Incorrect use of session object will cause requests to compete with each other and create security vulnerability

[AvedisBaghdasarian]

duo_universal_golang/example/main.go

Line 33 in 0c2571f

session := Session{}

session := Session{} is scoped to main(). If two users attempt to authenticate at the same time, the session object will be overwritten causing login failure for the first person.

func (session *Session) login(w http.ResponseWriter, r *http.Request, c *duouniversal.Client) {
...
		// Step 4: Generate and save a state variable
		session.duoState, err = c.GenerateState()
		if err != nil {
			log.Fatal("Error generating state: ", err)
		}

Please use something like gorrillas sessions package to manage duoState for each pre-auth session. I'm a bit busy right now but if I get some time I'll PR the right way of doing it.

https://pkg.go.dev/github.com/gorilla/sessions

[AvedisBaghdasarian]

Additionally, in this method, anyone with the correct callback url will aquire the user credentials, even if that url is all they, and they do not have the password.

If you use a preauth session like I suggest then you will have to posture an encrypted cookie holding the username and duostate, guarunteeing that you are the one who authenticated