duosecurity/duo_universal_golang

Duo OIDC-based two-factor authentication for Go web applications

Duo Universal Go library

This SDK allows a web developer to quickly add Duo's interactive, self-service, two-factor authentication to any Golang web login form.

What's included:

• duouniversal - The Golang Duo SDK for interacting with the Duo Universal Prompt
• example - An example Go application with Duo integrated

Tested Against Go Versions:

- 1.19
- 1.20

TLS 1.2 and 1.3 Support

Duo_universal_golang uses the Go cryptography library for TLS operations. Go versions 1.13 and higher support both TLS 1.2 and 1.3.

Getting Started

To use the SDK in your existing development environment, install it using Go Modules

go mod init example
go get github.com/duosecurity/duo_universal_golang/duouniversal

Once it's installed, see our developer documentation at https://duo.com/docs/duoweb and example/main.go in this repo for guidance on integrating Duo 2FA into your web application. See duosecurity/duo_python#57 for a step-by-step example of migrating an existing WebSDK2 integration to the Universal SDK.

Contribute

To contribute, fork this repo and make a pull request with your changes when they are ready.

Install the SDK from source:

cd duouniversal/
go build

Tests

cd duouniversal/
go test

Format

To run formatter

go fmt

duo_universal_golang's Issues

Incorrect use of session object will cause requests to compete with each other and create security vulnerability

duo_universal_golang/example/main.go

Line 33 in 0c2571f

session := Session{}

session := Session{} is scoped to main(). If two users attempt to authenticate at the same time, the session object will be overwritten causing login failure for the first person.

func (session *Session) login(w http.ResponseWriter, r *http.Request, c *duouniversal.Client) {
...
		// Step 4: Generate and save a state variable
		session.duoState, err = c.GenerateState()
		if err != nil {
			log.Fatal("Error generating state: ", err)
		}

Please use something like gorrillas sessions package to manage duoState for each pre-auth session. I'm a bit busy right now but if I get some time I'll PR the right way of doing it.

https://pkg.go.dev/github.com/gorilla/sessions

cannot unmarshal string into Go struct field AccessDeviceInfo.auth_context.access_device.is_encryption_enabled

Hi @AaronAtDuo & @jeffreyparker ! When testing this code I am getting following error:

"json: cannot unmarshal string into Go struct field AccessDeviceInfo.auth_context.access_device.is_encryption_enabled of type bool" [email protected]

When calling:

duoAuth, err := duo.ExchangeAuthorizationCodeFor2faResult(urlDuoCode, token.Subject)