Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

root: revert to use secret_key for JWT signing #5934

Merged
merged 1 commit into from
Jun 12, 2023
Merged

root: revert to use secret_key for JWT signing #5934

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 3 additions & 10 deletions authentik/root/middleware.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
"""Dynamically set SameSite depending if the upstream connection is TLS or not"""
from functools import lru_cache
from hashlib import sha512
from time import time
from timeit import default_timer
Expand All @@ -17,16 +16,10 @@
from structlog.stdlib import get_logger

from authentik.lib.utils.http import get_client_ip
from authentik.root.install_id import get_install_id

LOGGER = get_logger("authentik.asgi")
ACR_AUTHENTIK_SESSION = "goauthentik.io/core/default"


@lru_cache
def get_signing_hash():
"""Get cookie JWT signing hash"""
return sha512(get_install_id().encode()).hexdigest()
SIGNING_HASH = sha512(settings.SECRET_KEY.encode()).hexdigest()


class SessionMiddleware(UpstreamSessionMiddleware):
Expand Down Expand Up @@ -54,7 +47,7 @@ def decode_session_key(key: str) -> str:
# for testing setups, where the session is directly set
session_key = key if settings.TEST else None
try:
session_payload = decode(key, get_signing_hash(), algorithms=["HS256"])
session_payload = decode(key, SIGNING_HASH, algorithms=["HS256"])
session_key = session_payload["sid"]
except (KeyError, PyJWTError):
pass
Expand Down Expand Up @@ -121,7 +114,7 @@ def process_response(self, request: HttpRequest, response: HttpResponse) -> Http
}
if request.user.is_authenticated:
payload["sub"] = request.user.uid
value = encode(payload=payload, key=get_signing_hash())
value = encode(payload=payload, key=SIGNING_HASH)
if settings.TEST:
value = request.session.session_key
response.set_cookie(
Expand Down