diff options
| -rw-r--r-- | roseh.moe.go | 33 |
1 files changed, 14 insertions, 19 deletions
diff --git a/roseh.moe.go b/roseh.moe.go index c8d61e9..044ae01 100644 --- a/roseh.moe.go +++ b/roseh.moe.go @@ -159,25 +159,9 @@ func attachCookie(w http.ResponseWriter) error { return nil } -func attachCSRFToken(w http.ResponseWriter) string { +func cookieAuth(w http.ResponseWriter, r *http.Request) (string, bool) { const csrfTokenLen = 32 - buf := make([]byte, csrfTokenLen) - rand.Read(buf) - csrfToken := base64.RawStdEncoding.EncodeToString(buf) - http.SetCookie(w, &http.Cookie{ - Name: "csrf-token", - Value: csrfToken, - Path: "/notepad", - Secure: true, - HttpOnly: true, - SameSite: http.SameSiteStrictMode, - Partitioned: true, - }) - return csrfToken -} - -func cookieAuth(w http.ResponseWriter, r *http.Request) (string, bool) { cookie, err := r.Cookie("auth") if err != nil { return "", false @@ -208,7 +192,19 @@ func cookieAuth(w http.ResponseWriter, r *http.Request) (string, bool) { if csrfToken, err := r.Cookie("csrf-token"); err == nil { return csrfToken.Value, true } - csrfToken := attachCSRFToken(w) + + buf := make([]byte, csrfTokenLen) + rand.Read(buf) + csrfToken := base64.RawStdEncoding.EncodeToString(buf) + http.SetCookie(w, &http.Cookie{ + Name: "csrf-token", + Value: csrfToken, + Path: "/notepad", + Secure: true, + HttpOnly: true, + SameSite: http.SameSiteStrictMode, + Partitioned: true, + }) return csrfToken, true } @@ -253,7 +249,6 @@ func login(w http.ResponseWriter, r *http.Request) { encryptionKeyMu.Unlock() } attachCookie(w) - attachCSRFToken(w) http.Redirect(w, r, r.FormValue("redirect"), http.StatusSeeOther) } |