pfzetto/axum-oidc
1
0
Fork 0
mirror of https://github.com/pfzetto/axum-oidc.git synced 2024-11-22 19:42:50 +01:00
Code Issues Projects Releases Packages Wiki Activity

Merge fac75702e9 into dacaedf9ca

Browse source
This commit is contained in:
Quentin 2024-01-22 17:14:39 +01:00 committed by GitHub
commit 60f10cf986
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 50 additions and 33 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
src/middleware.rs
View file

@ -15,9 +15,12 @@ use tower_service::Service;
use tower_sessions::Session; use tower_sessions::Session;
use openidconnect::{ use openidconnect::{
core::CoreAuthenticationFlow, reqwest::async_http_client, AccessTokenHash, AuthorizationCode, core::{CoreAuthenticationFlow, CoreErrorResponseType},
CsrfToken, Nonce, OAuth2TokenResponse, PkceCodeChallenge, PkceCodeVerifier, RedirectUrl, Scope, reqwest::async_http_client,
TokenResponse, AccessTokenHash, AuthorizationCode, CsrfToken, Nonce, OAuth2TokenResponse, PkceCodeChallenge,
PkceCodeVerifier, RedirectUrl,
RequestTokenError::ServerResponse,
Scope, TokenResponse,
}; };
use crate::{ use crate::{
@ -343,19 +346,21 @@ where
refresh_request.add_scope(Scope::new(scope.to_string())); refresh_request.add_scope(Scope::new(scope.to_string()));
} }
let token_response = match refresh_request.request_async(async_http_client).await {
refresh_request.request_async(async_http_client).await?; Ok(token_response) => {
// Extract the ID token claims after verifying its authenticity and nonce. // Extract the ID token claims after verifying its authenticity and nonce.
let id_token = token_response let id_token = token_response
.id_token() .id_token()
.ok_or(MiddlewareError::IdTokenMissing)?; .ok_or(MiddlewareError::IdTokenMissing)?;
let claims = id_token let claims = id_token.claims(
.claims(&oidcclient.client.id_token_verifier(), &login_session.nonce)?; &oidcclient.client.id_token_verifier(),
&login_session.nonce,
)?;
// Verify the access token hash to ensure that the access token hasn't been substituted for // Verify the access token hash to ensure that the access token hasn't been substituted for
// another user's. // another user's.
if let Some(expected_access_token_hash) = claims.access_token_hash() { if let Some(expected_access_token_hash) = claims.access_token_hash()
{
let actual_access_token_hash = AccessTokenHash::from_token( let actual_access_token_hash = AccessTokenHash::from_token(
token_response.access_token(), token_response.access_token(),
&id_token.signing_alg()?, &id_token.signing_alg()?,
@ -376,6 +381,18 @@ where
parts.extensions.insert(OidcAccessToken( parts.extensions.insert(OidcAccessToken(
login_session.access_token.clone().unwrap_or_default(), login_session.access_token.clone().unwrap_or_default(),
)); ));
}
Err(ServerResponse(e))
if *e.error() == CoreErrorResponseType::InvalidGrant =>
{
// Refresh failed, refresh_token most likely expired or
// invalid, the session can be considered lost
login_session.refresh_token = None;
}
Err(err) => {
return Err(err.into());
}
};
let session = parts let session = parts
.extensions .extensions