Skip to content

Commit 3c2e609

Browse files
zeripathzeripath
committed
Simplify Gothic to use our session store instead of creating a different store
We have been using xormstore to provide a separate session store for our OAuth2 logins however, this relies on using gorilla context and some doubling of our session storing. We can however, simplify and simply use our own chi-based session store. Thus removing a cookie and some of the weirdness with missing contexts. Signed-off-by: Andrew Thornton <art27@cantab.net>
1 parent 4e8a817 commit 3c2e609

File tree

23 files changed

+95
-933
lines changed

23 files changed

+95
-933
lines changed

‎cmd/web.go

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ import (
1919
"code.gitea.io/gitea/routers"
2020
"code.gitea.io/gitea/routers/install"
2121

22-
context2 "github.com/gorilla/context"
2322
"github.com/urfave/cli"
2423
ini "gopkg.in/ini.v1"
2524
)
@@ -71,7 +70,7 @@ func runHTTPRedirector() {
7170
http.Redirect(w, r, target, http.StatusTemporaryRedirect)
7271
})
7372

74-
var err = runHTTP("tcp", source, "HTTP Redirector", context2.ClearHandler(handler))
73+
var err = runHTTP("tcp", source, "HTTP Redirector", handler)
7574

7675
if err != nil {
7776
log.Fatal("Failed to start port redirection: %v", err)
@@ -205,10 +204,10 @@ func listen(m http.Handler, handleRedirector bool) error {
205204
if handleRedirector {
206205
NoHTTPRedirector()
207206
}
208-
err = runHTTP("tcp", listenAddr, "Web", context2.ClearHandler(m))
207+
err = runHTTP("tcp", listenAddr, "Web", m)
209208
case setting.HTTPS:
210209
if setting.EnableLetsEncrypt {
211-
err = runLetsEncrypt(listenAddr, setting.Domain, setting.LetsEncryptDirectory, setting.LetsEncryptEmail, context2.ClearHandler(m))
210+
err = runLetsEncrypt(listenAddr, setting.Domain, setting.LetsEncryptDirectory, setting.LetsEncryptEmail, m)
212211
break
213212
}
214213
if handleRedirector {
@@ -218,22 +217,22 @@ func listen(m http.Handler, handleRedirector bool) error {
218217
NoHTTPRedirector()
219218
}
220219
}
221-
err = runHTTPS("tcp", listenAddr, "Web", setting.CertFile, setting.KeyFile, context2.ClearHandler(m))
220+
err = runHTTPS("tcp", listenAddr, "Web", setting.CertFile, setting.KeyFile, m)
222221
case setting.FCGI:
223222
if handleRedirector {
224223
NoHTTPRedirector()
225224
}
226-
err = runFCGI("tcp", listenAddr, "FCGI Web", context2.ClearHandler(m))
225+
err = runFCGI("tcp", listenAddr, "FCGI Web", m)
227226
case setting.UnixSocket:
228227
if handleRedirector {
229228
NoHTTPRedirector()
230229
}
231-
err = runHTTP("unix", listenAddr, "Web", context2.ClearHandler(m))
230+
err = runHTTP("unix", listenAddr, "Web", m)
232231
case setting.FCGIUnix:
233232
if handleRedirector {
234233
NoHTTPRedirector()
235234
}
236-
err = runFCGI("unix", listenAddr, "Web", context2.ClearHandler(m))
235+
err = runFCGI("unix", listenAddr, "Web", m)
237236
default:
238237
log.Fatal("Invalid protocol: %s", setting.Protocol)
239238
}

‎cmd/web_letsencrypt.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
"code.gitea.io/gitea/modules/setting"
1414

1515
"github.com/caddyserver/certmagic"
16-
context2 "github.com/gorilla/context"
1716
)
1817

1918
func runLetsEncrypt(listenAddr, domain, directory, email string, m http.Handler) error {
@@ -67,7 +66,7 @@ func runLetsEncrypt(listenAddr, domain, directory, email string, m http.Handler)
6766
}()
6867
}
6968

70-
return runHTTPSWithTLSConfig("tcp", listenAddr, "Web", tlsConfig, context2.ClearHandler(m))
69+
return runHTTPSWithTLSConfig("tcp", listenAddr, "Web", tlsConfig, m)
7170
}
7271

