summary refs log tree commit diff
path: root/synapse/handlers
diff options
context:
space:
mode:
authorDaniel Wagner-Hall <daniel@matrix.org>2015-08-18 14:22:02 +0100
committerDaniel Wagner-Hall <daniel@matrix.org>2015-08-18 14:22:02 +0100
commit2d3462714e48dca46dd54b17ca29188a17261e28 (patch)
tree8de2fa7cb4529fc1eb4ae6360bbdb2368632f5ad /synapse/handlers
parentMerge password checking implementations (diff)
downloadsynapse-2d3462714e48dca46dd54b17ca29188a17261e28.tar.xz
Issue macaroons as opaque auth tokens
This just replaces random bytes with macaroons. The macaroons are not
inspected by the client or server.

In particular, they claim to have an expiry time, but nothing verifies
that they have not expired.

Follow-up commits will actually enforce the expiration, and allow for
token refresh.

See https://bit.ly/matrix-auth for more information
Diffstat (limited to 'synapse/handlers')
-rw-r--r--synapse/handlers/register.py19
1 files changed, 13 insertions, 6 deletions
diff --git a/synapse/handlers/register.py b/synapse/handlers/register.py
index 39392d9fdd..86bacdda1d 100644
--- a/synapse/handlers/register.py
+++ b/synapse/handlers/register.py
@@ -25,9 +25,9 @@ import synapse.util.stringutils as stringutils
 from synapse.util.async import run_on_reactor
 from synapse.http.client import CaptchaServerHttpClient
 
-import base64
 import bcrypt
 import logging
+import pymacaroons
 import urllib
 
 logger = logging.getLogger(__name__)
@@ -274,11 +274,18 @@ class RegistrationHandler(BaseHandler):
                 )
 
     def generate_token(self, user_id):
-        # urlsafe variant uses _ and - so use . as the separator and replace
-        # all =s with .s so http clients don't quote =s when it is used as
-        # query params.
-        return (base64.urlsafe_b64encode(user_id).replace('=', '.') + '.' +
-                stringutils.random_string(18))
+        macaroon = pymacaroons.Macaroon(
+            location = self.hs.config.server_name,
+            identifier = "key",
+            key = self.hs.config.macaroon_secret_key)
+        macaroon.add_first_party_caveat("gen = 1")
+        macaroon.add_first_party_caveat("user_id = %s" % user_id)
+        macaroon.add_first_party_caveat("type = access")
+        now = self.hs.get_clock().time()
+        expiry = now + 60 * 60
+        macaroon.add_first_party_caveat("time < %s" % expiry)
+
+        return macaroon.serialize()
 
     def _generate_user_id(self):
         return "-" + stringutils.random_string(18)