webui: Remove sessions & securecookie

pkg/config/config.go

@@ -97,7 +97,6 @@ type Web struct {
 	GreetingFile   string `required:"true" default:"ui/greeting.html" desc:"Home page greeting HTML"`
 	TemplateCache  bool   `required:"true" default:"true" desc:"Cache templates after first use?"`
 	MailboxPrompt  string `required:"true" default:"@inbucket" desc:"Prompt next to mailbox input"`
-	CookieAuthKey  string `desc:"Session cipher key (text)"`
 	MonitorVisible bool   `required:"true" default:"true" desc:"Show monitor tab in UI?"`
 	MonitorHistory int    `required:"true" default:"30" desc:"Monitor remembered messages"`
 	PProf          bool   `required:"true" default:"false" desc:"Expose profiling tools on /debug/pprof"`

pkg/policy/address.go

@@ -159,16 +159,16 @@ func ValidateDomainPart(domain string) bool {
 // domain part is optional and not validated.
 func parseEmailAddress(address string) (local string, domain string, err error) {
 	if address == "" {
-		return "", "", fmt.Errorf("Empty address")
+		return "", "", fmt.Errorf("empty address")
 	}
 	if len(address) > 320 {
-		return "", "", fmt.Errorf("Address exceeds 320 characters")
+		return "", "", fmt.Errorf("address exceeds 320 characters")
 	}
 	if address[0] == '@' {
-		return "", "", fmt.Errorf("Address cannot start with @ symbol")
+		return "", "", fmt.Errorf("address cannot start with @ symbol")
 	}
 	if address[0] == '.' {
-		return "", "", fmt.Errorf("Address cannot start with a period")
+		return "", "", fmt.Errorf("address cannot start with a period")
 	}
 	// Loop over address parsing out local part.
 	buf := new(bytes.Buffer)

pkg/server/web/context.go

@@ -5,7 +5,6 @@ import (
 	"strings"
 
 	"github.com/gorilla/mux"
-	"github.com/gorilla/sessions"
 	"github.com/jhillyerd/inbucket/pkg/config"
 	"github.com/jhillyerd/inbucket/pkg/message"
 	"github.com/jhillyerd/inbucket/pkg/msghub"
@@ -15,7 +14,6 @@ import (
 // TODO remove redundant web config
 type Context struct {
 	Vars       map[string]string
-	Session    *sessions.Session
 	MsgHub     *msghub.Hub
 	Manager    message.Manager
 	RootConfig *config.Root
@@ -48,24 +46,13 @@ func headerMatch(req *http.Request, name string, value string) bool {
 // NewContext returns a Context for the given HTTP Request
 func NewContext(req *http.Request) (*Context, error) {
 	vars := mux.Vars(req)
-	sess, err := sessionStore.Get(req, "inbucket")
-	if err != nil {
-		if sess == nil {
-			// No session, must fail
-			return nil, err
-		}
-		// The session cookie was probably signed by an old key, ignore it
-		// gorilla created an empty session for us
-		err = nil
-	}
 	ctx := &Context{
 		Vars:       vars,
-		Session:    sess,
 		MsgHub:     msgHub,
 		Manager:    manager,
 		RootConfig: rootConfig,
 		WebConfig:  rootConfig.Web,
 		IsJSON:     headerMatch(req, "Accept", "application/json"),
 	}
-	return ctx, err
+	return ctx, nil
 }

pkg/server/web/server.go

@@ -11,8 +11,6 @@ import (
 	"time"
 
 	"github.com/gorilla/mux"
-	"github.com/gorilla/securecookie"
-	"github.com/gorilla/sessions"
 	"github.com/jhillyerd/inbucket/pkg/config"
 	"github.com/jhillyerd/inbucket/pkg/message"
 	"github.com/jhillyerd/inbucket/pkg/msghub"
@@ -36,7 +34,6 @@ var (
 	rootConfig     *config.Root
 	server         *http.Server
 	listener       net.Listener
-	sessionStore   sessions.Store
 	globalShutdown chan bool
 
