[PR #1069] [MERGED] fix: auth validation on existing sessions, rely on token only #968

New issue

Closed

opened 2026-02-25 23:36:03 +03:00 by kerem · 0 comments

kerem commented

2026-02-25 23:36:03 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/go-shiori/shiori/pull/1069
Author: @fmartingr
Created: 2/27/2025
Status: ✅ Merged
Merged: 2/28/2025
Merged by: @fmartingr

Base: master ← Head: fix/auth-cookie-validation

📝 Commits (9)

ef4e0dd chore: use http.NoBody
e217406 fix: remove cookie token on logout
198b069 fix: remove token cookie on middleware and redirect
f70972a fix: frontend sets cookie token if authenticated
ab3ecba refactor: remove session-id, rely on token only
0fe50e1 docs: make swagger
a5489ba fix: redirect
551ce87 fix: archive route handler
528b303 fix: properly unset cookie

📊 Changes

17 files changed (+124 additions, -169 deletions)

View changed files

📝 docs/swagger/docs.go (+0 -5)
📝 docs/swagger/swagger.json (+0 -5)
📝 docs/swagger/swagger.yaml (+0 -4)
📝 internal/http/handlers/api/v1/accounts_test.go (+2 -6)
📝 internal/http/handlers/api/v1/auth.go (+9 -11)
📝 internal/http/handlers/api/v1/auth_test.go (+5 -21)
📝 internal/http/handlers/bookmark.go (+1 -3)
📝 internal/http/handlers/legacy.go (+6 -3)
📝 internal/http/handlers/legacy_test.go (+1 -25)
📝 internal/http/middleware/auth.go (+8 -2)
📝 internal/http/middleware/auth_test.go (+33 -0)
📝 internal/http/server.go (+2 -5)
📝 internal/view/assets/js/component/login.js (+1 -7)
📝 internal/view/assets/js/page/base.js (+1 -1)
📝 internal/view/index.html (+9 -3)
📝 internal/webserver/handler.go (+42 -64)
📝 internal/webserver/server.go (+4 -4)

📄 Description

This pull request includes several changes aimed at removing the legacy session handling and improving the authentication process by using token-based authentication. The most important changes include the removal of the legacy session handling, updating the login and logout handlers, and ensuring the token is properly managed in the client-side code.

Removal of Legacy Session Handling:

internal/http/handlers/api/v1/auth.go: Removed the legacy session ID handling and related code from the HandleLogin function. [1] [2]
internal/http/handlers/legacy.go: Removed legacy session cache handling in the HandleLogin and HandleLogout functions.
internal/webserver/handler.go: Removed the session cache and related methods, replacing them with token validation. [1] [2]

internal/http/handlers/api/v1/auth.go: Updated the HandleLogout function to remove the token cookie instead of the session ID.
internal/http/middleware/auth.go: Modified the OnRequest method to remove the token cookie and redirect to login if token validation fails.

Client-Side Token Management:

internal/view/assets/js/component/login.js: Updated the login process to set and clear the token cookie instead of the session ID. [1] [2] [3]
internal/view/index.html: Ensured the token cookie is set and cleared properly during login and logout processes. [1] [2] [3]

Test Updates:

internal/http/handlers/api/v1/accounts_test.go: Updated tests to remove the use of the legacy login handler. [1] [2]
internal/http/handlers/api/v1/auth_test.go: Removed the legacy login handler and updated tests accordingly. [1] [2] [3]
internal/http/handlers/legacy_test.go: Removed tests related to the legacy session cache. [1] [2]

