feat(*): revoke cookie sessions by application supplied key - #212
Open
janiussyafiq wants to merge 6 commits into
Open
feat(*): revoke cookie sessions by application supplied key#212janiussyafiq wants to merge 6 commits into
janiussyafiq wants to merge 6 commits into
Conversation
Sessions can carry revocation keys in the encrypted payload via session:set_revocation_keys. On open, a key whose revocation mark is at or after the session creation time rejects the session with "session revoked". Marks are unix timestamps; the 4.2.0 mark "1" still means revoked regardless of time.
Writes a unix timestamp mark for an application supplied key through the configured revocation storage, so sessions carrying that key and created at or before the mark are rejected on open. Intended for identity provider initiated logout, where no cookie is available.
Check every audience's revocation keys when opening a remember cookie, since restoration mints a fresh session cookie carrying all of them. Reset the rejected cookie's meta on revocation so a re-login does not inherit the revoked creation time.
Run the key check before a remember cookie's data is kept for an absent audience, and leave a rejected remember cookie with empty metadata so save, logout and destroy do not reload its creation time.
Author
|
@bungle need help reviewing this, to support backchannel logout this feature is needed, thanks |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #211.
Summary
session:set_revocation_keys(keys)/session:get_revocation_keys(): opaque keys carried per audience in the encrypted payload, e.g. an identity provider'ssidandsub.session.revoke(key, ttl, configuration): writes a unix-timestamp mark through the existingrevocationstorage, no open session needed.session:openrejects a session carrying a key whose mark is at or after the session's creation time; sessions created later are unaffected. The 4.2.0 mark"1"still means revoked regardless of time anddestroykeeps writing it.hash_storage_key; marks share one namespace percookie_name, remember cookies included.session.revokealways returns write errors;revocation_fail_modeis unchanged for open/destroy.key -> timestampstore format lets the library auto-derive them later.Consumer: zmartzone/lua-resty-openidc#572 (Back-Channel Logout receiver), then apache/apisix.
Test plan
make unitin the CI image (155 tests),make lintspec/06: key round-trip without subject, mark at/after creation revokes, mark before creation does not, legacy"1"mark, unrelated key, audience scoping, remember cookie,session.revokethen reopen, created after revokespec/07:session.revokereports a failed write in open fail mode, not-enabled error