Documentation
¶
Overview ¶
Package handoff hands a session minted at an identity provider callback to the frontend that started the sign-in, by a single-use one-time code.
The callback is a top-level browser navigation landing on the API origin, so it cannot give tokens to an app that keeps them on its own origin. It stashes a reference to the session under a random code instead and redirects with `code=`. The app redeems the code once, with its publishable key, and gets a rotated token pair: the code names the session and carries no credential, so a copy of the ceremony store yields nothing a browser could present. The SSO and social plugins both use it.
Index ¶
Constants ¶
const TTL = 60 * time.Second
TTL is how long a code stays redeemable. The browser redeems it on the page the callback redirects to, so a minute is plenty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Payload ¶
type Payload struct {
User json.RawMessage `json:"user,omitempty"`
SessionID string `json:"session_id"`
Provider string `json:"provider,omitempty"`
IsNewUser bool `json:"is_new_user,omitempty"`
AppID string `json:"app_id"`
}
Payload is what a code stands for. It names the session and carries no token.
func Redeem ¶
func Redeem(ctx forge.Context, eng *authsome.Engine, store ceremony.Store, prefix, code string) (*Payload, *session.Session, error)
Redeem spends code once and rotates the session it names. The caller's publishable-key app, when there is one, must be the app the code was minted for. Every failure is a 400 that says no more than that the code is no good, so a guess learns nothing.
Single use holds across replicas: a claim marker set with SetNX lets exactly one redeemer through even if two read the payload at once.
Source Files