-
-
Notifications
You must be signed in to change notification settings - Fork 4.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Close sessions created for login flow v2
Sessions created during the login flow v2 should be short lived to not leave an unexpected opened session in the browser. This commit add a property to the session object to track its origin, and will close it as soon as possible, i.e., on the first non public page request. Signed-off-by: Louis Chemineau <louis@chmn.me>
- Loading branch information
Showing
7 changed files
with
101 additions
and
61 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
46 changes: 46 additions & 0 deletions
46
lib/private/AppFramework/Middleware/FlowV2EphemeralSessionsMiddleware.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| <?php | ||
|
|
||
| declare(strict_types=1); | ||
| /** | ||
| * SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors | ||
| * SPDX-License-Identifier: AGPL-3.0-only | ||
| */ | ||
| namespace OC\AppFramework\Middleware; | ||
|
|
||
| use OC\Core\Controller\ClientFlowLoginV2Controller; | ||
| use OCP\AppFramework\Controller; | ||
| use OCP\AppFramework\Middleware; | ||
| use OCP\ISession; | ||
| use OCP\IUserSession; | ||
| use ReflectionMethod; | ||
|
|
||
| // Will close the session if the user session is ephemeral. | ||
| // Happens when the user logs in via the login flow v2. | ||
| class FlowV2EphemeralSessionsMiddleware extends Middleware { | ||
| public function __construct( | ||
| private ISession $session, | ||
| private IUserSession $userSession, | ||
| ) { | ||
| } | ||
|
|
||
| public function beforeController(Controller $controller, string $methodName) { | ||
| if (!$this->session->get(ClientFlowLoginV2Controller::EPHEMERAL_NAME)) { | ||
| return; | ||
| } | ||
|
|
||
| if ( | ||
| $controller instanceof ClientFlowLoginV2Controller && | ||
| ($methodName === 'grantPage' || $methodName === 'generateAppPassword') | ||
| ) { | ||
| return; | ||
| } | ||
|
|
||
| $reflectionMethod = new ReflectionMethod($controller, $methodName); | ||
| if (!empty($reflectionMethod->getAttributes('PublicPage'))) { | ||
| return; | ||
| } | ||
|
|
||
| $this->userSession->logout(); | ||
| $this->session->close(); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
27 changes: 27 additions & 0 deletions
27
lib/private/Authentication/Login/FlowV2EphemeralSessionsCommand.php
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| <?php | ||
|
|
||
| declare(strict_types=1); | ||
|
|
||
| /** | ||
| * SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors | ||
| * SPDX-License-Identifier: AGPL-3.0-or-later | ||
| */ | ||
| namespace OC\Authentication\Login; | ||
|
|
||
| use OC\Core\Controller\ClientFlowLoginV2Controller; | ||
| use OCP\ISession; | ||
|
|
||
| class FlowV2EphemeralSessionsCommand extends ALoginCommand { | ||
| public function __construct( | ||
| private ISession $session, | ||
| ) { | ||
| } | ||
|
|
||
| public function process(LoginData $loginData): LoginResult { | ||
| if (str_contains($loginData->getRedirectUrl() ?? '', '/login/v2/grant')) { | ||
| $this->session->set(ClientFlowLoginV2Controller::EPHEMERAL_NAME, true); | ||
| } | ||
|
|
||
| return $this->processNextOrFinishSuccessfully($loginData); | ||
| } | ||
| } |