authorize_error.go

Documentation: github.com/ory/fosite

     1  /*
     2   * Copyright © 2015-2018 Aeneas Rekkas <aeneas+oss@aeneas.io>
     3   *
     4   * Licensed under the Apache License, Version 2.0 (the "License");
     5   * you may not use this file except in compliance with the License.
     6   * You may obtain a copy of the License at
     7   *
     8   *     http://www.apache.org/licenses/LICENSE-2.0
     9   *
    10   * Unless required by applicable law or agreed to in writing, software
    11   * distributed under the License is distributed on an "AS IS" BASIS,
    12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13   * See the License for the specific language governing permissions and
    14   * limitations under the License.
    15   *
    16   * @author		Aeneas Rekkas <aeneas+oss@aeneas.io>
    17   * @copyright 	2015-2018 Aeneas Rekkas <aeneas+oss@aeneas.io>
    18   * @license 	Apache-2.0
    19   *
    20   */
    21  
    22  package fosite
    23  
    24  import (
    25  	"encoding/json"
    26  	"fmt"
    27  	"net/http"
    28  )
    29  
    30  func (f *Fosite) WriteAuthorizeError(rw http.ResponseWriter, ar AuthorizeRequester, err error) {
    31  	rw.Header().Set("Cache-Control", "no-store")
    32  	rw.Header().Set("Pragma", "no-cache")
    33  
    34  	if f.ResponseModeHandler().ResponseModes().Has(ar.GetResponseMode()) {
    35  		f.ResponseModeHandler().WriteAuthorizeError(rw, ar, err)
    36  		return
    37  	}
    38  
    39  	rfcerr := ErrorToRFC6749Error(err).WithLegacyFormat(f.UseLegacyErrorFormat).WithExposeDebug(f.SendDebugMessagesToClients).WithLocalizer(f.MessageCatalog, getLangFromRequester(ar))
    40  	if !ar.IsRedirectURIValid() {
    41  		rw.Header().Set("Content-Type", "application/json;charset=UTF-8")
    42  
    43  		js, err := json.Marshal(rfcerr)
    44  		if err != nil {
    45  			if f.SendDebugMessagesToClients {
    46  				errorMessage := EscapeJSONString(err.Error())
    47  				http.Error(rw, fmt.Sprintf(`{"error":"server_error","error_description":"%s"}`, errorMessage), http.StatusInternalServerError)
    48  			} else {
    49  				http.Error(rw, `{"error":"server_error"}`, http.StatusInternalServerError)
    50  			}
    51  			return
    52  		}
    53  
    54  		rw.WriteHeader(rfcerr.CodeField)
    55  		_, _ = rw.Write(js)
    56  		return
    57  	}
    58  
    59  	redirectURI := ar.GetRedirectURI()
    60  
    61  	// The endpoint URI MUST NOT include a fragment component.
    62  	redirectURI.Fragment = ""
    63  
    64  	errors := rfcerr.ToValues()
    65  	errors.Set("state", ar.GetState())
    66  
    67  	var redirectURIString string
    68  	if ar.GetResponseMode() == ResponseModeFormPost {
    69  		rw.Header().Set("Content-Type", "text/html;charset=UTF-8")
    70  		WriteAuthorizeFormPostResponse(redirectURI.String(), errors, GetPostFormHTMLTemplate(*f), rw)
    71  		return
    72  	} else if ar.GetResponseMode() == ResponseModeFragment {
    73  		redirectURIString = redirectURI.String() + "#" + errors.Encode()
    74  	} else {
    75  		for key, values := range redirectURI.Query() {
    76  			for _, value := range values {
    77  				errors.Add(key, value)
    78  			}
    79  		}
    80  		redirectURI.RawQuery = errors.Encode()
    81  		redirectURIString = redirectURI.String()
    82  	}
    83  
    84  	rw.Header().Set("Location", redirectURIString)
    85  	rw.WriteHeader(http.StatusSeeOther)
    86  }
    87
View as plain text