go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2024-11-28 09:08:44 +02:00
Code Issues Releases Activity

Rename CookieOptions to Cookie

Browse Source
This commit is contained in:
Joel Speed 2020-05-25 12:43:24 +01:00
parent 285c65a2d4
commit 211fd3a010
No known key found for this signature in database
GPG Key ID: 6E80578D6751DEFB
13 changed files with 72 additions and 72 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/apis/options/cookie.go
View File

@ -6,8 +6,8 @@ import (
"github.com/spf13/pflag"
)
// CookieOptions contains configuration options relating to Cookie configuration
type CookieOptions struct {
// Cookie contains configuration options relating to Cookie configuration
type Cookie struct {
Name string `flag:"cookie-name" cfg:"cookie_name"`
Secret string `flag:"cookie-secret" cfg:"cookie_secret"`
Domains []string `flag:"cookie-domain" cfg:"cookie_domains"`
@ -35,9 +35,9 @@ func cookieFlagSet() *pflag.FlagSet {
return flagSet
}
// defaultCookieOptions creates a CookieOptions populating each field with its default value
func defaultCookieOptions() CookieOptions {
return CookieOptions{
// cookieDefaults creates a Cookie populating each field with its default value
func cookieDefaults() Cookie {
return Cookie{
Name: "_oauth2_proxy",
Secret: "",
Domains: nil,

4
pkg/apis/options/options.go
View File

@ -59,7 +59,7 @@ type Options struct {
Banner string `flag:"banner" cfg:"banner"`
Footer string `flag:"footer" cfg:"footer"`
Cookie CookieOptions `cfg:",squash"`
Cookie Cookie `cfg:",squash"`
Session SessionOptions `cfg:",squash"`
Logging Logging `cfg:",squash"`
@ -153,7 +153,7 @@ func NewOptions() *Options {
RealClientIPHeader: "X-Real-IP",
ForceHTTPS: false,
DisplayHtpasswdForm: true,
Cookie: defaultCookieOptions(),
Cookie: cookieDefaults(),
Session: SessionOptions{
Type: "cookie",
},

2
pkg/cookies/cookies.go
View File

@ -38,7 +38,7 @@ func MakeCookie(req *http.Request, name string, value string, path string, domai
// MakeCookieFromOptions constructs a cookie based on the given *options.CookieOptions,
// value and creation time
func MakeCookieFromOptions(req *http.Request, name string, value string, cookieOpts *options.CookieOptions, expiration time.Duration, now time.Time) *http.Cookie {
func MakeCookieFromOptions(req *http.Request, name string, value string, cookieOpts *options.Cookie, expiration time.Duration, now time.Time) *http.Cookie {
domain := GetCookieDomain(req, cookieOpts.Domains)
if domain != "" {