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-shiori/shiori/pull/1069 **Author:** [@fmartingr](https://github.com/fmartingr) **Created:** 2/27/2025 **Status:** ✅ Merged **Merged:** 2/28/2025 **Merged by:** [@fmartingr](https://github.com/fmartingr) **Base:** `master` ← **Head:** `fix/auth-cookie-validation` --- ### 📝 Commits (9) - [`ef4e0dd`](https://github.com/go-shiori/shiori/commit/ef4e0dd0368cc7a2a5ecb7e95002ed63d9a81cbf) chore: use http.NoBody - [`e217406`](https://github.com/go-shiori/shiori/commit/e217406177985b1c6ac9dfb060a39d56236df96d) fix: remove cookie token on logout - [`198b069`](https://github.com/go-shiori/shiori/commit/198b069b318fd380e6f0049ef297d798b60db74b) fix: remove token cookie on middleware and redirect - [`f70972a`](https://github.com/go-shiori/shiori/commit/f70972a53422fe068633feb0b6fae96484d7167b) fix: frontend sets cookie token if authenticated - [`ab3ecba`](https://github.com/go-shiori/shiori/commit/ab3ecba1980a0158143b980846cef3750a2e1f03) refactor: remove session-id, rely on token only - [`0fe50e1`](https://github.com/go-shiori/shiori/commit/0fe50e1be5cb3cfa128eb46587dca483dc3a944b) docs: make swagger - [`a5489ba`](https://github.com/go-shiori/shiori/commit/a5489bad2fa111529ae0377d239b638a3ef9f7f5) fix: redirect - [`551ce87`](https://github.com/go-shiori/shiori/commit/551ce87f841f16117aa32edf5826ea0f2f77f603) fix: archive route handler - [`528b303`](https://github.com/go-shiori/shiori/commit/528b3036885d4f025fa6fedfc8a12416c816f30d) fix: properly unset cookie ### 📊 Changes **17 files changed** (+124 additions, -169 deletions) <details> <summary>View changed files</summary> 📝 `docs/swagger/docs.go` (+0 -5) 📝 `docs/swagger/swagger.json` (+0 -5) 📝 `docs/swagger/swagger.yaml` (+0 -4) 📝 `internal/http/handlers/api/v1/accounts_test.go` (+2 -6) 📝 `internal/http/handlers/api/v1/auth.go` (+9 -11) 📝 `internal/http/handlers/api/v1/auth_test.go` (+5 -21) 📝 `internal/http/handlers/bookmark.go` (+1 -3) 📝 `internal/http/handlers/legacy.go` (+6 -3) 📝 `internal/http/handlers/legacy_test.go` (+1 -25) 📝 `internal/http/middleware/auth.go` (+8 -2) 📝 `internal/http/middleware/auth_test.go` (+33 -0) 📝 `internal/http/server.go` (+2 -5) 📝 `internal/view/assets/js/component/login.js` (+1 -7) 📝 `internal/view/assets/js/page/base.js` (+1 -1) 📝 `internal/view/index.html` (+9 -3) 📝 `internal/webserver/handler.go` (+42 -64) 📝 `internal/webserver/server.go` (+4 -4) </details> ### 📄 Description This pull request includes several changes aimed at removing the legacy session handling and improving the authentication process by using token-based authentication. The most important changes include the removal of the legacy session handling, updating the login and logout handlers, and ensuring the token is properly managed in the client-side code. ### Removal of Legacy Session Handling: * [`internal/http/handlers/api/v1/auth.go`](diffhunk://#diff-f045a095cf5a4259bb9de413ed435e79ae16ac2cd421cc9afc154cc08a89e6deL44-R43): Removed the legacy session ID handling and related code from the `HandleLogin` function. [[1]](diffhunk://#diff-f045a095cf5a4259bb9de413ed435e79ae16ac2cd421cc9afc154cc08a89e6deL44-R43) [[2]](diffhunk://#diff-f045a095cf5a4259bb9de413ed435e79ae16ac2cd421cc9afc154cc08a89e6deL75-L84) * [`internal/http/handlers/legacy.go`](diffhunk://#diff-f1b0da8e091fe2d0a67a1ae98abf54df79656cb33b3c9ce6b8b333d8350a36d0L53-R64): Removed