/src/mod_auth_openidc/src/handle/content.c

Source
/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

/***************************************************************************
 * Copyright (C) 2017-2026 ZmartZone Holding BV
 * All rights reserved.
 *
 * DISCLAIMER OF WARRANTIES:
 *
 * THE SOFTWARE PROVIDED HEREUNDER IS PROVIDED ON AN "AS IS" BASIS, WITHOUT
 * ANY WARRANTIES OR REPRESENTATIONS EXPRESS, IMPLIED OR STATUTORY; INCLUDING,
 * WITHOUT LIMITATION, WARRANTIES OF QUALITY, PERFORMANCE, NONINFRINGEMENT,
 * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.  NOR ARE THERE ANY
 * WARRANTIES CREATED BY A COURSE OR DEALING, COURSE OF PERFORMANCE OR TRADE
 * USAGE.  FURTHERMORE, THERE ARE NO WARRANTIES THAT THE SOFTWARE WILL MEET
 * YOUR NEEDS OR BE FREE FROM ERRORS, OR THAT THE OPERATION OF THE SOFTWARE
 * WILL BE UNINTERRUPTED.  IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES HOWEVER CAUSED AND ON ANY THEORY OF
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * @Author: Hans Zandbelt - hans.zandbelt@openidc.com
 */

#include "handle/handle.h"
#include "metrics.h"
#include "mod_auth_openidc.h"
#include "util/request_state.h"
#include "util/util.h"
#include "util/util_cfg.h"

/*
 * handle a request for session info on the redirect URI
 */
static int oidc_content_handle_info_request(request_rec *r, oidc_cfg_t *c) {
  int rc = OK;
  /* track if the session needs to be updated/saved into the cache */
  apr_byte_t needs_save = FALSE;
  oidc_session_t *session = NULL;

  /* see if a session was retained in the request state */
  apr_pool_userdata_get((void **)&session, OIDC_USERDATA_SESSION, r->pool);

  /* if no retained session was found, load it from the cache or create a new one*/
  if (session == NULL)
    oidc_session_load(r, &session);

  /*
   * see if the request state indicates that the (retained)
   * session was modified and needs to be updated in the cache
   */
  needs_save = (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_SAVE) != NULL);

  /* handle request for session info */
  rc = oidc_info_request(r, c, session, needs_save);

  /* free resources allocated for the session */
  oidc_session_free(r, session);

  return rc;
}

/*
 * handle content generating requests to the redirect URI
 */
static int oidc_content_handle_redirect_uri_request(request_rec *r, oidc_cfg_t *c) {
  /* requests to the redirect URI are handled and finished here */
  int rc = OK;

  /* NB: check HTTP/HTML request before info (and others) so Logout HTML is processed if there's no
   * session (anymore) */
  if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_HTTP) != NULL) {

    /* HTTP response has been generated and stored in the request state */
    rc = oidc_util_http_content_send(r);

  } else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_HTML) != NULL) {

    /* HTML body has been generated and stored in the request state */
    rc = oidc_util_html_content_send(r);

  } else if (oidc_util_url_has_parameter(r, OIDC_REDIRECT_URI_REQUEST_INFO)) {

    OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_INFO);

    /* handle request for session info */
    rc = oidc_content_handle_info_request(r, c);

  } else if (oidc_util_url_has_parameter(r, OIDC_REDIRECT_URI_REQUEST_DPOP)) {

    OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_DPOP);

    /* handle request to create a DPoP proof */
    rc = oidc_dpop_request(r, c);

  } else if (oidc_util_url_has_parameter(r, OIDC_REDIRECT_URI_REQUEST_JWKS)) {

    OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_JWKS);

    /* handle JWKs request */
    rc = oidc_jwks_request(r, c);

  } else {

    OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_UNKNOWN);
  }

  return rc;
}

/*
 * handle content generating requests
 */
int oidc_content_handler(request_rec *r) {
  oidc_cfg_t *c = ap_get_module_config(r->server->module_config, &auth_openidc_module);
  int rc = DECLINED;

  if ((r->parsed_uri.path != NULL) && (oidc_cfg_metrics_path_get(c) != NULL) &&
      (_oidc_strcmp(r->parsed_uri.path, oidc_cfg_metrics_path_get(c)) == 0))
    return oidc_metrics_handle_request(r);

  if (oidc_enabled(r, c) == FALSE) {
    OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_DECLINED);
    return DECLINED;
  }

  if (oidc_util_url_matches_redirect_uri(r, c) == TRUE) {

    rc = oidc_content_handle_redirect_uri_request(r, c);