7372
func runLetsEncryptFallbackHandler(w http.ResponseWriter, r *http.Request) {

‎contrib/pr/checkout.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,6 @@ import (
3636
"github.com/go-git/go-git/v5"
3737
"github.com/go-git/go-git/v5/config"
3838
"github.com/go-git/go-git/v5/plumbing"
39-
context2 "github.com/gorilla/context"
4039
"xorm.io/xorm"
4140
)
4241

@@ -138,7 +137,7 @@ func runPR() {
138137
*/
139138

140139
//Start the server
141-
http.ListenAndServe(":8080", context2.ClearHandler(c))
140+
http.ListenAndServe(":8080", c)
142141

143142
log.Printf("[PR] Cleaning up ...\n")
144143
/*

‎go.mod

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,10 +55,9 @@ require (
5555
github.com/golang/snappy v0.0.4 // indirect
5656
github.com/google/go-github/v39 v39.2.0
5757
github.com/google/uuid v1.2.0
58-
github.com/gorilla/context v1.1.1
5958
github.com/gorilla/feeds v1.1.1
6059
github.com/gorilla/mux v1.8.0 // indirect
61-
github.com/gorilla/sessions v1.2.1 // indirect
60+
github.com/gorilla/sessions v1.2.1
6261
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
6362
github.com/hashicorp/go-retryablehttp v0.7.0 // indirect
6463
github.com/hashicorp/go-version v1.3.1
@@ -73,7 +72,6 @@ require (
7372
github.com/klauspost/compress v1.13.1
7473
github.com/klauspost/cpuid/v2 v2.0.9 // indirect
7574
github.com/klauspost/pgzip v1.2.5 // indirect
76-
github.com/lafriks/xormstore v1.4.0
7775
github.com/lib/pq v1.10.2
7876
github.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
7977
github.com/markbates/goth v1.68.0

