auth-ui: Auto delete Hydra login challenge cookie after use
Fixes failed logins
Change-Id: I891acf511c5cdb83c8ad24d209172724125b501f
diff --git a/core/auth/ui/main.go b/core/auth/ui/main.go
index 978ddc7..55dc963 100644
--- a/core/auth/ui/main.go
+++ b/core/auth/ui/main.go
@@ -240,12 +240,28 @@
// Login flow
+func clearLoginChallengeCookie(w http.ResponseWriter) {
+ http.SetCookie(w, &http.Cookie{
+ Name: "login_challenge",
+ Value: "",
+ Path: "/",
+ MaxAge: -1,
+ HttpOnly: true,
+ SameSite: http.SameSiteLaxMode,
+ })
+}
+
func (s *Server) loginInitiate(w http.ResponseWriter, r *http.Request) {
if err := r.ParseForm(); err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
- if challenge, ok := r.Form["login_challenge"]; ok {
+ challenge, hasChallenge := r.Form["login_challenge"]
+ flow, hasFlow := r.Form["flow"]
+ if !hasChallenge && !hasFlow {
+ clearLoginChallengeCookie(w)
+ }
+ if hasChallenge {
_, username, err := getWhoAmIFromKratos(r.Cookies())
if err != nil && err != ErrNotLoggedIn {
http.Error(w, err.Error(), http.StatusInternalServerError)
@@ -257,6 +273,7 @@
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
+ clearLoginChallengeCookie(w)
http.Redirect(w, r, redirectTo, http.StatusSeeOther)
return
}
@@ -264,15 +281,16 @@
http.SetCookie(w, &http.Cookie{
Name: "login_challenge",
Value: challenge[0],
+ Path: "/",
HttpOnly: true,
+ SameSite: http.SameSiteLaxMode,
})
}
returnTo := r.FormValue("return_to")
if returnTo == "" && s.defaultReturnTo != "" {
returnTo = s.defaultReturnTo
}
- flow, ok := r.Form["flow"]
- if !ok {
+ if !hasFlow {
addr := s.kratos + "/self-service/login/browser"
if returnTo != "" {
addr += fmt.Sprintf("?return_to=%s", returnTo)
@@ -471,6 +489,7 @@
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
+ clearLoginChallengeCookie(w)
http.Redirect(w, r, redirectTo, http.StatusSeeOther)
return
}
@@ -491,6 +510,7 @@
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
+ clearLoginChallengeCookie(w)
http.Redirect(w, r, redirectTo, http.StatusSeeOther)
return
}