nic-6443 commented on code in PR #13808:
URL: https://github.com/apache/apisix/pull/13808#discussion_r3772180062
##########
apisix/plugins/openid-connect.lua:
##########
@@ -1117,6 +1192,335 @@ local function
validate_claims_in_oidcauth_response(resp, conf)
end
+local function bcl_redis_conf(conf)
+ return conf.backchannel_logout.redis
+ or (conf.session and conf.session.redis)
+end
+
+
+local function bcl_redis_connect(rconf)
+ local red, err = redis.new({
+ redis_host = rconf.host,
+ redis_port = rconf.port,
+ redis_username = rconf.username,
+ redis_password = rconf.password,
+ redis_database = rconf.database,
+ redis_ssl = rconf.ssl,
+ redis_ssl_verify = rconf.ssl_verify,
+ redis_timeout = rconf.connect_timeout,
+ })
+ if not red then
+ return nil, "failed to connect to redis: " .. err
+ end
+ return red
+end
+
+
+-- One revocation (or seen-jti) entry per key, holding the caller-supplied
+-- value (the logout token's iat, for entries the request path compares
+-- against).
+local function bcl_store_set(conf, key, value, ttl)
+ if conf.backchannel_logout.storage == "redis" then
+ local rconf = bcl_redis_conf(conf)
+ local red, err = bcl_redis_connect(rconf)
+ if not red then
+ return false, err
+ end
+ local ok
+ ok, err = red:set(rconf.prefix .. ":" .. key, value, "EX", ttl)
+ if not ok then
+ red:close()
+ return false, "failed to write to redis: " .. err
+ end
+ red:set_keepalive(rconf.keepalive_timeout, 100)
+ return true
+ end
+
+ local dict = ngx.shared.bcl
+ if not dict then
+ return false, "shared dict \"bcl\" is missing"
+ end
+ -- safe_set: evicting an unexpired revocation to make room would silently
+ -- re-admit a revoked session, so a full dict must fail the write instead.
+ local ok, err = dict:safe_set(key, value, ttl)
+ if not ok then
+ return false, "failed to write to the shared dict: " .. err
+ end
+ return true
+end
Review Comment:
These codes that directly manipulate Redis data break the encapsulation of
the OIDC and session libraries. We should not do this and need to find or add
relevant features in the upstream libraries.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
