Documentation
¶
Overview ¶
Package mint_token_endpoint mints an access token for a client that can sign for a registered key.
This is the one endpoint here that no session reaches: the assertion in the Authorization header is the whole credential, which is the point of the scheme -- the service stores no secret, and a caller proves it holds a private key rather than repeating something it was given.
What comes back is a short-lived session token, the same kind the browsers carry, marked in its "amr" as having been minted against a key. That mark is what keeps it out of the endpoints meant for a signed-in person: every authorizer takes the browser methods unless it says otherwise.
It is not the OAuth token endpoint, pkg/oauth/types/endpoint/token_endpoint, which redeems what an authorization server granted; this one redeems nothing but a signature.
Index ¶
- Constants
- type Endpoint
- func (e *Endpoint) Initialize(sessionManager *session_manager.Manager, db *sql.DB, audience string) error
- func (e *Endpoint) MaskedBodyFields() (*log_masking.BodyFields, error)
- func (e *Endpoint) MaskedHeaders() []*http_context_extractor_config.MaskedHeader
- func (e *Endpoint) MaskedUrlParams() []*schema.Url
Constants ¶
const DefaultPath = "/api/token"
DefaultPath is where pkg/api_key/client posts its assertions, client.TokenPath.
const DefaultTokenLifetime = 15 * time.Minute
DefaultTokenLifetime is how long a minted token is good for.
Short, and deliberately the same as a browser session's: consumers validate a token by its signature and its expiry without asking this service anything, so a token's lifetime is the window in which a revoked key's last token still works. A client re-mints; the key is the long-lived credential, and the token is not.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Endpoint ¶
type Endpoint struct {
*initialization_endpoint.Endpoint
// Audience is what an assertion must name this service as: its origin, the same string the
// tokens it issues carry as their issuer. It is what stops an assertion made for one
// deployment being presented to another.
Audience string
// TokenLifetime is how long the minted token lasts.
TokenLifetime time.Duration
}
func (*Endpoint) Initialize ¶
func (*Endpoint) MaskedBodyFields ¶ added in v1.23.1
func (e *Endpoint) MaskedBodyFields() (*log_masking.BodyFields, error)
MaskedBodyFields is the token the endpoint answers with, which the log would otherwise write out whole: a session token good for its lifetime to whoever reads the log. Named as the OAuth token endpoint names its own, the answer being in the same shape.
func (*Endpoint) MaskedHeaders ¶ added in v1.23.1
func (e *Endpoint) MaskedHeaders() []*http_context_extractor_config.MaskedHeader
MaskedHeaders is nothing: the log's own masking of a header already takes the assertion's signature, without which what is left of it cannot be presented again.
func (*Endpoint) MaskedUrlParams ¶ added in v1.23.1
MaskedUrlParams is empty: the assertion is sent in a header, and nothing in the URL.
Source Files