Login via OpenID-2.0 (#618)

2025-05-04 22:00:39 +00:00 · 2017-03-17 15:16:08 +01:00 · 2017-03-17 15:16:08 +01:00 · 71d16f69ff
commit 71d16f69ff
parent 0693fbfc00
44 changed files with 2298 additions and 57 deletions
--- a/vendor/github.com/yohcop/openid-go/yadis_discovery.go
+++ b/vendor/github.com/yohcop/openid-go/yadis_discovery.go
@ -0,0 +1,119 @@
+package openid
+
+import (
+	"errors"
+	"io"
+	"io/ioutil"
+	"strings"
+
+	"golang.org/x/net/html"
+)
+
+var yadisHeaders = map[string]string{
+	"Accept": "application/xrds+xml"}
+
+func yadisDiscovery(id string, getter httpGetter) (opEndpoint string, opLocalID string, err error) {
+	// Section 6.2.4 of Yadis 1.0 specifications.
+	// The Yadis Protocol is initiated by the Relying Party Agent
+	// with an initial HTTP request using the Yadis URL.
+
+	// This request MUST be either a GET or a HEAD request.
+
+	// A GET or HEAD request MAY include an HTTP Accept
+	// request-header (HTTP 14.1) specifying MIME media type,
+	// application/xrds+xml.
+	resp, err := getter.Get(id, yadisHeaders)
+	if err != nil {
+		return "", "", err
+	}
+
+	defer resp.Body.Close()
+
+	// Section 6.2.5 from Yadis 1.0 spec: Response
+
+	contentType := resp.Header.Get("Content-Type")
+
+	// The response MUST be one of:
+	// (see 6.2.6 for precedence)
+	if l := resp.Header.Get("X-XRDS-Location"); l != "" {
+		// 2. HTTP response-headers that include an X-XRDS-Location
+		// response-header, together with a document
+		return getYadisResourceDescriptor(l, getter)
+	} else if strings.Contains(contentType, "text/html") {
+		// 1. An HTML document with a <head> element that includes a
+		// <meta> element with http-equiv attribute, X-XRDS-Location,
+
+		metaContent, err := findMetaXrdsLocation(resp.Body)
+		if err == nil {
+			return getYadisResourceDescriptor(metaContent, getter)
+		}
+		return "", "", err
+	} else if strings.Contains(contentType, "application/xrds+xml") {
+		// 4. A document of MIME media type, application/xrds+xml.
+		body, err := ioutil.ReadAll(resp.Body)
+		if err == nil {
+			return parseXrds(body)
+		}
+		return "", "", err
+	}
+	// 3. HTTP response-headers only, which MAY include an
+	// X-XRDS-Location response-header, a content-type
+	// response-header specifying MIME media type,
+	// application/xrds+xml, or both.
+	//   (this is handled by one of the 2 previous if statements)
+	return "", "", errors.New("No expected header, or content type")
+}
+
+// Similar as above, but we expect an absolute Yadis document URL.
+func getYadisResourceDescriptor(id string, getter httpGetter) (opEndpoint string, opLocalID string, err error) {
+	resp, err := getter.Get(id, yadisHeaders)
+	if err != nil {
+		return "", "", err
+	}
+	defer resp.Body.Close()
+	// 4. A document of MIME media type, application/xrds+xml.
+	body, err := ioutil.ReadAll(resp.Body)
+	if err == nil {
+		return parseXrds(body)
+	}
+	return "", "", err
+}
+
+// Search for
+// <head>
+//    <meta http-equiv="X-XRDS-Location" content="....">
+func findMetaXrdsLocation(input io.Reader) (location string, err error) {
+	tokenizer := html.NewTokenizer(input)
+	inHead := false
+	for {
+		tt := tokenizer.Next()
+		switch tt {
+		case html.ErrorToken:
+			return "", tokenizer.Err()
+		case html.StartTagToken, html.EndTagToken:
+			tk := tokenizer.Token()
+			if tk.Data == "head" {
+				if tt == html.StartTagToken {
+					inHead = true
+				} else {
+					return "", errors.New("Meta X-XRDS-Location not found")
+				}
+			} else if inHead && tk.Data == "meta" {
+				ok := false
+				content := ""
+				for _, attr := range tk.Attr {
+					if attr.Key == "http-equiv" &&
+						strings.ToLower(attr.Val) == "x-xrds-location" {
+						ok = true
+					} else if attr.Key == "content" {
+						content = attr.Val
+					}
+				}
+				if ok && len(content) > 0 {
+					return content, nil
+				}
+			}
+		}
+	}
+	return "", errors.New("Meta X-XRDS-Location not found")
+}