forked from paulbellamy/mango
/
sessions.go
136 lines (115 loc) · 3.35 KB
/
sessions.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
package mango
import (
"bytes"
"crypto/hmac"
"crypto/sha1"
"encoding/base64"
"encoding/gob"
"fmt"
"hash"
"io/ioutil"
"net/http"
"strings"
)
func hashCookie(data, secret string) (sum string) {
var h hash.Hash = hmac.New(sha1.New, []byte(secret))
h.Write([]byte(data))
return string(h.Sum(nil))
}
func verifyCookie(data, secret, sum string) bool {
return hashCookie(data, secret) == sum
}
func decodeGob(value string) (result map[string]interface{}) {
buffer := bytes.NewBufferString(value)
decoder := gob.NewDecoder(buffer)
result = make(map[string]interface{})
decoder.Decode(&result)
return result
}
// Due to a bug in golang where when using
// base64.URLEncoding padding is still added
// (it shouldn't be), we have to strip and add
// it ourselves.
func pad64(value string) (result string) {
padding := strings.Repeat("=", len(value)%4)
return strings.Join([]string{value, padding}, "")
}
func decode64(value string) (result string) {
buffer := bytes.NewBufferString(pad64(value))
encoder := base64.NewDecoder(base64.URLEncoding, buffer)
decoded, _ := ioutil.ReadAll(encoder)
return string(decoded)
}
func decodeCookie(value, secret string) (cookie map[string]interface{}) {
cookie = make(map[string]interface{})
split := strings.Split(string(value), "/")
if len(split) < 2 {
return cookie
}
data := decode64(split[0])
sum := decode64(split[1])
if verifyCookie(data, secret, sum) {
cookie = decodeGob(data)
}
return cookie
}
func encodeGob(value interface{}) (result string) {
buffer := new(bytes.Buffer)
encoder := gob.NewEncoder(buffer)
encoder.Encode(value)
return buffer.String()
}
// Due to a bug in golang where when using
// base64.URLEncoding padding is still added
// (it shouldn't be), we have to strip and add
// it ourselves.
func dePad64(value string) (result string) {
return strings.TrimRight(value, "=")
}
func encode64(value string) (result string) {
buffer := new(bytes.Buffer)
encoder := base64.NewEncoder(base64.URLEncoding, buffer)
encoder.Write([]byte(value))
encoder.Close()
return dePad64(buffer.String())
}
func encodeCookie(value map[string]interface{}, secret string) (cookie string) {
data := encodeGob(value)
return fmt.Sprintf("%s/%s", encode64(data), encode64(hashCookie(data, secret)))
}
func prepareSession(env Env, key, secret string) {
for _, cookie := range env.Request().Cookies() {
if cookie.Name == key {
env["mango.session"] = decodeCookie(cookie.Value, secret)
return
}
}
// Didn't find a session to decode
env["mango.session"] = make(map[string]interface{})
}
func commitSession(headers Headers, env Env, key, secret string, options *CookieOptions) {
cookie := new(http.Cookie)
cookie.Name = key
cookie.Value = encodeCookie(env["mango.session"].(map[string]interface{}), secret)
cookie.Path = options.Path
cookie.Domain = options.Domain
cookie.MaxAge = options.MaxAge
cookie.Secure = options.Secure
cookie.HttpOnly = options.HttpOnly
headers.Add("Set-Cookie", cookie.String())
}
type CookieOptions struct {
Domain string
Path string
MaxAge int
Secure bool
HttpOnly bool
}
func Sessions(secret, key string, options *CookieOptions) Middleware {
return func(env Env, app App) (status Status, headers Headers, body Body) {
prepareSession(env, key, secret)
status, headers, body = app(env)
commitSession(headers, env, key, secret, options)
return status, headers, body
}
}