Mirrors/sftpgo
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2025-12-07 06:40:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

allow to configure JWT tokens and cookies duration

Browse Source 
Fixes #1839

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
This commit is contained in:
Nicola Murino
2024-12-18 18:33:37 +01:00
parent 6a72552754
commit ec90b61bb4
11 changed files with 175 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
internal/httpd/server.go
View File

@@ -758,7 +758,7 @@ func (s *httpdServer) loginUser(
errorFunc(w, r, util.NewI18nError(err, util.I18nError500Message))
return
}
invalidateToken(r, !isSecondFactorAuth)
invalidateToken(r)
if audience == tokenAudienceWebClientPartial {
redirectPath := webClientTwoFactorPath
if next := r.URL.Query().Get("next"); strings.HasPrefix(next, webClientFilesPath) {
@@ -806,7 +806,7 @@ func (s *httpdServer) loginAdmin(
errorFunc(w, r, util.NewI18nError(err, util.I18nError500Message))
return
}
invalidateToken(r, !isSecondFactorAuth)
invalidateToken(r)
if audience == tokenAudienceWebAdminPartial {
http.Redirect(w, r, webAdminTwoFactorPath, http.StatusFound)
return
@@ -822,7 +822,7 @@ func (s *httpdServer) loginAdmin(
func (s *httpdServer) logout(w http.ResponseWriter, r *http.Request) {
r.Body = http.MaxBytesReader(w, r.Body, maxLoginBodySize)
invalidateToken(r, false)
invalidateToken(r)
sendAPIResponse(w, r, nil, "Your token has been invalidated", http.StatusOK)
}
@@ -1009,9 +1009,13 @@ func (s *httpdServer) checkCookieExpiration(w http.ResponseWriter, r *http.Reque
if tokenClaims.Username == "" || tokenClaims.Signature == "" {
return
}
if time.Until(token.Expiration()) > tokenRefreshThreshold {
if time.Until(token.Expiration()) > cookieRefreshThreshold {
return
}
if (time.Since(token.IssuedAt()) + cookieTokenDuration) > maxTokenDuration {
return
}
tokenClaims.JwtIssuedAt = token.IssuedAt()
if slices.Contains(token.Audience(), tokenAudienceWebClient) {
s.refreshClientToken(w, r, &tokenClaims)
} else {