feat: secure cookies and same site set

handlers.go

@@ -35,7 +35,6 @@ func callbackHandler(c *gin.Context) {
 
 	if c.Query("state") != state || codeVerifier == nil {
 		log.Println("State invalid or verifier was not stored")
-		// TODO: Proper pages
 		c.HTML(500, "oidcerror.tmpl", gin.H{
 			"error": "ERR_INVALID_STATE",
 		})
@@ -92,7 +91,7 @@ func callbackHandler(c *gin.Context) {
 
 	// Verify NONCE
 	if nonce != claims.Nonce {
-		log.Println("Token verificcation failed", err)
+		log.Println("Token verificcation failed (none missing)")
 		c.HTML(500, "oidcerror.tmpl", gin.H{
 			"error": "ERR_AUTH",
 		})
@@ -102,8 +101,6 @@ func callbackHandler(c *gin.Context) {
 
 	if userFunc != nil {
 		userFunc(claims.Uid, claims.Name, claims.Email)
-	} else {
-		log.Println("[JHID] WARNING: No user function defined")
 	}
 
 	// Clear session data of oauth related state
@@ -115,6 +112,13 @@ func callbackHandler(c *gin.Context) {
 
 	session.Set("jhid_auth", true)
 	session.Set("jhid_uid", claims.Uid)
+	session.Options(sessions.Options{
+		Path:     "/",
+		SameSite: sameSiteMode,
+		HttpOnly: true,
+		Secure:   prod,
+		MaxAge:   172800, // Expires in 2 days
+	})
 	session.Save()
 
 	if redir != nil {

main.go

@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"log"
+	"net/http"
 	"os"
 
 	"github.com/coreos/go-oidc/v3/oidc"
@@ -27,23 +28,39 @@ var (
 	userFunc        UserFunc
 	verifier        oidc.IDTokenVerifier
 	defaultRedirect string
+	prod            bool
+	sameSiteMode    http.SameSite
 )
 
 // Wraps the normal configure function, but also gives you access to change the User Function, which is called upon login.
 // It is used to create or update a user.
 // The check middleware may be nil, in which case a default is used. Otherwise should be a valid gin middleware, calling c.Next() if okay to proceed.
-func ConfigureFull(r *gin.Engine, app_url string, default_redirect string, user_function UserFunc, stubs_on_unconfigured bool, check_middleware func(c *gin.Context)) {
+func ConfigureFull(
+	r *gin.Engine,
+	app_url string,
+	default_redirect string,
+	user_function UserFunc,
+	stubs_on_unconfigured bool,
+	check_middleware func(c *gin.Context),
+	production bool,
+) {
 	userFunc = user_function
-	Configure(r, app_url, default_redirect, stubs_on_unconfigured, check_middleware)
+	Configure(r, app_url, default_redirect, stubs_on_unconfigured, check_middleware, production)
 }
 
 // Configure and set up the login SDK
 // The check middleware may be nil, in which case a default is used. Otherwise should be a valid gin middleware, calling c.Next() if okay to proceed.
-func Configure(r *gin.Engine, app_url string, default_redirect string, stubs_on_unconfigured bool, check_middleware func(c *gin.Context)) {
+func Configure(r *gin.Engine, app_url string, default_redirect string, stubs_on_unconfigured bool, check_middleware func(c *gin.Context), production bool) {
 	issuer := os.Getenv("OIDC_ISSUER")
 	clientID := os.Getenv("OIDC_CLIENT_ID")
 	clientSecret := os.Getenv("OIDC_CLIENT_SECRET")
 	defaultRedirect = default_redirect
+	prod = production
+	if prod {
+		sameSiteMode = http.SameSiteNoneMode
+	} else {
+		sameSiteMode = http.SameSiteDefaultMode
+	}
 
 	if issuer == "" || clientID == "" || clientSecret == "" {
 		if stubs_on_unconfigured {
@@ -55,6 +72,10 @@ func Configure(r *gin.Engine, app_url string, default_redirect string, stubs_on_
 		}
 	}
 
+	if userFunc == nil {
+		log.Println("[JHID] WARNING: No user function defined")
+	}
+
 	provider, err := oidc.NewProvider(context.Background(), issuer)
 	if err != nil {
 		log.Fatal("[JHID] Provider resolution failed with error", err)