move SetSecureCookie / GetSecureCookie to *context.Context and alias in Controller
Showing
2 changed files
with
48 additions
and
36 deletions
| 1 | package context | 1 | package context |
| 2 | 2 | ||
| 3 | import ( | 3 | import ( |
| 4 | "crypto/hmac" | ||
| 5 | "crypto/sha1" | ||
| 6 | "encoding/base64" | ||
| 7 | "fmt" | ||
| 4 | "net/http" | 8 | "net/http" |
| 9 | "strconv" | ||
| 10 | "strings" | ||
| 11 | "time" | ||
| 5 | 12 | ||
| 6 | "github.com/astaxie/beego/middleware" | 13 | "github.com/astaxie/beego/middleware" |
| 7 | ) | 14 | ) |
| ... | @@ -59,3 +66,41 @@ func (ctx *Context) GetCookie(key string) string { | ... | @@ -59,3 +66,41 @@ func (ctx *Context) GetCookie(key string) string { |
| 59 | func (ctx *Context) SetCookie(name string, value string, others ...interface{}) { | 66 | func (ctx *Context) SetCookie(name string, value string, others ...interface{}) { |
| 60 | ctx.Output.Cookie(name, value, others...) | 67 | ctx.Output.Cookie(name, value, others...) |
| 61 | } | 68 | } |
| 69 | |||
| 70 | // Get secure cookie from request by a given key. | ||
| 71 | func (ctx *Context) GetSecureCookie(Secret, key string) (string, bool) { | ||
| 72 | val := ctx.Input.Cookie(key) | ||
| 73 | if val == "" { | ||
| 74 | return "", false | ||
| 75 | } | ||
| 76 | |||
| 77 | parts := strings.SplitN(val, "|", 3) | ||
| 78 | |||
| 79 | if len(parts) != 3 { | ||
| 80 | return "", false | ||
| 81 | } | ||
| 82 | |||
| 83 | vs := parts[0] | ||
| 84 | timestamp := parts[1] | ||
| 85 | sig := parts[2] | ||
| 86 | |||
| 87 | h := hmac.New(sha1.New, []byte(Secret)) | ||
| 88 | fmt.Fprintf(h, "%s%s", vs, timestamp) | ||
| 89 | |||
| 90 | if fmt.Sprintf("%02x", h.Sum(nil)) != sig { | ||
| 91 | return "", false | ||
| 92 | } | ||
| 93 | res, _ := base64.URLEncoding.DecodeString(vs) | ||
| 94 | return string(res), true | ||
| 95 | } | ||
| 96 | |||
| 97 | // Set Secure cookie for response. | ||
| 98 | func (ctx *Context) SetSecureCookie(Secret, name, value string, others ...interface{}) { | ||
| 99 | vs := base64.URLEncoding.EncodeToString([]byte(value)) | ||
| 100 | timestamp := strconv.FormatInt(time.Now().UnixNano(), 10) | ||
| 101 | h := hmac.New(sha1.New, []byte(Secret)) | ||
| 102 | fmt.Fprintf(h, "%s%s", vs, timestamp) | ||
| 103 | sig := fmt.Sprintf("%02x", h.Sum(nil)) | ||
| 104 | cookie := strings.Join([]string{vs, timestamp, sig}, "|") | ||
| 105 | ctx.Output.Cookie(name, cookie, others...) | ||
| 106 | } | ... | ... |
| ... | @@ -2,11 +2,7 @@ package beego | ... | @@ -2,11 +2,7 @@ package beego |
| 2 | 2 | ||
| 3 | import ( | 3 | import ( |
| 4 | "bytes" | 4 | "bytes" |
| 5 | "crypto/hmac" | ||
| 6 | "crypto/sha1" | ||
| 7 | "encoding/base64" | ||
| 8 | "errors" | 5 | "errors" |
| 9 | "fmt" | ||
| 10 | "html/template" | 6 | "html/template" |
| 11 | "io" | 7 | "io" |
| 12 | "io/ioutil" | 8 | "io/ioutil" |
| ... | @@ -17,7 +13,6 @@ import ( | ... | @@ -17,7 +13,6 @@ import ( |
| 17 | "reflect" | 13 | "reflect" |
| 18 | "strconv" | 14 | "strconv" |
| 19 | "strings" | 15 | "strings" |
| 20 | "time" | ||
| 21 | 16 | ||
| 22 | "github.com/astaxie/beego/context" | 17 | "github.com/astaxie/beego/context" |
| 23 | "github.com/astaxie/beego/session" | 18 | "github.com/astaxie/beego/session" |
| ... | @@ -417,40 +412,12 @@ func (c *Controller) IsAjax() bool { | ... | @@ -417,40 +412,12 @@ func (c *Controller) IsAjax() bool { |
| 417 | 412 | ||
| 418 | // GetSecureCookie returns decoded cookie value from encoded browser cookie values. | 413 | // GetSecureCookie returns decoded cookie value from encoded browser cookie values. |
| 419 | func (c *Controller) GetSecureCookie(Secret, key string) (string, bool) { | 414 | func (c *Controller) GetSecureCookie(Secret, key string) (string, bool) { |
| 420 | val := c.Ctx.GetCookie(key) | 415 | return c.Ctx.GetSecureCookie(Secret, key) |
| 421 | if val == "" { | ||
| 422 | return "", false | ||
| 423 | } | ||
| 424 | |||
| 425 | parts := strings.SplitN(val, "|", 3) | ||
| 426 | |||
| 427 | if len(parts) != 3 { | ||
| 428 | return "", false | ||
| 429 | } | ||
| 430 | |||
| 431 | vs := parts[0] | ||
| 432 | timestamp := parts[1] | ||
| 433 | sig := parts[2] | ||
| 434 | |||
| 435 | h := hmac.New(sha1.New, []byte(Secret)) | ||
| 436 | fmt.Fprintf(h, "%s%s", vs, timestamp) | ||
| 437 | |||
| 438 | if fmt.Sprintf("%02x", h.Sum(nil)) != sig { | ||
| 439 | return "", false | ||
| 440 | } | ||
| 441 | res, _ := base64.URLEncoding.DecodeString(vs) | ||
| 442 | return string(res), true | ||
| 443 | } | 416 | } |
| 444 | 417 | ||
| 445 | // SetSecureCookie puts value into cookie after encoded the value. | 418 | // SetSecureCookie puts value into cookie after encoded the value. |
| 446 | func (c *Controller) SetSecureCookie(Secret, name, val string, age int64) { | 419 | func (c *Controller) SetSecureCookie(Secret, name, value string, others ...interface{}) { |
| 447 | vs := base64.URLEncoding.EncodeToString([]byte(val)) | 420 | c.Ctx.SetSecureCookie(Secret, name, value, others...) |
| 448 | timestamp := strconv.FormatInt(time.Now().UnixNano(), 10) | ||
| 449 | h := hmac.New(sha1.New, []byte(Secret)) | ||
| 450 | fmt.Fprintf(h, "%s%s", vs, timestamp) | ||
| 451 | sig := fmt.Sprintf("%02x", h.Sum(nil)) | ||
| 452 | cookie := strings.Join([]string{vs, timestamp, sig}, "|") | ||
| 453 | c.Ctx.SetCookie(name, cookie, age, "/") | ||
| 454 | } | 421 | } |
| 455 | 422 | ||
| 456 | // XsrfToken creates a xsrf token string and returns. | 423 | // XsrfToken creates a xsrf token string and returns. | ... | ... |
-
Please register or sign in to post a comment