Method RegisterRoutes

pkg/oauth/server.go:242–294

(server *web.Server)

}

func (s *server) RegisterRoutes(server *web.Server) {
	router := server.PrefixWithRedirect(s.config.Mount).Subrouter()
	router.Use(
		func(next http.Handler) http.Handler {
			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				r, nonce := webui.WithNonce(r)
				cspString := s.generateCSP(s.configFromContext(r.Context()), nonce)
				w.Header().Set("Content-Security-Policy", cspString)
				next.ServeHTTP(w, r)
			})
		},
		ratelimit.HTTPMiddleware(s.c.RateLimiter(), "http:oauth"),
		func(next http.Handler) http.Handler {
			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				config := s.configFromContext(r.Context())
				r = webui.WithTemplateData(r, config.UI.TemplateData)
				frontendConfig := config.UI.FrontendConfig
				frontendConfig.Language = config.UI.TemplateData.Language
				r = webui.WithAppConfig(r, struct {
					FrontendConfig
				}{
					FrontendConfig: frontendConfig,
				})
				next.ServeHTTP(w, r)
			})
		},
		webhandlers.WithErrorHandlers(map[string]http.Handler{
			"text/html": webui.Template,
		}),
	)

	csrfMiddleware := webmiddleware.CSRF(
		s.config.CSRFAuthKey,
		csrf.CookieName("_csrf"),
		csrf.FieldName("_csrf"),
		csrf.Path("/"),
	)

	page := router.NewRoute().Subrouter()
	page.Use(mux.MiddlewareFunc(csrfMiddleware))

	// The logout route is currently in use by existing OAuth clients. As part of
	// the public API it should not be removed in this major.
	page.Path("/logout").HandlerFunc(s.ClientLogout).Methods(http.MethodGet)

	authorizeHandler := s.redirectToLogin(s.Authorize(webui.Template))
	page.Path("/authorize").Handler(authorizeHandler).Methods(http.MethodGet, http.MethodPost)

	router.Path("/local-callback").HandlerFunc(s.redirectToLocal).Methods(http.MethodGet)

	// No CSRF here:
	router.Path("/token").HandlerFunc(s.Token).Methods(http.MethodPost)
}