kataras / kataras/iris

[BUG] Recreating session (cookie) with securecookie enabled passes plain cookie value sometimes

Open
#1,929 14 comments 0 reactions 1 assignee Claimed by @kataras View on GitHub
Dominant language
Go
Stars
25.6k
Forks
2.4k
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
When using securecookie for session it fails sometime because plain (decoded) cookie value is passed to decode function.

securecookie decode fails with "securecookie: the value is not valid" on MAC check/decode: https://github.com/gorilla/securecookie/blob/master/securecookie.go#L323

**To Reproduce**
```
package main

import (
"net/http"

"github.com/gorilla/securecookie"
"github.com/kataras/iris/v12"
"github.com/kataras/iris/v12/context"
"github.com/kataras/iris/v12/sessions"
)

const cookieNameForSessionID = "session_id_cookie"

var sess *sessions.Sessions

func secret(ctx iris.Context) {
session := getSession(ctx, false)

// Check if user is authenticated
if auth, _ := session.GetBoolean("authenticated"); !auth {
ctx.StatusCode(iris.StatusForbidden)
ctx.ContentType("text/html")
ctx.WriteString(`Not logged in or session invalid logout`)
return
}

// Print secret message
ctx.ContentType("text/html")
ctx.WriteString(`The cake is a lie! logout`)
}

func login(ctx iris.Context) {
session := getSession(ctx, false)
// Authentication goes here
// ...

// Set user as authenticated
session = getSession(ctx, true)
session.Set("authenticated", true)
ctx.StatusCode(http.StatusTemporaryRedirect)
ctx.ContentType("text/html")
ctx.Header("Location", "/secret")
}

func logout(ctx iris.Context) {
sess.Destroy(ctx)
ctx.ContentType("text/html")
ctx.WriteString(`login`)
}

func getSession(ctx iris.Context, recreate bool) *sessions.Session {
cookieOptionList := []context.CookieOption{
func(ctx *context.Context, cookie *http.Cookie, op uint8) {
// c.applySessionSetting(ctx, cookie, op)
},
}

if recreate {
sess.Destroy(ctx)
}
s := sess.Start(ctx, cookieOptionList...)
return s
}

func main() {
app := iris.New()
secureCookie := securecookie.New(
[]byte("IGVneS5eZ0b5jTgwe0l38nON0bW5awxr"),
[]byte("r4GFiLvBtYCohUxt"),
)

sess = sessions.New(sessions.Config{
Cookie: cookieNameForSessionID,
Encoding: secureCookie,
CookieSecureTLS: false,
AllowReclaim: true,
DisableSubdomainPersistence: true,
})
app.Use(sess.Handler())
// ^ or comment this line and use sess.Start(ctx) inside your handlers
// instead of sessions.Get(ctx).

app.Get("/secret", secret)
app.Get("/login", login)
app.Get("/logout", logout)

app.Listen(":8080")
}
```
and add alter `Decode` function in securecookie:
```
func (s *SecureCookie) Decode(name, value string, dst interface{}) error {
fmt.Println(value)
```

result is:

```
MTY1Nzk3Nzg4MnxOTy0tV2JmWi1xbExTRlAzQXRMbXJJWV82S0F4dDJ5eGpSZWg5ODRydk1qdDBpVm1ZeXpKWUpMSExCWUY0M2ItZFZfZkQ2bm8yUUU9fAmHNHj68vBKoujiboz1UMf5r2IguTm-zoHQJ0DSJDpM
MTY1Nzk3Nzg4MnxOTy0tV2JmWi1xbExTRlAzQXRMbXJJWV82S0F4dDJ5eGpSZWg5ODRydk1qdDBpVm1ZeXpKWUpMSExCWUY0M2ItZFZfZkQ2bm8yUUU9fAmHNHj68vBKoujiboz1UMf5r2IguTm-zoHQJ0DSJDpM
a95828e7-a194-49e8-89cf-d76a987faa2e
a95828e7-a194-49e8-89cf-d76a987faa2e
a95828e7-a194-49e8-89cf-d76a987faa2e
MTY1Nzk3Nzg4OXxPSGs2YVNhQThFRXYyVmkwWkl5OTQ1bm5vNDVNRmxsUHRZUFNCdGFBRW12aGZIZ3dnaW1naVNDZjkyTXZLRWU1Nkc1QkxTVWdoc2M9fG38bjG-RwEYLoostgZErggXc07I_a28N2vKS-99Uf1P
MTY1Nzk3Nzg4OXxPSGs2YVNhQThFRXYyVmkwWkl5OTQ1bm5vNDVNRmxsUHRZUFNCdGFBRW12aGZIZ3dnaW1naVNDZjkyTXZLRWU1Nkc1QkxTVWdoc2M9fG38bjG-RwEYLoostgZErggXc07I_a28N2vKS-99Uf1P
```

**Desktop (please complete the following information):**
- OS: osx
-
**iris.Version**
- `v12.2.0-beta3`
- `master`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.