‎go.sum

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,6 @@ github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAE
7373
github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
7474
github.com/ProtonMail/go-crypto v0.0.0-20210705153151-cc34b1f6908b h1:BF5p87XWvmgdrTPPzcRMwC0TMQbviwQ+uBKfNfWJy50=
7575
github.com/ProtonMail/go-crypto v0.0.0-20210705153151-cc34b1f6908b/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
76-
github.com/PuerkitoBio/goquery v1.5.1/go.mod h1:GsLWisAFVj4WgDibEWF4pvYnkVQBpKBKeU+7zCJoLcc=
7776
github.com/PuerkitoBio/goquery v1.7.0 h1:O5SP3b9JWqMSVMG69zMfj577zwkSNpxrFf7ybS74eiw=
7877
github.com/PuerkitoBio/goquery v1.7.0/go.mod h1:GsLWisAFVj4WgDibEWF4pvYnkVQBpKBKeU+7zCJoLcc=
7978
github.com/PuerkitoBio/purell v1.1.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
@@ -256,7 +255,6 @@ github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964/go.mod h1:Xd9
256255
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
257256
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
258257
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
259-
github.com/denisenkom/go-mssqldb v0.0.0-20200428022330-06a60b6afbbc/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
260258
github.com/denisenkom/go-mssqldb v0.10.0 h1:QykgLZBorFE95+gO3u9esLd0BmbvpWp0/waNNZfHBM8=
261259
github.com/denisenkom/go-mssqldb v0.10.0/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
262260
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
@@ -801,14 +799,11 @@ github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
801799
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
802800
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
803801
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
804-
github.com/lafriks/xormstore v1.4.0 h1:DX1yS9WUhVY+MTHGaOJ2tDVpwL1w/247iro5KR0BQEQ=
805-
github.com/lafriks/xormstore v1.4.0/go.mod h1:5a3wJ6Ro0TFJmJcH1ywtHO/fBEIWYfSfO4WTYmM7qEk=
806802
github.com/lestrrat-go/jwx v0.9.0/go.mod h1:iEoxlYfZjvoGpuWwxUz+eR5e6KTJGsaRcy/YNA/UnBk=
807803
github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
808804
github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
809805
github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
810806
github.com/lib/pq v1.3.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
811-
github.com/lib/pq v1.7.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
812807
github.com/lib/pq v1.10.2 h1:AqzbZs4ZoCBp+GtejcpCpcxM3zlSMx29dXbUSeVtJb8=
813808
github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
814809
github.com/libdns/libdns v0.2.1 h1:Wu59T7wSHRgtA0cfxC+n1c/e+O3upJGWytknkmFEDis=
@@ -858,7 +853,6 @@ github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m
858853
github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4OSgU=
859854
github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
860855
github.com/mattn/go-sqlite3 v1.11.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
861-
github.com/mattn/go-sqlite3 v1.14.0/go.mod h1:JIl7NbARA7phWnGvh0LKTyg7S9BA+6gx71ShQilpsus=
862856
github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
863857
github.com/mattn/go-sqlite3 v1.14.7/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
864858
github.com/mattn/go-sqlite3 v1.14.8 h1:gDp86IdQsN/xWjIEmr9MF6o9mpksUgh0fu+9ByFxzIU=
@@ -1260,7 +1254,6 @@ golang.org/x/crypto v0.0.0-20190617133340-57b3e21c3d56/go.mod h1:yigFU9vqHzYiE8U
12601254
golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
12611255
golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
12621256
golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
1263-
golang.org/x/crypto v0.0.0-20190927123631-a832865fa7ad/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
12641257
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
12651258
golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
12661259
golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -1761,9 +1754,7 @@ sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
17611754
sourcegraph.com/sourcegraph/appdash v0.0.0-20190731080439-ebfcffb1b5c0/go.mod h1:hI742Nqp5OhwiqlzhgfbWU4mW4yO10fP+LoT9WOswdU=
17621755
strk.kbt.io/projects/go/libravatar v0.0.0-20191008002943-06d1c002b251 h1:mUcz5b3FJbP5Cvdq7Khzn6J9OCUQJaBwgBkCR+MOwSs=
17631756
strk.kbt.io/projects/go/libravatar v0.0.0-20191008002943-06d1c002b251/go.mod h1:FJGmPh3vz9jSos1L/F91iAgnC/aejc0wIIrF2ZwJxdY=
1764-
xorm.io/builder v0.3.7/go.mod h1:aUW0S9eb9VCaPohFCH3j7czOx1PMW3i1HrSzbLYGBSE=
17651757
xorm.io/builder v0.3.9 h1:Sd65/LdWyO7LR8+Cbd+e7mm3sK/7U9k0jS3999IDHMc=
17661758
xorm.io/builder v0.3.9/go.mod h1:aUW0S9eb9VCaPohFCH3j7czOx1PMW3i1HrSzbLYGBSE=
1767-
xorm.io/xorm v1.0.6/go.mod h1:uF9EtbhODq5kNWxMbnBEj8hRRZnlcNSz2t2N7HW/+A4=
17681759
xorm.io/xorm v1.2.5 h1:tqN7OhN8P9xi52qBb76I8m5maAJMz/SSbgK2RGPCPbo=
17691760
xorm.io/xorm v1.2.5/go.mod h1:fTG8tSjk6O1BYxwuohZUK+S1glnRycsCF05L1qQyEU0=

‎models/db/store.go

Lines changed: 0 additions & 18 deletions
This file was deleted.

‎services/auth/source/oauth2/init.go

Lines changed: 5 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -5,23 +5,20 @@
55
package oauth2
66

77
import (
8+
"encoding/gob"
89
"net/http"
910
"sync"
1011

11-
"code.gitea.io/gitea/models/db"
1212
"code.gitea.io/gitea/models/login"
1313
"code.gitea.io/gitea/modules/log"
14-
"code.gitea.io/gitea/modules/setting"
1514

1615
"github.com/google/uuid"
16+
"github.com/gorilla/sessions"
1717
"github.com/markbates/goth/gothic"
1818
)
1919

2020
var gothRWMutex = sync.RWMutex{}
2121

22-
// SessionTableName is the table name that OAuth2 will use to store things
23-
const SessionTableName = "oauth2_session"
24-
2522
// UsersStoreKey is the key for the store
2623
const UsersStoreKey = "gitea-oauth2-sessions"
2724

