Method ValidateBrowserSession

internal/token/auth_token.go:384–419

(gc *gin.Context, encryptedSession string)

}

func (p *provider) ValidateBrowserSession(gc *gin.Context, encryptedSession string) (*SessionData, error) {
	if encryptedSession == "" {
		return nil, fmt.Errorf(`unauthorized`)
	}

	decryptedFingerPrint, err := crypto.DecryptAES(p.config.ClientSecret, encryptedSession)
	if err != nil {
		return nil, err
	}

	var res SessionData
	err = json.Unmarshal([]byte(decryptedFingerPrint), &res)
	if err != nil {
		return nil, err
	}

	sessionStoreKey := res.Subject
	if res.LoginMethod != "" {
		sessionStoreKey = res.LoginMethod + ":" + res.Subject
	}
	token, err := p.dependencies.MemoryStoreProvider.GetUserSession(sessionStoreKey, constants.TokenTypeSessionToken+"_"+res.Nonce)
	if token == "" || err != nil {
		p.dependencies.Log.Debug().Err(err).Msgf("invalid session token: %v, key: %s", err, sessionStoreKey+":"+constants.TokenTypeSessionToken+"_"+res.Nonce)
		return nil, fmt.Errorf(`unauthorized`)
	}

	if subtle.ConstantTimeCompare([]byte(encryptedSession), []byte(token)) != 1 {
		return nil, fmt.Errorf(`unauthorized: invalid nonce`)
	}

	if res.ExpiresAt <= time.Now().Unix() {
		return nil, fmt.Errorf(`unauthorized: token expired`)
	}

	return &res, nil
}

// CreateIDToken util to create the OIDC ID token JWT, based on user
// information, roles config and CUSTOM_ACCESS_TOKEN_SCRIPT.