusBadRequest)
		return
	}
	err = p.sessionStore.SaveSession(w, r, session)
	if err != nil {
		log.FromRequest(r).Error().Msg("error saving session")
		httputil.ErrorResponse(w, r, "Error saving session", http.StatusInternalServerError)
		return
	}
	log.FromRequest(r).Debug().
		Str("code", r.Form.Get("code")).
		Str("state", r.Form.Get("state")).
		Str("RefreshToken", session.RefreshToken).
		Str("session", session.AccessToken).
		Str("RedirectURI", stateParameter.RedirectURI).
		Msg("session")
	http.Redirect(w, r, stateParameter.RedirectURI, http.StatusFound)
}
func ( p * Proxy ) OAuthCallback ( w http . ResponseWriter , r * http . Request ) { err := r . ParseForm ( ) if err != nil { log . FromRequest ( r ) . Error ( ) . Err ( err ) . Msg ( " " ) httputil . ErrorResponse ( w , r , err . Error ( ) , http . StatusInternalServerError ) return } errorString := r . Form . Get ( " " ) if errorString != " " { httputil . ErrorResponse ( w , r , errorString , http . StatusForbidden ) return } session , err := p . AuthenticateClient . Redeem ( r . Context ( ) , r . Form . Get ( " " ) ) if err != nil { log . FromRequest ( r ) . Error ( ) . Err ( err ) . Msg ( " " ) httputil . ErrorResponse ( w , r , " " , http . StatusInternalServerError ) return } encryptedState := r . Form . Get ( " " ) stateParameter := & StateParameter { } err = p . cipher . Unmarshal ( encryptedState , stateParameter ) if err != nil { log . FromRequest ( r ) . Error ( ) . Err ( err ) . Msg ( " " ) httputil . ErrorResponse ( w , r , " " , http . StatusInternalServerError ) return } c , err := p . csrfStore . GetCSRF ( r ) if err != nil { log . FromRequest ( r ) . Error ( ) . Err ( err ) . Msg ( " " ) httputil . ErrorResponse ( w , r , err . Error ( ) , http . StatusBadRequest ) return } p . csrfStore . ClearCSRF ( w , r ) encryptedCSRF := c . Value csrfParameter := & StateParameter { } err = p . cipher . Unmarshal ( encryptedCSRF , csrfParameter ) if err != nil { log . FromRequest ( r ) . Error ( ) . Err ( err ) . Msg ( " " ) httputil . ErrorResponse ( w , r , " " , http . StatusInternalServerError ) return } if encryptedState == encryptedCSRF { log . FromRequest ( r ) . Error ( ) . Msg ( " " ) httputil . ErrorResponse ( w , r , " " , http . StatusBadRequest ) return } if ! reflect . DeepEqual ( stateParameter , csrfParameter ) { log . FromRequest ( r ) . Error ( ) . Msg ( " " ) httputil . ErrorResponse ( w , r , " " , http . StatusBadRequest ) return } err = p . sessionStore . SaveSession ( w , r , session ) if err != nil { log . FromRequest ( r ) . Error ( ) . Msg ( " " ) httputil . ErrorResponse ( w , r , " " , http . StatusInternalServerError ) return } log . FromRequest ( r ) . Debug ( ) . Str ( " " , r . Form . Get ( " " ) ) . Str ( " " , r . Form . Get ( " " ) ) . Str ( " " , session . RefreshToken ) . Str ( " " , session . AccessToken ) . Str ( " " , stateParameter . RedirectURI ) . Msg ( " " ) http . Redirect ( w , r , stateParameter . RedirectURI , http . StatusFound ) }
OAuthCallback validates the cookie sent back from the authenticate service.
OAuthCallback validates the cookie sent back from the authenticate service .
// We begin the process of redeeming the code for an access token. // We store the session in a cookie and redirect the user back to the application // This is the redirect back to the original requested application