525edb188a
- Added a new blueprint for OIDC logout that invalidates the Authentik session and redirects to a specified landing page. - Introduced custom CSS and JS files for branding, improving the visual integration of Authentik flows. - Updated Nginx configuration to serve the new branding assets and handle specific routes for signup and password recovery. - Enhanced the flow completion logic to support OIDC bridge functionality, including session management and redirect handling. - Implemented unit tests for the new OIDC bridge and flow context functionalities to ensure reliability.
38 lines
849 B
Go
38 lines
849 B
Go
package authentik
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"strings"
|
|
)
|
|
|
|
type sessionClaims struct {
|
|
Authenticated bool `json:"authenticated"`
|
|
Sub string `json:"sub"`
|
|
}
|
|
|
|
// SessionAuthenticated reports whether exported cookies contain a logged-in Authentik session.
|
|
func SessionAuthenticated(stored []SerializedCookie) bool {
|
|
for _, sc := range stored {
|
|
if sc.Name != "authentik_session" || strings.TrimSpace(sc.Value) == "" {
|
|
continue
|
|
}
|
|
parts := strings.Split(sc.Value, ".")
|
|
if len(parts) < 2 {
|
|
continue
|
|
}
|
|
raw, err := base64.RawURLEncoding.DecodeString(parts[1])
|
|
if err != nil {
|
|
continue
|
|
}
|
|
var claims sessionClaims
|
|
if err := json.Unmarshal(raw, &claims); err != nil {
|
|
continue
|
|
}
|
|
if claims.Authenticated && claims.Sub != "" && claims.Sub != "anonymous" {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|