[BUG] Recreating session (cookie) with securecookie enabled passes plain cookie value sometimes
- Dominant language
- Go
- Stars
- 25.6k
- Forks
- 2.4k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
When using securecookie for session it fails sometime because plain (decoded) cookie value is passed to decode function.
securecookie decode fails with "securecookie: the value is not valid" on MAC check/decode: https://github.com/gorilla/securecookie/blob/master/securecookie.go#L323
**To Reproduce**
```
package main
import (
"net/http"
"github.com/gorilla/securecookie"
"github.com/kataras/iris/v12"
"github.com/kataras/iris/v12/context"
"github.com/kataras/iris/v12/sessions"
)
const cookieNameForSessionID = "session_id_cookie"
var sess *sessions.Sessions
func secret(ctx iris.Context) {
session := getSession(ctx, false)
// Check if user is authenticated
if auth, _ := session.GetBoolean("authenticated"); !auth {
ctx.StatusCode(iris.StatusForbidden)
ctx.ContentType("text/html")
ctx.WriteString(`Not logged in or session invalid logout`)
return
}
// Print secret message
ctx.ContentType("text/html")
ctx.WriteString(`The cake is a lie! logout`)
}
func login(ctx iris.Context) {
session := getSession(ctx, false)
// Authentication goes here
// ...
// Set user as authenticated
session = getSession(ctx, true)
session.Set("authenticated", true)
ctx.StatusCode(http.StatusTemporaryRedirect)
ctx.ContentType("text/html")
ctx.Header("Location", "/secret")
}
func logout(ctx iris.Context) {
sess.Destroy(ctx)
ctx.ContentType("text/html")
ctx.WriteString(`login`)
}
func getSession(ctx iris.Context, recreate bool) *sessions.Session {
cookieOptionList := []context.CookieOption{
func(ctx *context.Context, cookie *http.Cookie, op uint8) {
// c.applySessionSetting(ctx, cookie, op)
},
}
if recreate {
sess.Destroy(ctx)
}
s := sess.Start(ctx, cookieOptionList...)
return s
}
func main() {
app := iris.New()
secureCookie := securecookie.New(
[]byte("IGVneS5eZ0b5jTgwe0l38nON0bW5awxr"),
[]byte("r4GFiLvBtYCohUxt"),
)
sess = sessions.New(sessions.Config{
Cookie: cookieNameForSessionID,
Encoding: secureCookie,
CookieSecureTLS: false,
AllowReclaim: true,
DisableSubdomainPersistence: true,
})
app.Use(sess.Handler())
// ^ or comment this line and use sess.Start(ctx) inside your handlers
// instead of sessions.Get(ctx).
app.Get("/secret", secret)
app.Get("/login", login)
app.Get("/logout", logout)
app.Listen(":8080")
}
```
and add alter `Decode` function in securecookie:
```
func (s *SecureCookie) Decode(name, value string, dst interface{}) error {
fmt.Println(value)
```
result is:
```
MTY1Nzk3Nzg4MnxOTy0tV2JmWi1xbExTRlAzQXRMbXJJWV82S0F4dDJ5eGpSZWg5ODRydk1qdDBpVm1ZeXpKWUpMSExCWUY0M2ItZFZfZkQ2bm8yUUU9fAmHNHj68vBKoujiboz1UMf5r2IguTm-zoHQJ0DSJDpM
MTY1Nzk3Nzg4MnxOTy0tV2JmWi1xbExTRlAzQXRMbXJJWV82S0F4dDJ5eGpSZWg5ODRydk1qdDBpVm1ZeXpKWUpMSExCWUY0M2ItZFZfZkQ2bm8yUUU9fAmHNHj68vBKoujiboz1UMf5r2IguTm-zoHQJ0DSJDpM
a95828e7-a194-49e8-89cf-d76a987faa2e
a95828e7-a194-49e8-89cf-d76a987faa2e
a95828e7-a194-49e8-89cf-d76a987faa2e
MTY1Nzk3Nzg4OXxPSGs2YVNhQThFRXYyVmkwWkl5OTQ1bm5vNDVNRmxsUHRZUFNCdGFBRW12aGZIZ3dnaW1naVNDZjkyTXZLRWU1Nkc1QkxTVWdoc2M9fG38bjG-RwEYLoostgZErggXc07I_a28N2vKS-99Uf1P
MTY1Nzk3Nzg4OXxPSGs2YVNhQThFRXYyVmkwWkl5OTQ1bm5vNDVNRmxsUHRZUFNCdGFBRW12aGZIZ3dnaW1naVNDZjkyTXZLRWU1Nkc1QkxTVWdoc2M9fG38bjG-RwEYLoostgZErggXc07I_a28N2vKS-99Uf1P
```
**Desktop (please complete the following information):**
- OS: osx
-
**iris.Version**
- `v12.2.0-beta3`
- `master`
Contributor guide
Assessment
This issue has not been assessed yet.