cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix potential race condition during signer update

Browse source
This commit is contained in:
David Sharnoff 2022-09-27 18:33:16 -07:00
parent 0e7949b1a0
commit 35630fbb3e
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
pkg/op/signer.go
View file

@ -3,6 +3,7 @@ package op
import ( import (
"context" "context"
"errors" "errors"
"sync"
"github.com/zitadel/logging" "github.com/zitadel/logging"
"gopkg.in/square/go-jose.v2" "gopkg.in/square/go-jose.v2"
@ -18,6 +19,7 @@ type tokenSigner struct {
signer jose.Signer signer jose.Signer
storage AuthStorage storage AuthStorage
alg jose.SignatureAlgorithm alg jose.SignatureAlgorithm
lock sync.RWMutex
} }
func NewSigner(ctx context.Context, storage AuthStorage, keyCh <-chan jose.SigningKey) Signer { func NewSigner(ctx context.Context, storage AuthStorage, keyCh <-chan jose.SigningKey) Signer {
@ -47,6 +49,8 @@ func (s *tokenSigner) Health(_ context.Context) error {
} }
func (s *tokenSigner) Signer() jose.Signer { func (s *tokenSigner) Signer() jose.Signer {
s.lock.RLock()
defer s.lock.RUnlock()
return s.signer return s.signer
} }
@ -62,6 +66,8 @@ func (s *tokenSigner) refreshSigningKey(ctx context.Context, keyCh <-chan jose.S
} }
func (s *tokenSigner) exchangeSigningKey(key jose.SigningKey) { func (s *tokenSigner) exchangeSigningKey(key jose.SigningKey) {
s.lock.Lock()
defer s.lock.Unlock()
s.alg = key.Algorithm s.alg = key.Algorithm
if key.Algorithm == "" || key.Key == nil { if key.Algorithm == "" || key.Key == nil {
s.signer = nil s.signer = nil