lukaszraczylo/traefikoidc
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/traefikoidc.git synced 2026-10-14 04:07:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(middleware): refresh expired sessions on SSE/WebSocket bypass

Browse Source 
The SSE and WebSocket bypass does not check the token expiry. A session
stays usable for streaming until the session cookie expires, also after
the IdP disables the user. The bypass now forwards the configured headers
(#162), so this gap also gives the proxy secret to such a session.

Add the streamingRefresh option. The default is false. When it is true and
the access token has expired, the bypass refreshes the session. It uses
the ID token expiry if the access token is opaque. If the IdP rejects the
refresh with invalid_grant, the request gets 401. If the IdP cannot be
reached, the request is forwarded as before.

The bypass waits for the full coordinated refresh. A shorter wait can
drop a rotated refresh token, and the next refresh then logs the user out.

applyBypassUserHeaders now takes the ResponseWriter, so a refresh can
write the new session cookie. Add a yaegi check for the invalid_grant path
through the real token endpoint and RefreshCoordinator.

Claude-Session: https://claude.ai/code/session_01G1d1n1BrHHHw8dBUkbiBPC
This commit is contained in:
lukaszraczylo
2026-09-28 15:31:18 +01:00
parent c9844d0ff2
commit 937776516d
13 changed files with 333 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
settings.go
+6 -2
View File
@@ -115,8 +115,12 @@ type Config struct {
// or not, like any other method. Enable only if your backend itself
// answers CORS preflights and must see them unauthenticated.
AllowUnauthenticatedPreflight bool `json:"allowUnauthenticatedPreflight,omitempty"`
MinimalHeaders bool `json:"minimalHeaders,omitempty"`
StripAuthCookies bool `json:"stripAuthCookies,omitempty"`
// StreamingRefresh refreshes an expired session on the SSE/WebSocket
// bypass and rejects the request when the IdP revokes the grant.
// Default false: the bypass trusts the session cookie until it expires.
StreamingRefresh bool `json:"streamingRefresh,omitempty"`
MinimalHeaders bool `json:"minimalHeaders,omitempty"`
StripAuthCookies bool `json:"stripAuthCookies,omitempty"`
// CookiePath restricts session cookies to a specific path prefix instead of "/".
// When traefikoidc protects some but not all paths on a domain, set this to the
// middleware's path prefix (e.g. "/app-protegido") so the browser does not send