volatiletech/authboss-clientstate

Provides gorilla based session and cookie handling for authboss

Authboss Client State

Session and Cookie ClientStateRW implementations using Gorilla.

Assuming you're using Gorilla in your web application you can easily use this package to augment Gorilla to be used with authboss or use this package's wrappers directly.

authboss-clientstate's Issues

ReadState drops error on the floor

https://github.com/volatiletech/authboss-clientstate/blob/master/sessions.go#L60

I presume this should be return nil, err

Using GAE datastore as database undefined: http.SameSite

Starting the datastore emulator with:
$ dev_appserver.py app.yaml
throws an error that http.SameSite can't be found.

ERROR 2019-09-19 21:54:19,563 instance_factory.py:243] Failed to build Go application: (Executed command: /Users/x/google-cloud-sdk/platform/google_appengine/goroot-1.9/bin/go-app-builder -app_base /Users/x/Dropbox/go/src/authboss-sampleGAE -api_version go1 -arch 6 -dynamic -goroot /Users/x/google-cloud-sdk/platform/google_appengine/goroot-1.9 -nobuild_files ^^$ -incremental_rebuild -unsafe -binary_name _go_app -extra_imports appengine_internal/init -work_dir /var/folders/mw/0y88j8_54bjc93d_lg3120qw0000gp/T/tmpMREYx9appengine-go-bin -gcflags -I,/Users/x/google-cloud-sdk/platform/google_appengine/goroot-1.9/pkg/darwin_amd64_appengine -ldflags -L,/Users/Bryan/google-cloud-sdk/platform/google_appengine/goroot-1.9/pkg/darwin_amd64_appengine storer.go debug.go blog.go blogs.go middleware.go)

/Users/x/go/src/github.com/volatiletech/authboss-clientstate/cookies.go:37:11: undefined: http.SameSite

"net/http" is clearly imported on line 4 of cookies.go

Why is http.SameSite undefined?

WriteState type conversion can panic

https://github.com/volatiletech/authboss-clientstate/blob/master/sessions.go#L72

You should basically never do a type conversion without the , ok pattern. This method even already returns an error, so it would be trivial to just return an error that the type is unexpected.

I hit this in trying to get around volatiletech/authboss#181 by just allowing the state to be set to nil... but then it panics here. Clearly the state shouldn't be nil... but there's also no reason not to do the checked type conversion.

sessions.go:113:8: undefined: authboss.ClientStateEventDelAll

What do you think about this?

[13:24:14.383] failed to build, error: stderr: # github.com/volatiletech/authboss-clientstate
..\..\..\..\go\pkg\mod\github.com\volatiletech\[email protected]\sessions.go:113:8: undefined: authboss.ClientStateEventDelAll