@@ -34,23 +31,12 @@ func Init() error {
3431
return err
3532
}
3633

37-
store, err := db.CreateStore(SessionTableName, UsersStoreKey)
38-
if err != nil {
39-
return err
40-
}
41-
42-
// according to the Goth lib:
43-
// set the maxLength of the cookies stored on the disk to a larger number to prevent issues with:
44-
// securecookie: the value is too long
45-
// when using OpenID Connect , since this can contain a large amount of extra information in the id_token
46-
47-
// Note, when using the FilesystemStore only the session.ID is written to a browser cookie, so this is explicit for the storage on disk
48-
store.MaxLength(setting.OAuth2.MaxTokenLength)
49-
5034
// Lock our mutex
5135
gothRWMutex.Lock()
5236

53-
gothic.Store = store
37+
gob.Register(&sessions.Session{})
38+
39+
gothic.Store = &SessionsStore{}
5440

5541
gothic.SetState = func(req *http.Request) string {
5642
return uuid.New().String()

‎services/auth/source/oauth2/store.go

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
// Copyright 2021 The Gitea Authors. All rights reserved.
2+
// Use of this source code is governed by a MIT-style
3+
// license that can be found in the LICENSE file.
4+
5+
package oauth2
6+
7+
import (
8+
"fmt"
9+
"net/http"
10+
11+
chiSession "gitea.com/go-chi/session"
12+
"github.com/gorilla/sessions"
13+
)
14+
15+
// SessionsStore creates a gothic store from our session
16+
type SessionsStore struct {
17+
}
18+
19+
// Get should return a cached session.
20+
func (st *SessionsStore) Get(r *http.Request, name string) (*sessions.Session, error) {
21+
chiStore := chiSession.GetSession(r)
22+
23+
rawData := chiStore.Get(name)
24+
if rawData == nil {
25+
return st.New(r, name)
26+
}
27+
28+
oldSession, ok := rawData.(*sessions.Session)
29+
if !ok {
30+
return nil, fmt.Errorf("unexpected object in session: %v at name: %s", rawData, name)
31+
}
32+
33+
// Copy over the old data into the session
34+
session := sessions.NewSession(st, name)
35+
session.ID = oldSession.ID
36+
session.IsNew = oldSession.IsNew
37+
session.Options = oldSession.Options
38+
session.Values = oldSession.Values
39+
40+
return session, nil
41+
}
42+
43+
// New should create and return a new session.
44+
//
45+
// Note that New should never return a nil session, even in the case of
46+
// an error if using the Registry infrastructure to cache the session.
47+
func (st *SessionsStore) New(r *http.Request, name string) (*sessions.Session, error) {
48+
chiStore := chiSession.GetSession(r)
49+
50+
session := sessions.NewSession(st, name)
51+
session.ID = chiStore.ID()
52+
53+
rawData := chiStore.Get(name)
54+
if rawData != nil {
55+
oldSession, ok := rawData.(*sessions.Session)
56+
if ok {
57+
session.ID = oldSession.ID
58+
session.IsNew = oldSession.IsNew
59+
session.Options = oldSession.Options
60+
session.Values = oldSession.Values
61+
62+
return session, nil
63+
}
64+
}
65+
66+
return session, chiStore.Set(name, session)
67+
}
68+
69+
// Save should persist session to the underlying store implementation.
70+
func (st *SessionsStore) Save(r *http.Request, w http.ResponseWriter, session *sessions.Session) error {
71+
chiStore := chiSession.GetSession(r)
72+
73+
if err := chiStore.Set(session.Name(), session); err != nil {
74+
return err
75+
}
76+
77+
return chiStore.Release()
78+
}
79+
80+
var _ (sessions.Store) = &SessionsStore{}

‎vendor/github.com/gorilla/context/.travis.yml

Lines changed: 0 additions & 19 deletions
This file was deleted.

‎vendor/github.com/gorilla/context/LICENSE

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎vendor/github.com/gorilla/context/README.md

Lines changed: 0 additions & 10 deletions
This file was deleted.

0 commit comments

Comments
 (0)