Documentation
¶
Index ¶
- func NormalizeBasePath(p string) string
- type Config
- type Server
- func (s *Server) HandleCallback(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleInfo(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleLogin(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleLogout(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleSession(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleTokenLogin(w http.ResponseWriter, r *http.Request)
- func (s *Server) Handler() http.Handler
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NormalizeBasePath ¶
NormalizeBasePath makes a base-path flag value safe to concatenate: no trailing slash (else cookie paths become /console//) and a guaranteed leading slash.
Types ¶
type Config ¶
type Config struct {
ControlPlaneURL string
AdminToken string
StaticDir string
BasePath string
// ExternalURL is the origin browsers reach this console on, e.g.
// "https://console.example". When set it decides the OIDC redirect_uri and
// whether session cookies are marked Secure, instead of the Host and
// X-Forwarded-Proto headers, which a client controls and a proxy may drop.
ExternalURL string
}
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
func (*Server) HandleCallback ¶
func (s *Server) HandleCallback(w http.ResponseWriter, r *http.Request)
func (*Server) HandleInfo ¶
func (s *Server) HandleInfo(w http.ResponseWriter, r *http.Request)
func (*Server) HandleLogin ¶
func (s *Server) HandleLogin(w http.ResponseWriter, r *http.Request)
func (*Server) HandleLogout ¶
func (s *Server) HandleLogout(w http.ResponseWriter, r *http.Request)
func (*Server) HandleSession ¶
func (s *Server) HandleSession(w http.ResponseWriter, r *http.Request)
HandleSession reports whether a session cookie is present. It deliberately does not return the cookie's value: the credential is stored HttpOnly so an XSS in the console cannot exfiltrate mesh admin rights, and handing the raw token back to any same-origin fetch would undo exactly that. The SPA never needs it, since the reverse proxy injects the cookie as Authorization for /api/ calls.
func (*Server) HandleTokenLogin ¶
func (s *Server) HandleTokenLogin(w http.ResponseWriter, r *http.Request)
HandleTokenLogin exchanges a token the operator pasted into the console for an httpOnly session cookie, so the credential is never reachable from JavaScript and an XSS in the console cannot exfiltrate mesh admin rights.
Source Files