104 lines
2.1 KiB
Go
104 lines
2.1 KiB
Go
package auth
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"fmt"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
const (
|
|
cookieName = "shop_session"
|
|
sessionTTL = 24 * time.Hour
|
|
)
|
|
|
|
type Session struct {
|
|
secret []byte
|
|
}
|
|
|
|
func NewSession(secret string) *Session {
|
|
return &Session{secret: []byte(secret)}
|
|
}
|
|
|
|
func (s *Session) Create(email string) (string, error) {
|
|
exp := time.Now().Add(sessionTTL).Unix()
|
|
payload := fmt.Sprintf("%s|%d", email, exp)
|
|
sig := s.sign(payload)
|
|
token := base64.URLEncoding.EncodeToString([]byte(payload + "|" + sig))
|
|
return token, nil
|
|
}
|
|
|
|
func (s *Session) Validate(token string) (string, bool) {
|
|
raw, err := base64.URLEncoding.DecodeString(token)
|
|
if err != nil {
|
|
return "", false
|
|
}
|
|
|
|
parts := strings.Split(string(raw), "|")
|
|
if len(parts) != 3 {
|
|
return "", false
|
|
}
|
|
|
|
email, expStr, sig := parts[0], parts[1], parts[2]
|
|
payload := email + "|" + expStr
|
|
|
|
if !hmac.Equal([]byte(sig), []byte(s.sign(payload))) {
|
|
return "", false
|
|
}
|
|
|
|
exp, err := strconv.ParseInt(expStr, 10, 64)
|
|
if err != nil || time.Now().Unix() > exp {
|
|
return "", false
|
|
}
|
|
|
|
return email, true
|
|
}
|
|
|
|
func (s *Session) SetCookie(w http.ResponseWriter, r *http.Request, token string) {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: cookieName,
|
|
Value: token,
|
|
Path: "/admin",
|
|
HttpOnly: true,
|
|
Secure: s.isSecure(r),
|
|
SameSite: http.SameSiteLaxMode,
|
|
MaxAge: int(sessionTTL.Seconds()),
|
|
})
|
|
}
|
|
|
|
func (s *Session) ClearCookie(w http.ResponseWriter, r *http.Request) {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: cookieName,
|
|
Value: "",
|
|
Path: "/admin",
|
|
HttpOnly: true,
|
|
Secure: s.isSecure(r),
|
|
MaxAge: -1,
|
|
})
|
|
}
|
|
|
|
func (s *Session) isSecure(r *http.Request) bool {
|
|
if r.TLS != nil {
|
|
return true
|
|
}
|
|
return strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https")
|
|
}
|
|
|
|
func (s *Session) FromRequest(r *http.Request) (string, bool) {
|
|
c, err := r.Cookie(cookieName)
|
|
if err != nil {
|
|
return "", false
|
|
}
|
|
return s.Validate(c.Value)
|
|
}
|
|
|
|
func (s *Session) sign(payload string) string {
|
|
mac := hmac.New(sha256.New, s.secret)
|
|
mac.Write([]byte(payload))
|
|
return base64.URLEncoding.EncodeToString(mac.Sum(nil))
|
|
}
|