Asara/sudoscientist-go-backend
Archived
1
0
Fork 0
Code Issues Pull requests Releases 2 Wiki Activity

Update jwtauth and remove jwt-go since it has vulns

Browse source
This commit is contained in:
Amarpreet Minhas 2021-01-16 19:26:19 -05:00
parent cb75af9997
commit f1987e310a
2 changed files with 19 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
main.go
View file

@ -1,6 +1,7 @@
package main package main
import ( import (
"compress/flate"
"fmt" "fmt"
_ "github.com/lib/pq" _ "github.com/lib/pq"
"log" "log"
@ -61,11 +62,13 @@ func Routes() *chi.Mux {
MaxAge: 360, MaxAge: 360,
}) })
compressor := middleware.NewCompressor(flate.DefaultCompression)
router.Use( router.Use(
compressor.Handler,
cors.Handler, cors.Handler,
render.SetContentType(render.ContentTypeJSON), render.SetContentType(render.ContentTypeJSON),
middleware.Logger, middleware.Logger,
middleware.DefaultCompress,
middleware.RedirectSlashes, middleware.RedirectSlashes,
middleware.Recoverer, middleware.Recoverer,
) )

38
packages/auth/auth.go
View file

@ -8,7 +8,6 @@ import (
"git.minhas.io/asara/sudoscientist-go-backend/packages/middleware" "git.minhas.io/asara/sudoscientist-go-backend/packages/middleware"
"git.minhas.io/asara/sudoscientist-go-backend/packages/users" "git.minhas.io/asara/sudoscientist-go-backend/packages/users"
"github.com/badoux/checkmail" "github.com/badoux/checkmail"
"github.com/dgrijalva/jwt-go"
"github.com/go-chi/chi" "github.com/go-chi/chi"
"github.com/go-chi/jwtauth" "github.com/go-chi/jwtauth"
"github.com/go-chi/render" "github.com/go-chi/render"
@ -66,7 +65,6 @@ type Claims struct {
Username string `json:"username", db:"username"` Username string `json:"username", db:"username"`
Admin bool `json:"admin", db:"admin"` Admin bool `json:"admin", db:"admin"`
Verified bool `json:"verified", db:"verified"` Verified bool `json:"verified", db:"verified"`
jwt.StandardClaims
} }
type JWT struct { type JWT struct {
@ -175,14 +173,12 @@ func register(w http.ResponseWriter, r *http.Request) {
} }
users.CreateProfile(creds.Username, creds.Email) users.CreateProfile(creds.Username, creds.Email)
expirationTime := time.Now().Add(24 * time.Hour) expirationTime := time.Now().Add(24 * time.Hour)
claims := &Claims{ claims := map[string]interface{}{
Username: creds.Username, "username": creds.Username,
Admin: false, "admin": false,
Verified: false, "verified": false,
StandardClaims: jwt.StandardClaims{
ExpiresAt: expirationTime.Unix(),
},
} }
jwtauth.SetExpiry(claims, expirationTime)
if PostalEnabled { if PostalEnabled {
_, emailToken, _ := EmailAuth.Encode(claims) _, emailToken, _ := EmailAuth.Encode(claims)
returnMessage, ok := sendEmailToken(w, emailToken, creds.Username, creds.Email) returnMessage, ok := sendEmailToken(w, emailToken, creds.Username, creds.Email)
@ -227,14 +223,12 @@ func signin(w http.ResponseWriter, r *http.Request) {
user_claims := &Claims{} user_claims := &Claims{}
user_claims_query := DB.QueryRow("SELECT username, admin, verified FROM users WHERE username=$1", creds.Username) user_claims_query := DB.QueryRow("SELECT username, admin, verified FROM users WHERE username=$1", creds.Username)
err = user_claims_query.Scan(&user_claims.Username, &user_claims.Admin, &user_claims.Verified) err = user_claims_query.Scan(&user_claims.Username, &user_claims.Admin, &user_claims.Verified)
claims := &Claims{ claims := map[string]interface{}{
Username: user_claims.Username, "username": user_claims.Username,
Admin: user_claims.Admin, "admin": user_claims.Admin,
Verified: user_claims.Verified, "verified": user_claims.Verified,
StandardClaims: jwt.StandardClaims{
ExpiresAt: expirationTime.Unix(),
},
} }
jwtauth.SetExpiry(claims, expirationTime)
_, tokenString, _ := TokenAuth.Encode(claims) _, tokenString, _ := TokenAuth.Encode(claims)
setCookies(w, tokenString, expirationTime) setCookies(w, tokenString, expirationTime)
w.WriteHeader(http.StatusOK) w.WriteHeader(http.StatusOK)
@ -258,14 +252,12 @@ func refresh(w http.ResponseWriter, r *http.Request) {
render.JSON(w, r, returnMessage) render.JSON(w, r, returnMessage)
return return
} }
newClaims := &Claims{ newClaims := map[string]interface{}{
Username: user_claims.Username, "username": user_claims.Username,
Admin: user_claims.Admin, "admin": user_claims.Admin,
Verified: user_claims.Verified, "verified": user_claims.Verified,
StandardClaims: jwt.StandardClaims{
ExpiresAt: expirationTime.Unix(),
},
} }
jwtauth.SetExpiry(newClaims, expirationTime)
_, tokenString, _ := TokenAuth.Encode(newClaims) _, tokenString, _ := TokenAuth.Encode(newClaims)
setCookies(w, tokenString, expirationTime) setCookies(w, tokenString, expirationTime)
w.WriteHeader(http.StatusOK) w.WriteHeader(http.StatusOK)