legacy session cache handling in the `HandleLogin` and `HandleLogout` functions. * [`internal/webserver/handler.go`](diffhunk://#diff-23ac7c335913be10e1805f787365bc02ea6ebd356c93c93feca9d7bd8901c86aL19-R73): Removed the session cache and related methods, replacing them with token validation. [[1]](diffhunk://#diff-23ac7c335913be10e1805f787365bc02ea6ebd356c93c93feca9d7bd8901c86aL19-R73) [[2]](diffhunk://#diff-23ac7c335913be10e1805f787365bc02ea6ebd356c93c93feca9d7bd8901c86aL88-L108) ### Update Login and Logout Handlers: * [`internal/http/handlers/api/v1/auth.go`](diffhunk://#diff-f045a095cf5a4259bb9de413ed435e79ae16ac2cd421cc9afc154cc08a89e6deR209-R215): Updated the `HandleLogout` function to remove the token cookie instead of the session ID. * [`internal/http/middleware/auth.go`](diffhunk://#diff-5694f2cf177da9911ce163a96863355a6c24ba0bd5a3268151b6207557fc3692L35-R42): Modified the `OnRequest` method to remove the token cookie and redirect to login if token validation fails. ### Client-Side Token Management: * [`internal/view/assets/js/component/login.js`](diffhunk://#diff-f7fe46e66180c6669ab9f41cc5be9f6272f52d0589241577ca6ebf138f2f9611L109-R109): Updated the login process to set and clear the token cookie instead of the session ID. [[1]](diffhunk://#diff-f7fe46e66180c6669ab9f41cc5be9f6272f52d0589241577ca6ebf138f2f9611L109-R109) [[2]](diffhunk://#diff-f7fe46e66180c6669ab9f41cc5be9f6272f52d0589241577ca6ebf138f2f9611L131-L133) [[3]](diffhunk://#diff-f7fe46e66180c6669ab9f41cc5be9f6272f52d0589241577ca6ebf138f2f9611L189-L191) * [`internal/view/index.html`](diffhunk://#diff-52cb678ae9bdcc35b4fb77dbfcdc49f0ad68ac83a8fb4f62363f7bd2510321aaL98-L105): Ensured the token cookie is set and cleared properly during login and logout processes. [[1]](diffhunk://#diff-52cb678ae9bdcc35b4fb77dbfcdc49f0ad68ac83a8fb4f62363f7bd2510321aaL98-L105) [[2]](diffhunk://#diff-52cb678ae9bdcc35b4fb77dbfcdc49f0ad68ac83a8fb4f62363f7bd2510321aaL192) [[3]](diffhunk://#diff-52cb678ae9bdcc35b4fb77dbfcdc49f0ad68ac83a8fb4f62363f7bd2510321aaR206-R210) ### Test Updates: * [`internal/http/handlers/api/v1/accounts_test.go`](diffhunk://#diff-04f89fe15caf8f954d4c436cd765e7d55a091d77c6e4609525219dcb3e291d00L360-R360): Updated tests to remove the use of the legacy login handler. [[1]](diffhunk://#diff-04f89fe15caf8f954d4c436cd765e7d55a091d77c6e4609525219dcb3e291d00L360-R360) [[2]](diffhunk://#diff-04f89fe15caf8f954d4c436cd765e7d55a091d77c6e4609525219dcb3e291d00L483-R481) * [`internal/http/handlers/api/v1/auth_test.go`](diffhunk://#diff-4fafb2dfb0e8f47f1d8fcb14f44ec0d1f4261583eb9dd7dcb06d2f7a1870916dL7-L18): Removed the legacy login handler and updated tests accordingly. [[1]](diffhunk://#diff-4fafb2dfb0e8f47f1d8fcb14f44ec0d1f4261583eb9dd7dcb06d2f7a1870916dL7-L18) [[2]](diffhunk://#diff-4fafb2dfb0e8f47f1d8fcb14f44ec0d1f4261583eb9dd7dcb06d2f7a1870916dL27-R46) [[3]](diffhunk://#diff-4fafb2dfb0e8f47f1d8fcb14f44ec0d1f4261583eb9dd7dcb06d2f7a1870916dL77-L86) * [`internal/http/handlers/legacy_test.go`](diffhunk://#diff-9631057aa89e3bc88fb453ec990aa99faebafd87e63afc4847cc2b441d0ab636L39-L62): Removed tests related to the legacy session cache. [[1]](diffhunk://#diff-9631057aa89e3bc88fb453ec990aa99faebafd87e63afc4847cc2b441d0ab636L39-L62) [[2]](diffhunk://#diff-9631057aa89e3bc88fb453ec990aa99faebafd87e63afc4847cc2b441d0ab636L82-R58) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>