mirror of
https://github.com/superseriousbusiness/gotosocial.git
synced 2025-11-03 18:02:26 -06:00
31628019fe
# Description
- tweaks the NoLLaMas proof-of-work algorithm to further granularity on time spent computing solutions
- standardizes GoToSocial cookie security directive setting in a CookiePolicy{} type
## Checklist
- [x] I/we have read the [GoToSocial contribution guidelines](https://codeberg.org/superseriousbusiness/gotosocial/src/branch/main/CONTRIBUTING.md).
- [x] I/we have discussed the proposed changes already, either in an issue on the repository, or in the Matrix chat.
- [x] I/we have not leveraged AI to create the proposed changes.
- [x] I/we have performed a self-review of added code.
- [x] I/we have written code that is legible and maintainable by others.
- [x] I/we have commented the added code, particularly in hard-to-understand areas.
- [ ] I/we have made any necessary changes to documentation.
- [ ] I/we have added tests that cover new code.
- [ ] I/we have run tests and they pass locally with the changes.
- [x] I/we have run `go fmt ./...` and `golangci-lint run`.
Co-authored-by: tobi <tobi.smethurst@protonmail.com>
Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4090
Co-authored-by: kim <grufwub@gmail.com>
Co-committed-by: kim <grufwub@gmail.com>
77 lines
2.8 KiB
Go
77 lines
2.8 KiB
Go
// GoToSocial
|
|
// Copyright (C) GoToSocial Authors admin@gotosocial.org
|
|
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
package middleware
|
|
|
|
import (
|
|
"fmt"
|
|
"net/url"
|
|
|
|
apiutil "code.superseriousbusiness.org/gotosocial/internal/api/util"
|
|
"code.superseriousbusiness.org/gotosocial/internal/config"
|
|
"github.com/gin-contrib/sessions"
|
|
"github.com/gin-contrib/sessions/memstore"
|
|
"github.com/gin-gonic/gin"
|
|
"golang.org/x/net/idna"
|
|
)
|
|
|
|
// SessionOptions returns the standard set of options to use for each session.
|
|
func SessionOptions(cookiePolicy apiutil.CookiePolicy) sessions.Options {
|
|
return sessions.Options{
|
|
Path: "/",
|
|
Domain: cookiePolicy.Domain,
|
|
// 2 minutes
|
|
MaxAge: 120,
|
|
Secure: cookiePolicy.Secure,
|
|
HttpOnly: cookiePolicy.HTTPOnly,
|
|
SameSite: cookiePolicy.SameSite,
|
|
}
|
|
}
|
|
|
|
// SessionName is a utility function that derives an appropriate session name from the hostname.
|
|
func SessionName() (string, error) {
|
|
// parse the protocol + host
|
|
protocol := config.GetProtocol()
|
|
host := config.GetHost()
|
|
u, err := url.Parse(fmt.Sprintf("%s://%s", protocol, host))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
// take the hostname without any port attached
|
|
strippedHostname := u.Hostname()
|
|
if strippedHostname == "" {
|
|
return "", fmt.Errorf("could not derive hostname without port from %s://%s", protocol, host)
|
|
}
|
|
|
|
// make sure IDNs are converted to punycode or the cookie library breaks:
|
|
// see https://en.wikipedia.org/wiki/Punycode
|
|
punyHostname, err := idna.New().ToASCII(strippedHostname)
|
|
if err != nil {
|
|
return "", fmt.Errorf("could not convert %s to punycode: %s", strippedHostname, err)
|
|
}
|
|
|
|
return fmt.Sprintf("gotosocial-%s", punyHostname), nil
|
|
}
|
|
|
|
// Session returns a new gin middleware that implements session cookies using the given sessionName, authentication
|
|
// key, and encryption key. Session name can be derived from the SessionName utility function in this package.
|
|
func Session(sessionName string, auth []byte, crypt []byte, cookiePolicy apiutil.CookiePolicy) gin.HandlerFunc {
|
|
store := memstore.NewStore(auth, crypt)
|
|
store.Options(SessionOptions(cookiePolicy))
|
|
return sessions.Sessions(sessionName, store)
|
|
}
|