 	// ExpWebSocketConnectsCurrent tracks the number of open WebSockets
@@ -94,17 +91,6 @@ func Initialize(
 		http.StatusNotFound, "No route matches URI path")
 	Router.MethodNotAllowedHandler = noMatchHandler(
 		http.StatusMethodNotAllowed, "Method not allowed for URI path")
-
-	// Session cookie setup.
-	if conf.Web.CookieAuthKey == "" {
-		log.Info().Str("module", "web").Str("phase", "startup").
-			Msg("Generating random cookie.auth.key")
-		sessionStore = sessions.NewCookieStore(securecookie.GenerateRandomKey(64))
-	} else {
-		log.Info().Str("module", "web").Str("phase", "startup").
-			Msg("Using configured cookie.auth.key")
-		sessionStore = sessions.NewCookieStore([]byte(conf.Web.CookieAuthKey))
-	}
 }
 
 // Start begins listening for HTTP requests

pkg/webui/mailbox_controller.go

@@ -1,6 +1,7 @@
 package webui
 
 import (
+	"errors"
 	"fmt"
 	"html/template"
 	"io"
@@ -147,19 +148,13 @@ func MailboxViewAttach(w http.ResponseWriter, req *http.Request, ctx *web.Contex
 	// Don't have to validate these aren't empty, Gorilla returns 404
 	name, err := ctx.Manager.MailboxForAddress(ctx.Vars["name"])
 	if err != nil {
-		ctx.Session.AddFlash(err.Error(), "errors")
-		_ = ctx.Session.Save(req, w)
-		http.Redirect(w, req, web.Reverse("RootIndex"), http.StatusSeeOther)
-		return nil
+		return err
 	}
 	id := ctx.Vars["id"]
 	numStr := ctx.Vars["num"]
 	num, err := strconv.ParseUint(numStr, 10, 32)
 	if err != nil {
-		ctx.Session.AddFlash("Attachment number must be unsigned numeric", "errors")
-		_ = ctx.Session.Save(req, w)
-		http.Redirect(w, req, web.Reverse("RootIndex"), http.StatusSeeOther)
-		return nil
+		return err
 	}
 	msg, err := ctx.Manager.GetMessage(name, id)
 	if err == storage.ErrNotExist {
@@ -171,10 +166,7 @@ func MailboxViewAttach(w http.ResponseWriter, req *http.Request, ctx *web.Contex
 		return fmt.Errorf("GetMessage(%q) failed: %v", id, err)
 	}
 	if int(num) >= len(msg.Attachments()) {
-		ctx.Session.AddFlash("Attachment number too high", "errors")
-		_ = ctx.Session.Save(req, w)
-		http.Redirect(w, req, web.Reverse("RootIndex"), http.StatusSeeOther)
-		return nil
+		return errors.New("requested attachment number does not exist")
 	}
 	// Output attachment
 	part := msg.Attachments()[num]

pkg/webui/recent.go

@@ -1,35 +0,0 @@
-package webui
-
-import (
-	"github.com/jhillyerd/inbucket/pkg/server/web"
-)
-
-const (
-	// maximum mailboxes to remember
-	maxRemembered = 8
-	// session value key; referenced in templates, do not change
-	mailboxKey = "recentMailboxes"
-)
-
-// RememberMailbox manages the list of recently accessed mailboxes stored in the session
-func RememberMailbox(ctx *web.Context, mailbox string) {
-	recent := RecentMailboxes(ctx)
-	newRecent := make([]string, 1, maxRemembered)
-	newRecent[0] = mailbox
-
-	for _, recBox := range recent {
-		// Insert until newRecent is full, but don't repeat the new mailbox
-		if len(newRecent) < maxRemembered && mailbox != recBox {
-			newRecent = append(newRecent, recBox)
-		}
-	}
-
-	ctx.Session.Values[mailboxKey] = newRecent
-}
-
-// RecentMailboxes returns a slice of the most recently accessed mailboxes
-func RecentMailboxes(ctx *web.Context) []string {
-	val := ctx.Session.Values[mailboxKey]
-	recent, _ := val.([]string)
-	return recent
-}