git.sophuwu.com > goauth 
deleted log out functions for stability
sophuwu sophie@skisiel.com
Sun, 18 May 2025 21:35:01 +0200
commit

926a91be9c662f1453829a747dc0521cbc71ac8e

parent

2f42507669ae3ea37a3efa74693ec105b2be3b43

1 files changed, 9 insertions(+), 37 deletions(-)

jump to
M htsesh/session.go → htsesh/session.go 
@@ -3,7 +3,6 @@ 
 import (
 	"crypto/rand"
 	"crypto/sha512"
-	"encoding/base32"
 	"encoding/base64"
 	"net/http"
 	"sync/atomic"

@@ -22,7 +21,12 @@ h.Write([]byte(s.T.String()))
 	return base64.URLEncoding.EncodeToString(h.Sum(nil))
 }
 
-func (s *session) Validate(cookie *http.Cookie) bool {
+func sessionOK(r *http.Request) bool {
+	cookie, err := r.Cookie("session_id")
+	if err != nil {
+		return false
+	}
+	s := sessionID.Load()
 	if s == nil {
 		return false
 	}

@@ -38,43 +42,10 @@ }
 	return true
 }
 
-func sessionOK(r *http.Request) bool {
-	cookie, err := r.Cookie("session_id")
-	if err != nil {
-		return false
-	}
-	return sessionID.Load().Validate(cookie)
-}
-
-func Logout(w http.ResponseWriter, r *http.Request) {
-	if r.URL.Path == "/logout" {
-		ji := base32.StdEncoding.EncodeToString(sessionID.Load().V[:5])
-		if r.URL.Query().Get("logoutid") == ji {
-			sessionID.Store(nil)
-			http.SetCookie(w, &http.Cookie{
-				Name:     "session_id",
-				Value:    "",
-				HttpOnly: true,
-				Secure:   true,
-				Expires:  time.Now(),
-				SameSite: http.SameSiteStrictMode,
-			})
-			http.Redirect(w, r, r.URL.Path, http.StatusSeeOther)
-		} else {
-			w.Header().Set("Content-Type", "text/html")
-			w.WriteHeader(http.StatusUnauthorized)
-			w.Write([]byte("<html><body><a href='?logout&logoutid=" + ji + "'>Logout</a></body></html>"))
-		}
-		return
-	}
-}
-
 func Authenticate(next http.HandlerFunc) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if sessionOK(r) {
+		if sessionOK(r) || loginHandler(w, r) {
 			next.ServeHTTP(w, r)
-		} else if loginHandler(w, r) {
-			http.Redirect(w, r, r.URL.Path, http.StatusSeeOther)
 		} else {
 			w.Header().Set("Content-Type", "text/html")
 			w.WriteHeader(http.StatusUnauthorized)

@@ -104,7 +75,6 @@ n, err := rand.Read(s.V)
 	if err != nil || 32 != len(s.V) || n != 32 {
 		return false
 	}
-	sessionID.Store(&s)
 	http.SetCookie(w, &http.Cookie{
 		Name:     "session_id",
 		Value:    s.Hash(),

@@ -113,6 +83,7 @@ Secure:   true,
 		Expires:  s.T,
 		SameSite: http.SameSiteStrictMode,
 	})
+	sessionID.Store(&s)
 	return true
 }
 

@@ -133,3 +104,4 @@ <input type="password" autocomplete="off" name="password" placeholder="password">
 <input type="text" autocomplete="off" placeholder="otp" name="otp">
 <input type="submit" value="submit">
 </form></body></html>`
+