main.go aktualisiert

go.mod

@@ -5,9 +5,14 @@ go 1.23.0
 require (
 	github.com/coreos/go-oidc/v3 v3.11.0
 	golang.org/x/oauth2 v0.27.0
+    "time"
+    "github.com/alexedwards/scs/v2"
+    "github.com/alexedwards/scs/valkeystore"
+    "github.com/valkey-io/valkey-go"
 )
 
 require (
 	github.com/go-jose/go-jose/v4 v4.0.2 // indirect
 	golang.org/x/crypto v0.25.0 // indirect
 )
+

main.go

@@ -5,11 +5,15 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"fmt"
+    "time"
 	"log"
 	"net/http"
     "crypto/tls"
 	"github.com/coreos/go-oidc/v3/oidc"
 	"golang.org/x/oauth2"
+    "github.com/alexedwards/scs/v2"
+    "github.com/alexedwards/scs/valkeystore"
+    "github.com/valkey-io/valkey-go"
 )
 
 const (
@@ -24,10 +28,10 @@ const (
 var (
 	oauthConfig *oauth2.Config
 	verifier    *oidc.IDTokenVerifier
+    sessionManager *scs.SessionManager
 )
 
 func main() {
-
     http.DefaultTransport.(*http.Transport).TLSClientConfig =
     &tls.Config{
         InsecureSkipVerify: true,
@@ -35,6 +39,27 @@ func main() {
 
 	ctx := context.Background()
 
+    // valkey session
+    client, err := valkey.NewClient(
+    valkey.ClientOption{
+        InitAddress: []string{
+            "valkey:6379",
+            },
+        },
+    )
+    
+    if err != nil {
+        log.Fatal(err)
+    }
+    
+    sessionManager = scs.New()
+    sessionManager.Store = valkeystore.New(client)
+    sessionManager.Lifetime = 24 * time.Hour
+    sessionManager.Cookie.HttpOnly = true
+    sessionManager.Cookie.Secure = true
+    sessionManager.Cookie.SameSite = http.SameSiteLaxMode
+    // valkey session end
+
 	// OIDC Discovery (.well-known/openid-configuration)
 	provider, err := oidc.NewProvider(ctx, keycloakURL)
 	if err != nil {
@@ -65,7 +90,12 @@ func main() {
 	http.HandleFunc("/logout", logout)
 
 	log.Println("running :8080")
-	log.Fatal(http.ListenAndServe(":8080", nil))
+    	log.Fatal(
+        http.ListenAndServe(
+            ":8080",
+            sessionManager.LoadAndSave(http.DefaultServeMux),
+        ),
+    )
 }
 
 
@@ -75,11 +105,11 @@ func login(w http.ResponseWriter, r *http.Request) {
 	// CSRF-Schutz: State erzeugen
 	state := randomString()
 
-	http.SetCookie(w, &http.Cookie{
+	sessionManager.Put(
-		Name:  "oidc_state",
+        r.Context(),
-		Value: state,
+        "user",
-		Path:  "/",
+        claims.Username,
-	})
+    )
 
 	url := oauthConfig.AuthCodeURL(
 		state,
@@ -153,41 +183,49 @@ func callback(w http.ResponseWriter, r *http.Request) {
 
 func home(w http.ResponseWriter, r *http.Request) {
 
-	cookie, err := r.Cookie("user")
+	user := sessionManager.GetString(
+    r.Context(),
+    "user",
+)
 
-	if err != nil {
+if user == "" {
 
-		fmt.Fprint(w, `
+    fmt.Fprint(w, `
 <h1>OIDC Demo</h1>
+
 <a href="/login">
 <button>Anmeldung über OIDC</button>
 </a>
 `)
 
-		return
+    return
-	}
+}
 
-
+fmt.Fprintf(
-	fmt.Fprintf(w, `
+    w,
+    `
 <h1>Hallo %s</h1>
 
 <form action="/logout" method="post">
 <button>Abmelden</button>
 </form>
-`, cookie.Value)
+`,
+    user,
+)
+    
 }
 
 
 func logout(w http.ResponseWriter, r *http.Request) {
-
+	sessionManager.Destroy(
-	http.SetCookie(w, &http.Cookie{
+        r.Context(),
-		Name:   "user",
+    )
-		Value:  "",
+	http.Redirect(
-		Path:   "/",
+        w,
-		MaxAge: -1,
+        r,
-	})
+        "/",
-
+        http.StatusFound,
-	http.Redirect(w, r, "/", 302)
+    )
 }