Add redis lock feature (#1063)

* Add sensible logging flag to default setup for logger

* Add Redis lock

* Fix default value flag for sensitive logging

* Split RefreshSessionIfNeeded in two methods and use Redis lock

* Small adjustments to doc and code

* Remove sensible logging

* Fix method names in ticket.go

* Revert "Fix method names in ticket.go"

This reverts commit 408ba1a1a5.

* Fix methods name in ticket.go

* Remove block in Redis client get

* Increase lock time to 1 second

* Perform retries, if session store is locked

* Reverse if condition, because it should return if session does not have to be refreshed

* Update go.sum

* Update MockStore

* Return error if loading session fails

* Fix and update tests

* Change validSession to session in docs and strings

* Change validSession to session in docs and strings

* Fix docs

* Fix wrong field name

* Fix linting

* Fix imports for linting

* Revert changes except from locking functionality

* Add lock feature on session state

* Update from master

* Remove errors package, because it is not used

* Only pass context instead of request to lock

* Use lock key

* By default use NoOpLock

* Remove debug output

* Update ticket_test.go

* Map internal error to sessions error

* Add ErrLockNotObtained

* Enable lock peek for all redis clients

* Use lock key prefix consistent

* Fix imports

* Use exists method for peek lock

* Fix imports

* Fix imports

* Fix imports

* Remove own Dockerfile

* Fix imports

* Fix tests for ticket and session store

* Fix session store test

* Update pkg/apis/sessions/interfaces.go

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

* Do not wrap lock method

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

* Use errors package for lock constants

* Use better naming for initLock function

* Add comments

* Add session store lock test

* Fix tests

* Fix tests

* Fix tests

* Fix tests

* Add cookies after saving session

* Add mock lock

* Fix imports for mock_lock.go

* Store mock lock for key

* Apply elapsed time on mock lock

* Check if lock is initially applied

* Reuse existing lock

* Test all lock methods

* Update CHANGELOG.md

* Use redis client methods in redis.lock for release an refresh

* Use lock key suffix instead of prefix for lock key

* Add comments for Lock interface

* Update comment for Lock interface

* Update CHANGELOG.md

* Change LockSuffix to const

* Check lock on already loaded session

* Use global var for loadedSession in lock tests

* Use lock instance for refreshing and releasing of lock

* Update possible error type for Refresh

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

pkg/sessions/persistence/interfaces.go

@@ -3,6 +3,8 @@ package persistence
 import (
 	"context"
 	"time"
+
+	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
 )
 
 // Store is used for persistent session stores (IE not Cookie)
@@ -12,4 +14,5 @@ type Store interface {
 	Save(context.Context, string, []byte, time.Duration) error
 	Load(context.Context, string) ([]byte, error)
 	Clear(context.Context, string) error
+	Lock(key string) sessions.Lock
 }

pkg/sessions/persistence/manager.go

@@ -60,9 +60,12 @@ func (m *Manager) Load(req *http.Request) (*sessions.SessionState, error) {
 		return nil, err
 	}
 
-	return tckt.loadSession(func(key string) ([]byte, error) {
-		return m.Store.Load(req.Context(), key)
-	})
+	return tckt.loadSession(
+		func(key string) ([]byte, error) {
+			return m.Store.Load(req.Context(), key)
+		},
+		m.Store.Lock,
+	)
 }
 
 // Clear clears any saved session information for a given ticket cookie.

pkg/sessions/persistence/ticket.go

@@ -30,6 +30,10 @@ type loadFunc func(string) ([]byte, error)
 // a string key for the target of the deletion.
 type clearFunc func(string) error
 
+// initLockFunc returns a lock object for a persistent store using a
+// string key
+type initLockFunc func(string) sessions.Lock
+
 // ticket is a structure representing the ticket used in server based
 // session storage. It provides a unique per session decryption secret giving
 // more security than the shared CookieSecret.
@@ -122,7 +126,8 @@ func (t *ticket) saveSession(s *sessions.SessionState, saver saveFunc) error {
 // loadSession loads a session from the disk store via the passed loadFunc
 // using the ticket.id as the key. It then decodes the SessionState using
 // ticket.secret to make the AES-GCM cipher.
-func (t *ticket) loadSession(loader loadFunc) (*sessions.SessionState, error) {
+// finally it appends a lock implementation
+func (t *ticket) loadSession(loader loadFunc, initLock initLockFunc) (*sessions.SessionState, error) {
 	ciphertext, err := loader(t.id)
 	if err != nil {
 		return nil, fmt.Errorf("failed to load the session state with the ticket: %v", err)
@@ -132,7 +137,13 @@ func (t *ticket) loadSession(loader loadFunc) (*sessions.SessionState, error) {
 		return nil, err
 	}
 
-	return sessions.DecodeSessionState(ciphertext, c, false)
+	sessionState, err := sessions.DecodeSessionState(ciphertext, c, false)
+	if err != nil {
+		return nil, err
+	}
+	lock := initLock(t.id)
+	sessionState.Lock = lock
+	return sessionState, nil
 }
 
 // clearSession uses the passed clearFunc to delete a session stored with a

pkg/sessions/persistence/ticket_test.go

@@ -103,10 +103,17 @@ var _ = Describe("Session Ticket Tests", func() {
 			c, err := t.makeCipher()
 			Expect(err).ToNot(HaveOccurred())
 
-			ss := &sessions.SessionState{User: "foobar"}
-			loadedSession, err := t.loadSession(func(k string) ([]byte, error) {
-				return ss.EncodeSessionState(c, false)
-			})
+			ss := &sessions.SessionState{
+				User: "foobar",
+				Lock: &sessions.NoOpLock{},
+			}
+			loadedSession, err := t.loadSession(
+				func(k string) ([]byte, error) {
+					return ss.EncodeSessionState(c, false)
+				},
+				func(k string) sessions.Lock {
+					return &sessions.NoOpLock{}
+				})
 			Expect(err).ToNot(HaveOccurred())
 			Expect(loadedSession).To(Equal(ss))
 		})
@@ -115,9 +122,13 @@ var _ = Describe("Session Ticket Tests", func() {
 			t, err := newTicket(&options.Cookie{Name: "dummy"})
 			Expect(err).ToNot(HaveOccurred())
 
-			data, err := t.loadSession(func(k string) ([]byte, error) {
-				return nil, errors.New("load error")
-			})
+			data, err := t.loadSession(
+				func(k string) ([]byte, error) {
+					return nil, errors.New("load error")
+				},
+				func(k string) sessions.Lock {
+					return &sessions.NoOpLock{}
+				})
 			Expect(data).To(BeNil())
 			Expect(err).To(MatchError(errors.New("failed to load the session state with the ticket: load error")))
 		})