duosecurity/duo_universal_golang

Duo OIDC-based two-factor authentication for Go web applications

duo_universal_golang's Issues

cannot unmarshal string into Go struct field AccessDeviceInfo.auth_context.access_device.is_encryption_enabled

Hi @AaronAtDuo & @jeffreyparker ! When testing this code I am getting following error:

"json: cannot unmarshal string into Go struct field AccessDeviceInfo.auth_context.access_device.is_encryption_enabled of type bool" [email protected]

When calling:

duoAuth, err := duo.ExchangeAuthorizationCodeFor2faResult(urlDuoCode, token.Subject)

Incorrect use of session object will cause requests to compete with each other and create security vulnerability

duo_universal_golang/example/main.go

Line 33 in 0c2571f

session := Session{}

session := Session{} is scoped to main(). If two users attempt to authenticate at the same time, the session object will be overwritten causing login failure for the first person.

func (session *Session) login(w http.ResponseWriter, r *http.Request, c *duouniversal.Client) {
...
		// Step 4: Generate and save a state variable
		session.duoState, err = c.GenerateState()
		if err != nil {
			log.Fatal("Error generating state: ", err)
		}

Please use something like gorrillas sessions package to manage duoState for each pre-auth session. I'm a bit busy right now but if I get some time I'll PR the right way of doing it.

https://pkg.go.dev/github.com/gorilla/sessions