studio/tuwunel
2
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix SSO cookie deserialization for cases requiring allocated strings.

Browse Source 
Signed-off-by: Jason Volk <jason@zemos.net>
This commit is contained in:
Jason Volk
2025-12-26 14:18:16 +00:00
parent 806ecaec7e
commit d56ee58a73
1 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/api/client/session/sso.rs
View File

@@ -1,4 +1,4 @@
use std::time::Duration; use std::{borrow::Cow, time::Duration};
use axum::extract::State; use axum::extract::State;
use axum_client_ip::InsecureClientIp; use axum_client_ip::InsecureClientIp;
@@ -55,10 +55,10 @@ struct GrantQuery<'a> {
#[derive(Debug, Deserialize, Serialize)] #[derive(Debug, Deserialize, Serialize)]
struct GrantCookie<'a> { struct GrantCookie<'a> {
client_id: &'a str, client_id: Cow<'a, str>,
state: &'a str, state: Cow<'a, str>,
nonce: &'a str, nonce: Cow<'a, str>,
redirect_uri: &'a str, redirect_uri: Cow<'a, str>,
} }
static GRANT_SESSION_COOKIE: &str = "tuwunel_grant_session"; static GRANT_SESSION_COOKIE: &str = "tuwunel_grant_session";
@@ -136,10 +136,10 @@ pub(crate) async fn sso_login_with_provider_route(
})?; })?;
let cookie_val = GrantCookie { let cookie_val = GrantCookie {
client_id: query.client_id, client_id: query.client_id.into(),
state: query.state, state: query.state.into(),
nonce: &cookie_nonce, nonce: cookie_nonce.as_str().into(),
redirect_uri: redirect_url.as_str(), redirect_uri: redirect_url.as_str().into(),
}; };
let cookie_path = provider let cookie_path = provider
@@ -251,15 +251,15 @@ pub(crate) async fn sso_callback_route(
.transpose()? .transpose()?
.ok_or_else(|| err!(Request(Unauthorized("Missing cookie {GRANT_SESSION_COOKIE:?}"))))?; .ok_or_else(|| err!(Request(Unauthorized("Missing cookie {GRANT_SESSION_COOKIE:?}"))))?;
if cookie.client_id != client_id { if cookie.client_id.as_ref() != client_id.as_str() {
return Err!(Request(Unauthorized("Client ID {client_id:?} cookie mismatch."))); return Err!(Request(Unauthorized("Client ID {client_id:?} cookie mismatch.")));
} }
if Some(cookie.nonce) != session.cookie_nonce.as_deref() { if Some(cookie.nonce.as_ref()) != session.cookie_nonce.as_deref() {
return Err!(Request(Unauthorized("Cookie nonce does not match session state."))); return Err!(Request(Unauthorized("Cookie nonce does not match session state.")));
} }
if cookie.state != sess_id { if cookie.state.as_ref() != sess_id {
return Err!(Request(Unauthorized("Session ID {sess_id:?} cookie mismatch."))); return Err!(Request(Unauthorized("Session ID {sess_id:?} cookie mismatch.")));
} }