  } else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_DISCOVERY) != NULL) {

    OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_DISCOVERY);

    /* discovery may result in a 200 HTML page or a redirect to an external URL */
    rc = oidc_discovery_request(r, c);

  } else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_AUTHN_POST) != NULL) {

    /* sending POST authentication request */
    OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_AUTHN_POST);

    /* HTML body has been generated and stored in the request state */
    rc = oidc_util_html_content_send(r);

  } else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_AUTHN_PRESERVE) != NULL) {

    /* sending POST preserve request */
    OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_POST_PRESERVE);

    /* Javascript for HTML head has been generated and stored in the request state */
    rc = oidc_util_html_content_send(r);

  } else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_HTTP) != NULL) {

    /* HTTP response has been generated and stored in the request state */
    rc = oidc_util_http_content_send(r);

  } else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_HTML) != NULL) {

    /* HTML body has been generated and stored in the request state */
    rc = oidc_util_html_content_send(r);

  } /* else: an authenticated request for which content is produced downstream */

  return rc;
}

Line	Count	Source
1		/*
2		* Licensed to the Apache Software Foundation (ASF) under one
3		* or more contributor license agreements. See the NOTICE file
4		* distributed with this work for additional information
5		* regarding copyright ownership. The ASF licenses this file
6		* to you under the Apache License, Version 2.0 (the
7		* "License"); you may not use this file except in compliance
8		* with the License. You may obtain a copy of the License at
9		*
10		* http://www.apache.org/licenses/LICENSE-2.0
11		*
12		* Unless required by applicable law or agreed to in writing,
13		* software distributed under the License is distributed on an
14		* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15		* KIND, either express or implied. See the License for the
16		* specific language governing permissions and limitations
17		* under the License.
18		*/
19
20		/***************************************************************************
21		* Copyright (C) 2017-2026 ZmartZone Holding BV
22		* All rights reserved.
23		*
24		* DISCLAIMER OF WARRANTIES:
25		*
26		* THE SOFTWARE PROVIDED HEREUNDER IS PROVIDED ON AN "AS IS" BASIS, WITHOUT
27		* ANY WARRANTIES OR REPRESENTATIONS EXPRESS, IMPLIED OR STATUTORY; INCLUDING,
28		* WITHOUT LIMITATION, WARRANTIES OF QUALITY, PERFORMANCE, NONINFRINGEMENT,
29		* MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. NOR ARE THERE ANY
30		* WARRANTIES CREATED BY A COURSE OR DEALING, COURSE OF PERFORMANCE OR TRADE
31		* USAGE. FURTHERMORE, THERE ARE NO WARRANTIES THAT THE SOFTWARE WILL MEET
32		* YOUR NEEDS OR BE FREE FROM ERRORS, OR THAT THE OPERATION OF THE SOFTWARE
33		* WILL BE UNINTERRUPTED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR
34		* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
35		* EXEMPLARY, OR CONSEQUENTIAL DAMAGES HOWEVER CAUSED AND ON ANY THEORY OF
36		* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
37		* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
38		* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39		*
40		* @Author: Hans Zandbelt - hans.zandbelt@openidc.com
41		*/
42
43		#include "handle/handle.h"
44		#include "metrics.h"
45		#include "mod_auth_openidc.h"
46		#include "util/request_state.h"
47		#include "util/util.h"
48		#include "util/util_cfg.h"
49
50		/*
51		* handle a request for session info on the redirect URI
52		*/
53	115	static int oidc_content_handle_info_request(request_rec r, oidc_cfg_t c) {
54	115	int rc = OK;
55		/* track if the session needs to be updated/saved into the cache */
56	115	apr_byte_t needs_save = FALSE;
57	115	oidc_session_t *session = NULL;
58
59		/* see if a session was retained in the request state */
60	115	apr_pool_userdata_get((void **)&session, OIDC_USERDATA_SESSION, r->pool);
61
62		/* if no retained session was found, load it from the cache or create a new one*/
63	115	if (session == NULL)
64	115	oidc_session_load(r, &session);
65
66		/*
67		* see if the request state indicates that the (retained)
