gitea
/
forgejo
mirror of https://codeberg.org/forgejo/forgejo
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request '[GITEA] Refactor generation of JWT secret' (#2227) from gusted/forgejo-refactor-jwt-secret into forgejo-dependency 

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2227
Reviewed-by: Otto <otto@codeberg.org>
Reviewed-by: oliverpool <oliverpool@noreply.codeberg.org>
This commit is contained in:
Gusted 2024-01-25 18:26:15 +00:00
parent dd0af95065 6a6b5a31a8
commit c3665b2a94
5 changed files with 8 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/generate.go
View File

@ -70,7 +70,7 @@ func runGenerateInternalToken(c *cli.Context) error {
}
func runGenerateLfsJwtSecret(c *cli.Context) error {
_, jwtSecretBase64, err := generate.NewJwtSecretBase64()
_, jwtSecretBase64, err := generate.NewJwtSecret()
if err != nil {
return err
}

16
modules/generate/generate.go
View File

@ -38,22 +38,14 @@ func NewInternalToken() (string, error) {
return internalToken, nil
}
// NewJwtSecret generates a new value intended to be used for JWT secrets.
func NewJwtSecret() ([]byte, error) {
// NewJwtSecret generates a new base64 encoded value intended to be used for JWT secrets.
func NewJwtSecret() ([]byte, string, error) {
bytes := make([]byte, 32)
_, err := io.ReadFull(rand.Reader, bytes)
if err != nil {
return nil, err
}
return bytes, nil
}
// NewJwtSecretBase64 generates a new base64 encoded value intended to be used for JWT secrets.
func NewJwtSecretBase64() ([]byte, string, error) {
bytes, err := NewJwtSecret()
_, err := rand.Read(bytes)
if err != nil {
return nil, "", err
}
return bytes, base64.RawURLEncoding.EncodeToString(bytes), nil
}

2
modules/setting/lfs.go
View File

@ -64,7 +64,7 @@ func loadLFSFrom(rootCfg ConfigProvider) error {
LFS.JWTSecretBase64 = loadSecret(rootCfg.Section("server"), "LFS_JWT_SECRET_URI", "LFS_JWT_SECRET")
LFS.JWTSecretBytes, err = util.Base64FixedDecode(base64.RawURLEncoding, []byte(LFS.JWTSecretBase64), 32)
if err != nil {
LFS.JWTSecretBytes, LFS.JWTSecretBase64, err = generate.NewJwtSecretBase64()
LFS.JWTSecretBytes, LFS.JWTSecretBase64, err = generate.NewJwtSecret()
if err != nil {
return fmt.Errorf("error generating JWT Secret for custom config: %v", err)
}

3
modules/setting/oauth2.go
View File

@ -131,12 +131,11 @@ func loadOAuth2From(rootCfg ConfigProvider) {
if InstallLock {
if _, err := util.Base64FixedDecode(base64.RawURLEncoding, []byte(OAuth2.JWTSecretBase64), 32); err != nil {
key, err := generate.NewJwtSecret()
_, OAuth2.JWTSecretBase64, err = generate.NewJwtSecret()
if err != nil {
log.Fatal("error generating JWT secret: %v", err)
}
OAuth2.JWTSecretBase64 = base64.RawURLEncoding.EncodeToString(key)
saveCfg, err := rootCfg.PrepareSaving()
if err != nil {
log.Fatal("save oauth2.JWT_SECRET failed: %v", err)

2
routers/install/install.go
View File

@ -413,7 +413,7 @@ func SubmitInstall(ctx *context.Context) {
cfg.Section("server").Key("LFS_START_SERVER").SetValue("true")
cfg.Section("lfs").Key("PATH").SetValue(form.LFSRootPath)
var lfsJwtSecret string
if _, lfsJwtSecret, err = generate.NewJwtSecretBase64(); err != nil {
if _, lfsJwtSecret, err = generate.NewJwtSecret(); err != nil {
ctx.RenderWithErr(ctx.Tr("install.lfs_jwt_secret_failed", err), tplInstall, &form)
return
}