pfzetto/axum-oidc
1
0
Fork 0
mirror of https://github.com/pfzetto/axum-oidc.git synced 2024-11-21 19:12:49 +01:00
Code Issues Projects Releases Packages Wiki Activity

Merge Pull Request #5 "feat: Handle Grant error while refreshing token"

Browse source 
Expired refresh_tokens weren't removed from the session causing a 500
Internal Server Error.
This PR removes the invalid request token when it is expired.
This commit is contained in:
Paul Zinselmeyer 2024-01-23 14:17:55 +01:00
commit 8d0be319ad
Signed by: pfzetto
GPG key ID: B471A1AF06C895FD
1 changed files with 50 additions and 33 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
src/middleware.rs
View file

@ -15,9 +15,12 @@ use tower_service::Service;
use tower_sessions::Session; use tower_sessions::Session;
use openidconnect::{ use openidconnect::{
core::CoreAuthenticationFlow, reqwest::async_http_client, AccessTokenHash, AuthorizationCode, core::{CoreAuthenticationFlow, CoreErrorResponseType},
CsrfToken, Nonce, OAuth2TokenResponse, PkceCodeChallenge, PkceCodeVerifier, RedirectUrl, Scope, reqwest::async_http_client,
TokenResponse, AccessTokenHash, AuthorizationCode, CsrfToken, Nonce, OAuth2TokenResponse, PkceCodeChallenge,
PkceCodeVerifier, RedirectUrl,
RequestTokenError::ServerResponse,
Scope, TokenResponse,
}; };
use crate::{ use crate::{
@ -343,19 +346,21 @@ where
refresh_request.add_scope(Scope::new(scope.to_string())); refresh_request.add_scope(Scope::new(scope.to_string()));
} }
let token_response = match refresh_request.request_async(async_http_client).await {
refresh_request.request_async(async_http_client).await?; Ok(token_response) => {
// Extract the ID token claims after verifying its authenticity and nonce. // Extract the ID token claims after verifying its authenticity and nonce.
let id_token = token_response let id_token = token_response
.id_token() .id_token()
.ok_or(MiddlewareError::IdTokenMissing)?; .ok_or(MiddlewareError::IdTokenMissing)?;
let claims = id_token let claims = id_token.claims(
.claims(&oidcclient.client.id_token_verifier(), &login_session.nonce)?; &oidcclient.client.id_token_verifier(),
&login_session.nonce,
)?;
// Verify the access token hash to ensure that the access token hasn't been substituted for // Verify the access token hash to ensure that the access token hasn't been substituted for
// another user's. // another user's.
if let Some(expected_access_token_hash) = claims.access_token_hash() { if let Some(expected_access_token_hash) = claims.access_token_hash()
{
let actual_access_token_hash = AccessTokenHash::from_token( let actual_access_token_hash = AccessTokenHash::from_token(
token_response.access_token(), token_response.access_token(),
&id_token.signing_alg()?, &id_token.signing_alg()?,
@ -376,6 +381,18 @@ where
parts.extensions.insert(OidcAccessToken( parts.extensions.insert(OidcAccessToken(
login_session.access_token.clone().unwrap_or_default(), login_session.access_token.clone().unwrap_or_default(),
)); ));
}
Err(ServerResponse(e))
if *e.error() == CoreErrorResponseType::InvalidGrant =>
{
// Refresh failed, refresh_token most likely expired or
// invalid, the session can be considered lost
login_session.refresh_token = None;
}
Err(err) => {
return Err(err.into());
}
};
let session = parts let session = parts
.extensions .extensions