Backup_Repos/filestash
1
0
Fork 0
mirror of https://github.com/mickael-kerjean/filestash synced 2025-12-06 08:22:24 +01:00
Code Issues Projects Releases Wiki Activity

feature (cookie split): split session cookie onto fixed size chunks - #422

Browse source 
* Fixed invalid cookie issue when session object is serialized into a string larger than 4KB.

* Update session.go

Removed comments

* Update share.go

Removed comments
This commit is contained in:
alexanghh 2022-01-27 06:07:02 +08:00 committed by GitHub
parent a37de01b3b
commit ab71c339dd
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 63 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
server/ctrl/session.go
View file

@ -8,6 +8,7 @@ import (
"github.com/mickael-kerjean/filestash/server/model"
"net/http"
"net/url"
"strconv"
"strings"
"time"
)
@ -84,15 +85,31 @@ func SessionAuthenticate(ctx App, res http.ResponseWriter, req *http.Request) {
SendErrorResult(res, NewError(err.Error(), 500))
return
}
http.SetCookie(res, &http.Cookie{
Name: COOKIE_NAME_AUTH,
Value: obfuscate,
MaxAge: 60 * Config.Get("general.cookie_timeout").Int(),
Path: COOKIE_PATH,
HttpOnly: true,
SameSite: http.SameSiteStrictMode,
})
// split session cookie if greater than 3800 bytes
value_limit := 3800
index := 0
end := 0
for {
if len(obfuscate) >= (index+1)*value_limit {
end = (index + 1) * value_limit
} else {
end = len(obfuscate)
}
http.SetCookie(res, &http.Cookie{
Name: COOKIE_NAME_AUTH + strconv.Itoa(index),
Value: obfuscate[index*value_limit : end],
MaxAge: 60 * Config.Get("general.cookie_timeout").Int(),
Path: COOKIE_PATH,
HttpOnly: true,
SameSite: http.SameSiteStrictMode,
})
if end == len(obfuscate) {
break
} else {
Log.Debug("session::auth obfuscate index: %d length: %d total: %d", index, len(obfuscate[index*value_limit:end]), len(obfuscate))
index++
}
}
if home != "" {
SendSuccessResult(res, home)
return
@ -116,12 +133,20 @@ func SessionLogout(ctx App, res http.ResponseWriter, req *http.Request) {
}
})(ctx, res, req)
}()
http.SetCookie(res, &http.Cookie{
Name: COOKIE_NAME_AUTH,
Value: "",
MaxAge: -1,
Path: COOKIE_PATH,
})
index := 0
for {
_, err := req.Cookie(COOKIE_NAME_AUTH + strconv.Itoa(index))
if err != nil {
break
}
http.SetCookie(res, &http.Cookie{
Name: COOKIE_NAME_AUTH + strconv.Itoa(index),
Value: "",
MaxAge: -1,
Path: COOKIE_PATH,
})
index++
}
http.SetCookie(res, &http.Cookie{
Name: COOKIE_NAME_ADMIN,
Value: "",

15
server/ctrl/share.go
View file

@ -7,6 +7,7 @@ import (
. "github.com/mickael-kerjean/filestash/server/common"
"github.com/mickael-kerjean/filestash/server/model"
"net/http"
"strconv"
"strings"
)
@ -41,11 +42,17 @@ func ShareUpsert(ctx App, res http.ResponseWriter, req *http.Request) {
Id: share_id,
Auth: func() string {
if ctx.Share.Id == "" {
a, err := req.Cookie(COOKIE_NAME_AUTH)
if err != nil {
return ""
str := ""
index := 0
for {
cookie, err := req.Cookie(COOKIE_NAME_AUTH + strconv.Itoa(index))
if err != nil {
break
}
index++
str += cookie.Value
}
return a.Value
return str
}
return ctx.Share.Auth
}(),

15
server/middleware/session.go
View file

@ -10,6 +10,7 @@ import (
"github.com/mickael-kerjean/filestash/server/model"
"net/http"
"regexp"
"strconv"
"strings"
)
@ -256,11 +257,19 @@ func _extractSession(req *http.Request, ctx *App) (map[string]string, error) {
}
return session, err
} else {
cookie, err := req.Cookie(COOKIE_NAME_AUTH)
if err != nil {
str := ""
index := 0
for {
cookie, err := req.Cookie(COOKIE_NAME_AUTH + strconv.Itoa(index))
if err != nil {
break
}
index++
str += cookie.Value
}
if str == "" {
return session, nil
}
str = cookie.Value
str, err = DecryptString(SECRET_KEY_DERIVATE_FOR_USER, str)
if err != nil {
// This typically happen when changing the secret key