-
Notifications
You must be signed in to change notification settings - Fork 158
/
security_cookie.ts
87 lines (77 loc) · 2.7 KB
/
security_cookie.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
/*
* Copyright OpenSearch Contributors
*
* Licensed under the Apache License, Version 2.0 (the "License").
* You may not use this file except in compliance with the License.
* A copy of the License is located at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* or in the "license" file accompanying this file. This file is distributed
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied. See the License for the specific language governing
* permissions and limitations under the License.
*/
import { SessionStorageCookieOptions } from '../../../../src/core/server';
import { SecurityPluginConfigType } from '..';
export interface SecuritySessionCookie {
// security_authentication
username?: string;
credentials?: any;
authType?: string;
assignAuthHeader?: boolean;
isAnonymousAuth?: boolean;
expiryTime?: number;
additionalAuthHeaders?: any;
// security_storage
tenant?: any;
// for oidc auth workflow
oidc?: {
state?: string;
nextUrl?: string;
redirectHash?: boolean;
};
// for Saml auth workflow
saml?: {
requestId?: string;
nextUrl?: string;
redirectHash?: boolean;
};
}
export function getSecurityCookieOptions(
config: SecurityPluginConfigType
): SessionStorageCookieOptions<SecuritySessionCookie> {
return {
name: config.cookie.name,
encryptionKey: config.cookie.password,
validate: (sessionStorage: SecuritySessionCookie | SecuritySessionCookie[]) => {
sessionStorage = sessionStorage as SecuritySessionCookie;
if (sessionStorage === undefined) {
return { isValid: false, path: '/' };
}
// TODO: with setting redirect attributes to support OIDC and SAML,
// we need to do additional cookie validation in AuthenticationHandlers.
// if SAML fields present
if (sessionStorage.saml && sessionStorage.saml.requestId) {
return { isValid: true, path: '/' };
}
// if OIDC fields present
if (sessionStorage.oidc) {
return { isValid: true, path: '/' };
}
if (sessionStorage.expiryTime === undefined || sessionStorage.expiryTime < Date.now()) {
return { isValid: false, path: '/' };
}
return { isValid: true, path: '/' };
},
isSecure: config.cookie.secure,
sameSite: config.cookie.isSameSite || undefined,
};
}
export function clearOldVersionCookieValue(config: SecurityPluginConfigType): string {
if (config.cookie.secure) {
return 'security_authentication=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure; HttpOnly; Path=/';
} else {
return 'security_authentication=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; Path=/';
}
}