Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix cookie name in passcode handler #1625

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix cookie name in passcode handler #1625

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 6 additions & 7 deletions backend/handler/passcode.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,17 @@ package handler
import (
"errors"
"fmt"
"net/http"
"strings"
"time"

"github.com/gobuffalo/pop/v6"
"github.com/gofrs/uuid"
"github.com/labstack/echo/v4"
"github.com/lestrrat-go/jwx/v2/jwt"
zeroLogger "github.com/rs/zerolog/log"
"github.com/sethvargo/go-limiter"
"github.com/teamhanko/hanko/backend/audit_log"
auditlog "github.com/teamhanko/hanko/backend/audit_log"
"github.com/teamhanko/hanko/backend/config"
"github.com/teamhanko/hanko/backend/crypto"
"github.com/teamhanko/hanko/backend/dto"
Expand All @@ -23,9 +27,6 @@ import (
"github.com/teamhanko/hanko/backend/webhooks/utils"
"golang.org/x/crypto/bcrypt"
"gopkg.in/gomail.v2"
"net/http"
"strings"
"time"
)

type PasscodeHandler struct {
Expand Down Expand Up @@ -229,14 +230,12 @@ func (h *PasscodeHandler) Init(c echo.Context) error {
}

err = utils.TriggerWebhooks(c, h.persister.GetConnection(), events.EmailSend, webhookData)

if err != nil {
zeroLogger.Warn().Err(err).Msg("failed to trigger webhook")
}
} else {
webhookData.DeliveredByHanko = false
err = utils.TriggerWebhooks(c, h.persister.GetConnection(), events.EmailSend, webhookData)

if err != nil {
return fmt.Errorf(fmt.Sprintf("failed to trigger webhook: %s", err))
}
Expand Down Expand Up @@ -453,7 +452,7 @@ func (h *PasscodeHandler) Finish(c echo.Context) error {

func (h *PasscodeHandler) GetSessionToken(c echo.Context) jwt.Token {
var token jwt.Token
sessionCookie, _ := c.Cookie("hanko")
sessionCookie, _ := c.Cookie(h.cfg.Session.Cookie.GetName())
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@FreddyDevelop how can we handle the errors here? all errors in GetSessionToken are ignored. They should be logged at least. What is the best way to get a logger instance here?

That would have helped to faster find that bug, because the accessed cookie doesn't exist.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We do not log the error, that a cookie is missing, because the session token can also be send within the Authorization header and when the error gets logged then we would clutter the logs with unnecessary messages.

Only solution to that would be to log that errors only when no token can be returned. You can use zerolog for the logging. An example can be found at:

hanko/backend/handler/passcode.go

Line 234 in 579cef3

zeroLogger.Warn().Err(err).Msg("failed to trigger webhook")

// we don't need to check the error, because when the cookie can not be found, the user is not logged in
if sessionCookie != nil {
token, _ = h.sessionManager.Verify(sessionCookie.Value)
Expand Down