35 lines
704 B
Go
35 lines
704 B
Go
package authproxy
|
|
|
|
import (
|
|
"sync"
|
|
"time"
|
|
)
|
|
|
|
// nonceCache makes hand-off tokens single-use. Entries expire alongside the
|
|
// token they guard, so the map stays tiny (hand-off tokens live 60 seconds).
|
|
type nonceCache struct {
|
|
mu sync.Mutex
|
|
seen map[string]int64
|
|
}
|
|
|
|
func newNonceCache() *nonceCache {
|
|
return &nonceCache{seen: make(map[string]int64)}
|
|
}
|
|
|
|
// use records the nonce and reports whether this was its first use.
|
|
func (c *nonceCache) use(nonce string, exp int64) bool {
|
|
c.mu.Lock()
|
|
defer c.mu.Unlock()
|
|
now := time.Now().Unix()
|
|
for k, v := range c.seen {
|
|
if v < now {
|
|
delete(c.seen, k)
|
|
}
|
|
}
|
|
if _, dup := c.seen[nonce]; dup {
|
|
return false
|
|
}
|
|
c.seen[nonce] = exp
|
|
return true
|
|
}
|