From dcc97ce0790c64d1cfa0e69ec32d01f1dee3e7e5 Mon Sep 17 00:00:00 2001
From: Kevin Lyda <kevin@ie.suberic.net>
Date: Sun, 21 Oct 2018 08:03:56 +0100
Subject: [PATCH] Only pass around the port for auto tokens.

---
 client/client.go    | 14 ++++++--------
 cmd/cashier/main.go |  4 +---
 server/handlers.go  |  9 +++++----
 3 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/client/client.go b/client/client.go
index 3116ab8b..09da7879 100644
--- a/client/client.go
+++ b/client/client.go
@@ -177,9 +177,9 @@ func Sign(pub ssh.PublicKey, token string, conf *Config) (*ssh.Certificate, erro
 
 // Listener type contains information for the client listener.
 type Listener struct {
-	srv         *http.Server
-	ReceiverURL string
-	Token       chan string
+	srv   *http.Server
+	Port  int
+	Token chan string
 }
 
 // StartHTTPServer starts an http server in the background.
@@ -188,9 +188,9 @@ func StartHTTPServer() *Listener {
 		srv:   &http.Server{},
 		Token: make(chan string),
 	}
-	authCallbackURL := "/auth/callback" // TODO: Random?
+	authCallbackPath := "/auth/callback" // TODO: Random?
 
-	http.HandleFunc(authCallbackURL,
+	http.HandleFunc(authCallbackPath,
 		func(w http.ResponseWriter, r *http.Request) {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
 			w.Write([]byte("<html><head><title>Authorized</title></head><body>Authorized. You can now close this window.</body></html>"))
@@ -203,9 +203,7 @@ func StartHTTPServer() *Listener {
 	if err != nil {
 		return nil
 	}
-	port := l.Addr().(*net.TCPAddr).Port
-	listener.ReceiverURL = fmt.Sprintf("http://localhost:%d%s",
-		port, authCallbackURL)
+	listener.Port = l.Addr().(*net.TCPAddr).Port
 
 	go func() {
 		err := listener.srv.Serve(l)
diff --git a/cmd/cashier/main.go b/cmd/cashier/main.go
index 4400e7c5..a08096ce 100644
--- a/cmd/cashier/main.go
+++ b/cmd/cashier/main.go
@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"log"
 	"net"
-	"net/url"
 	"os"
 	"os/user"
 	"path"
@@ -55,8 +54,7 @@ func main() {
 	if c.AutoToken {
 		listener = client.StartHTTPServer()
 		if listener != nil {
-			authURL = fmt.Sprintf("%s?auto_token=%s",
-				c.CA, url.PathEscape(listener.ReceiverURL))
+			authURL = fmt.Sprintf("%s?auto_token=%d", c.CA, listener.Port)
 		}
 	}
 	fmt.Printf("Your browser has been opened to visit %s\n", authURL)
diff --git a/server/handlers.go b/server/handlers.go
index 0b56cb5a..b078c20d 100644
--- a/server/handlers.go
+++ b/server/handlers.go
@@ -116,10 +116,11 @@ func (a *app) auth(w http.ResponseWriter, r *http.Request) {
 
 func (a *app) index(w http.ResponseWriter, r *http.Request) {
 	tok := a.getAuthToken(r)
-	autoTokenURL := a.getSessionVariable(r, "auto_token")
-	if autoTokenURL != "" {
-		http.Redirect(w, r, fmt.Sprintf("%s?token=%s",
-			autoTokenURL, tok.AccessToken), http.StatusSeeOther)
+	autoToken := a.getSessionVariable(r, "auto_token")
+	if autoToken != "" {
+		http.Redirect(w, r,
+			fmt.Sprintf("http://localhost:%s/auth/callback?token=%s",
+				autoToken, tok.AccessToken), http.StatusSeeOther)
 	} else {
 		page := struct {
 			Token string
-- 
GitLab