feat: generate a nonce to validate the OAuth callback

1 files changed, 5 insertions, 2 deletions

diff --git a/app/controllers/sessions/controller.go b/app/controllers/sessions/controller.go
index 7e706e7..7549dc7 100644
--- a/app/controllers/sessions/controller.go
+++ b/app/controllers/sessions/controller.go
@@ -3,9 +3,11 @@ package sessions
 import (
 	"context"
 	"net/http"
+	"time"
 
 	"github.com/xlgmokha/x/pkg/log"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/oidc"
+	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/pls"
 	"gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/web/cookie"
 	"golang.org/x/oauth2"
 )
@@ -29,8 +31,9 @@ func (c *Controller) MountTo(mux *http.ServeMux) {
 }
 
 func (c *Controller) New(w http.ResponseWriter, r *http.Request) {
-	// TODO:: Generate and store nonce and use as state param to compare as a CSRF token
-	url := c.cfg.Config.AuthCodeURL("todo-csrf-token", oauth2.SetAuthURLParam("audience", "todo"))
+	nonce := pls.GenerateNonce(32)
+	url := c.cfg.Config.AuthCodeURL(nonce, oauth2.SetAuthURLParam("audience", c.cfg.Config.ClientID))
+	http.SetCookie(w, cookie.New("oauth_state", nonce, time.Now().Add(10*time.Minute)))
 	http.Redirect(w, r, url, http.StatusFound)
 }