Documentation
¶
Overview ¶
Package browserbind ties a browser-driven OAuth or SSO ceremony to the browser that started it.
The state parameter alone proves that a callback belongs to some login the server minted, not that it belongs to the browser presenting it. A cookie set when the login starts, carrying a digest of that state, closes the gap: the callback must arrive with the cookie that matches its state, which an attacker who only holds a login URL cannot supply.
Index ¶
Constants ¶
const CookieName = "__Host-authsome_oauth_state"
CookieName is the state-binding cookie's name on https requests. The __Host- prefix makes browsers refuse it unless it is Secure, has no Domain and has Path=/ , so a subdomain cannot plant one.
const InsecureCookieName = "authsome_oauth_state"
InsecureCookieName is the name used when the request is plain http, where browsers reject a __Host- cookie outright. Development only.
const TTL = 10 * time.Minute
TTL matches the ceremony state's own lifetime.
Variables ¶
This section is empty.
Functions ¶
func ClearStateCookie ¶
func ClearStateCookie(w http.ResponseWriter, r *http.Request)
ClearStateCookie expires the binding cookie once the ceremony completed.
It is built the way SetStateCookie builds the cookie it clears: the plain-http variant first, then the __Host- name and Secure over https.
func Digest ¶
Digest is the cookie value for a state: its hex SHA-256. The state itself travels in URLs, so the cookie holds something derived from it rather than the state, and the callback compares digests in constant time.
func IsBrowser ¶
IsBrowser reports whether the request came from a web browser, which always attaches fetch metadata or an Origin to a script-initiated request. A native client sends neither and is bound by PKCE instead.
func IsHTTPS ¶
IsHTTPS reports whether the request reached the server over TLS, directly or through a proxy that says so.
func SetStateCookie ¶
func SetStateCookie(w http.ResponseWriter, r *http.Request, state string)
SetStateCookie writes the binding cookie for state on w. Over https it is the __Host- cookie with SameSite=None, which a cross-site POST such as a SAML assertion still carries; over plain http it is the unprefixed, Lax variant, since browsers refuse __Host- without Secure.
Types ¶
This section is empty.
Source Files