Refactor the login handler

The login handler is now a simpler, standalone http.Handler wrapper. The separation between the SSO application and the login handler is now fairly complete.

The login handler no longer forces the user to a specific workflow via session cookies, but it works on a request-by-request basis instead, which makes the "back" button works as expected (allowing the user to bail out of a broken 2FA process, for example).

Session handling has been simplified as well: there is a single session for authentication and login state, which should remove the opportunity for session synchronization errors.

server/http.go

@@ -122,6 +122,13 @@ func New(loginService *LoginService, authClient authclient.Client, config *Confi
 			return nil, err
 		}
 		root.Handle(h.urlFor("/favicon.ico"), siteFavicon)
+	} else if urlPrefix == "" {
+		// Block default favicon requests (created by error pages, or
+		// if we don't set a custom favicon) *before* the login
+		// handler runs, or it will invalidate the session!
+		root.HandleFunc(h.urlFor("/favicon.ico"), func(w http.ResponseWriter, r *http.Request) {
+			http.NotFound(w, r)
+		})
 	}
 
 	// Serve static content to anyone.
@@ -212,6 +219,13 @@ func (h *Server) loginCallback(ctx context.Context, username, password string, u
 // signing a token with the user's identity. The client is redirected back to
 // the original service, with the signed token.
 func (h *Server) handleGrantTicket(w http.ResponseWriter, req *http.Request) {
+	// We need this check here because this handler is usually
+	// mounted at the application root.
+	if req.URL.Path != h.urlFor("/") {
+		http.NotFound(w, req)
+		return
+	}
+
 	// Extract the authorization request parameters from the HTTP
 	// request query args.
 	//
@@ -380,15 +394,6 @@ func parseEmbeddedTemplates() *template.Template {
 	return root
 }
 
-// Template helper function that encodes its input as JSON.
-func toJSON(obj interface{}) string {
-	data, err := json.Marshal(obj)
-	if err != nil {
-		return ""
-	}
-	return string(data)
-}
-
 func sl2bl(sl []string) [][]byte {
 	var out [][]byte
 	for _, s := range sl {
@@ -424,6 +429,15 @@ func intersectGroups(a, b []string) []string {
 	return out
 }
 
+// Template helper function that encodes its input as JSON.
+func toJSON(obj interface{}) string {
+	data, err := json.Marshal(obj)
+	if err != nil {
+		return ""
+	}
+	return string(data)
+}
+
 // Return an integrity= attribute for the given URI (which should be
 // supplied without an eventual prefix).
 func sriIntegrity(uri string) template.HTML {