From 171d4ac77cef3563d6ec526cf9407702dbcfac5e Mon Sep 17 00:00:00 2001 From: James Royal Date: Mon, 17 Apr 2023 10:42:50 -0500 Subject: [PATCH] AUTH-3122 Verify that Access tokens are still valid in curl command Before this change, the only sure fire way to make sure you had a valid Access token was to run `cloudflared access login `. That was because that command would actually make a preflight request to ensure that the edge considered that token valid. The most common reasons a token was no longer valid was expiration and revocation. Expiration is easy to check client side, but revocation can only be checked at the edge. This change adds the same flow that cfd access login did to the curl command. It will preflight the request with the token and ensure that the edge thinks its valid before making the real request. --- cmd/cloudflared/access/cmd.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/cmd/cloudflared/access/cmd.go b/cmd/cloudflared/access/cmd.go index 6fec29f9..687e0165 100644 --- a/cmd/cloudflared/access/cmd.go +++ b/cmd/cloudflared/access/cmd.go @@ -280,6 +280,13 @@ func curl(c *cli.Context) error { if err != nil { return err } + + // Verify that the existing token is still good; if not fetch a new one + if err := verifyTokenAtEdge(appURL, appInfo, c, log); err != nil { + log.Err(err).Msg("Could not verify token") + return err + } + tok, err := token.GetAppTokenIfExists(appInfo) if err != nil || tok == "" { if allowRequest {