68		* session was modified and needs to be updated in the cache
69		*/
70	115	needs_save = (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_SAVE) != NULL);
71
72		/* handle request for session info */
73	115	rc = oidc_info_request(r, c, session, needs_save);
74
75		/* free resources allocated for the session */
76	115	oidc_session_free(r, session);
77
78	115	return rc;
79	115	}
80
81		/*
82		* handle content generating requests to the redirect URI
83		*/
84	158	static int oidc_content_handle_redirect_uri_request(request_rec r, oidc_cfg_t c) {
85		/* requests to the redirect URI are handled and finished here */
86	158	int rc = OK;
87
88		/* NB: check HTTP/HTML request before info (and others) so Logout HTML is processed if there's no
89		* session (anymore) */
90	158	if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_HTTP) != NULL) {
91
92		/* HTTP response has been generated and stored in the request state */
93	5	rc = oidc_util_http_content_send(r);
94
95	153	} else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_HTML) != NULL) {
96
97		/* HTML body has been generated and stored in the request state */
98	24	rc = oidc_util_html_content_send(r);
99
100	129	} else if (oidc_util_url_has_parameter(r, OIDC_REDIRECT_URI_REQUEST_INFO)) {
101
102	115	OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_INFO);
103
104		/* handle request for session info */
105	115	rc = oidc_content_handle_info_request(r, c);
106
107	115	} else if (oidc_util_url_has_parameter(r, OIDC_REDIRECT_URI_REQUEST_DPOP)) {
108
109	1	OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_DPOP);
110
111		/* handle request to create a DPoP proof */
112	1	rc = oidc_dpop_request(r, c);
113
114	13	} else if (oidc_util_url_has_parameter(r, OIDC_REDIRECT_URI_REQUEST_JWKS)) {
115
116	1	OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_JWKS);
117
118		/* handle JWKs request */
119	1	rc = oidc_jwks_request(r, c);
120
121	12	} else {
122
123	12	OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_UNKNOWN);
124	12	}
125
126	158	return rc;
127	158	}
128
129		/*
130		* handle content generating requests
131		*/
132	158	int oidc_content_handler(request_rec *r) {
133	158	oidc_cfg_t *c = ap_get_module_config(r->server->module_config, &auth_openidc_module);
134	158	int rc = DECLINED;
135
136	158	if ((r->parsed_uri.path != NULL) && (oidc_cfg_metrics_path_get(c) != NULL) &&
137	0	(_oidc_strcmp(r->parsed_uri.path, oidc_cfg_metrics_path_get(c)) == 0))
138	0	return oidc_metrics_handle_request(r);
139
140	158	if (oidc_enabled(r, c) == FALSE) {
141	0	OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_DECLINED);
142	0	return DECLINED;
143	0	}
144
145	158	if (oidc_util_url_matches_redirect_uri(r, c) == TRUE) {
146
147	158	rc = oidc_content_handle_redirect_uri_request(r, c);
148
149	158	} else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_DISCOVERY) != NULL) {
150
151	0	OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_DISCOVERY);
152
153		/* discovery may result in a 200 HTML page or a redirect to an external URL */
154	0	rc = oidc_discovery_request(r, c);
155
156	0	} else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_AUTHN_POST) != NULL) {
157
158		/* sending POST authentication request */
159	0	OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_AUTHN_POST);
160
161		/* HTML body has been generated and stored in the request state */
162	0	rc = oidc_util_html_content_send(r);
163
164	0	} else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_AUTHN_PRESERVE) != NULL) {
165
166		/* sending POST preserve request */
167	0	OIDC_METRICS_COUNTER_INC(r, c, OM_CONTENT_REQUEST_POST_PRESERVE);
168
169		/* Javascript for HTML head has been generated and stored in the request state */
170	0	rc = oidc_util_html_content_send(r);
171
172	0	} else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_HTTP) != NULL) {
173
174		/* HTTP response has been generated and stored in the request state */
175	0	rc = oidc_util_http_content_send(r);
176
177	0	} else if (oidc_request_state_get(r, OIDC_REQUEST_STATE_KEY_HTML) != NULL) {
178
179		/* HTML body has been generated and stored in the request state */
180	0	rc = oidc_util_html_content_send(r);
181
182	0	} /* else: an authenticated request for which content is produced downstream */
183
184	158	return rc;
185	158	}

Coverage Report

Created: 2026-09-03 06:52