a6c32908a0
- Remove SessionCookieName and SessionSlidingDuration constants - Remove ExtractSessionCookieFromHeader() function - Remove SessionIDContextKey and GetSessionID() function - Remove sessionID parameter from SetUserInContext() - Remove SessionID field from AuthResult struct - Remove session cookie extraction from middleware - Update documentation to reflect JWT + PAT only auth Session cookies were never being set since migration to refresh token authentication. This change removes ~50 lines of dead code and clarifies that the system uses JWT access tokens, refresh tokens, and PATs only.
33 lines
820 B
Go
33 lines
820 B
Go
package auth
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
// ExtractBearerToken extracts the JWT token from an Authorization header value.
|
|
// Expected format: "Bearer {token}"
|
|
// Returns empty string if no valid bearer token is found.
|
|
func ExtractBearerToken(authHeader string) string {
|
|
if authHeader == "" {
|
|
return ""
|
|
}
|
|
parts := strings.Fields(authHeader)
|
|
if len(parts) != 2 || !strings.EqualFold(parts[0], "bearer") {
|
|
return ""
|
|
}
|
|
return parts[1]
|
|
}
|
|
|
|
// ExtractRefreshTokenFromCookie extracts the refresh token from cookie header.
|
|
func ExtractRefreshTokenFromCookie(cookieHeader string) string {
|
|
if cookieHeader == "" {
|
|
return ""
|
|
}
|
|
req := &http.Request{Header: http.Header{"Cookie": []string{cookieHeader}}}
|
|
cookie, err := req.Cookie(RefreshTokenCookieName)
|
|
if err != nil {
|
|
return ""
|
|
}
|
|
return cookie.Value
|
|
}
|