Function verifyTokenAtEdge

cmd/cloudflared/access/cmd.go:546–573

verifyTokenAtEdge checks for a token on disk, or generates a new one. Then makes a request to the origin with the token to ensure it is valid. Returns nil if token is valid.

(appUrl *url.URL, appInfo *token.AppInfo, c *cli.Context, log *zerolog.Logger)

// Then makes a request to the origin with the token to ensure it is valid.
// Returns nil if token is valid.
func verifyTokenAtEdge(appUrl *url.URL, appInfo *token.AppInfo, c *cli.Context, log *zerolog.Logger) error {
	headers := parseRequestHeaders(c.StringSlice(sshHeaderFlag))
	if c.IsSet(sshTokenIDFlag) {
		headers.Add(cfAccessClientIDHeader, c.String(sshTokenIDFlag))
	}
	if c.IsSet(sshTokenSecretFlag) {
		headers.Add(cfAccessClientSecretHeader, c.String(sshTokenSecretFlag))
	}
	options := &carrier.StartOptions{AppInfo: appInfo, OriginURL: appUrl.String(), Headers: headers, AutoCloseInterstitial: c.Bool(cfdflags.AutoCloseInterstitial), IsFedramp: c.Bool(fedrampFlag)}

	if valid, err := isTokenValid(options, log); err != nil {
		return err
	} else if valid {
		return nil
	}

	if err := token.RemoveTokenIfExists(appInfo); err != nil {
		return err
	}

	if valid, err := isTokenValid(options, log); err != nil {
		return err
	} else if !valid {
		return errors.New("failed to verify token")
	}

	return nil
}

// isTokenValid makes a request to the origin and returns true if the response was not a 302.
func isTokenValid(options *carrier.StartOptions, log *zerolog.Logger) (bool, error) {