24
pkg/sessions/cookie/session_store.go
View File

@ -28,8 +28,8 @@ var _ sessions.SessionStore = &SessionStore{}
// SessionStore is an implementation of the sessions.SessionStore
// interface that stores sessions in client side cookies
type SessionStore struct {
CookieOptions *options.CookieOptions
CookieCipher encryption.Cipher
Cookie *options.Cookie
CookieCipher encryption.Cipher
}
// Save takes a sessions.SessionState and stores the information from it
@ -50,12 +50,12 @@ func (s *SessionStore) Save(rw http.ResponseWriter, req *http.Request, ss *sessi
// Load reads sessions.SessionState information from Cookies within the
// HTTP request object
func (s *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {
c, err := loadCookie(req, s.CookieOptions.Name)
c, err := loadCookie(req, s.Cookie.Name)
if err != nil {
// always http.ErrNoCookie
return nil, fmt.Errorf("cookie %q not present", s.CookieOptions.Name)
return nil, fmt.Errorf("cookie %q not present", s.Cookie.Name)
}
val, _, ok := encryption.Validate(c, s.CookieOptions.Secret, s.CookieOptions.Expire)
val, _, ok := encryption.Validate(c, s.Cookie.Secret, s.Cookie.Expire)
if !ok {
return nil, errors.New("cookie signature not valid")
}
@ -71,7 +71,7 @@ func (s *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {
// clear the session
func (s *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) error {
// matches CookieName, CookieName_<number>
var cookieNameRegex = regexp.MustCompile(fmt.Sprintf("^%s(_\\d+)?$", s.CookieOptions.Name))
var cookieNameRegex = regexp.MustCompile(fmt.Sprintf("^%s(_\\d+)?$", s.Cookie.Name))
for _, c := range req.Cookies() {
if cookieNameRegex.MatchString(c.Name) {
@ -105,9 +105,9 @@ func (s *SessionStore) setSessionCookie(rw http.ResponseWriter, req *http.Reques
// authentication details
func (s *SessionStore) makeSessionCookie(req *http.Request, value string, now time.Time) []*http.Cookie {
if value != "" {
value = encryption.SignedValue(s.CookieOptions.Secret, s.CookieOptions.Name, []byte(value), now)
value = encryption.SignedValue(s.Cookie.Secret, s.Cookie.Name, []byte(value), now)
}
c := s.makeCookie(req, s.CookieOptions.Name, value, s.CookieOptions.Expire, now)
c := s.makeCookie(req, s.Cookie.Name, value, s.Cookie.Expire, now)
if len(c.String()) > maxCookieLength {
return splitCookie(c)
@ -120,7 +120,7 @@ func (s *SessionStore) makeCookie(req *http.Request, name string, value string,
req,
name,
value,
s.CookieOptions,
s.Cookie,
expiration,
now,
)
@ -128,15 +128,15 @@ func (s *SessionStore) makeCookie(req *http.Request, name string, value string,
// NewCookieSessionStore initialises a new instance of the SessionStore from
// the configuration given
func NewCookieSessionStore(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) {
func NewCookieSessionStore(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessions.SessionStore, error) {
cipher, err := encryption.NewBase64Cipher(encryption.NewCFBCipher, encryption.SecretBytes(cookieOpts.Secret))
if err != nil {
return nil, fmt.Errorf("error initialising cipher: %v", err)
}
return &SessionStore{
CookieCipher: cipher,
CookieOptions: cookieOpts,
CookieCipher: cipher,
Cookie: cookieOpts,
}, nil
}

2
pkg/sessions/cookie/session_store_test.go
View File

@ -25,7 +25,7 @@ func TestSessionStore(t *testing.T) {
var _ = Describe("Cookie SessionStore Tests", func() {
tests.RunSessionStoreTests(
func(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessionsapi.SessionStore, error) {
func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
// Set the connection URL
opts.Type = options.CookieSessionStoreType
return NewCookieSessionStore(opts, cookieOpts)

50
pkg/sessions/redis/redis_store.go
View File

@ -32,14 +32,14 @@ type TicketData struct {
// SessionStore is an implementation of the sessions.SessionStore
// interface that stores sessions in redis
type SessionStore struct {
CookieCipher encryption.Cipher
CookieOptions *options.CookieOptions
Client Client
CookieCipher encryption.Cipher
Cookie *options.Cookie
Client Client
}
// NewRedisSessionStore initialises a new instance of the SessionStore from
// the configuration given
func NewRedisSessionStore(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) {
func NewRedisSessionStore(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessions.SessionStore, error) {
cipher, err := encryption.NewBase64Cipher(encryption.NewCFBCipher, encryption.SecretBytes(cookieOpts.Secret))
if err != nil {
return nil, fmt.Errorf("error initialising cipher: %v", err)
@ -51,9 +51,9 @@ func NewRedisSessionStore(opts *options.SessionOptions, cookieOpts *options.Cook
}
rs := &SessionStore{
Client: client,
CookieCipher: cipher,
CookieOptions: cookieOpts,
Client: client,
CookieCipher: cipher,
Cookie: cookieOpts,
}
return rs, nil
@ -145,13 +145,13 @@ func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *se
// Old sessions that we are refreshing would have a request cookie
// New sessions don't, so we ignore the error. storeValue will check requestCookie
requestCookie, _ := req.Cookie(store.CookieOptions.Name)
requestCookie, _ := req.Cookie(store.Cookie.Name)
value, err := s.EncodeSessionState(store.CookieCipher)
if err != nil {
return err
}
ctx := req.Context()
ticketString, err := store.storeValue(ctx, value, store.CookieOptions.Expire, requestCookie)
ticketString, err := store.storeValue(ctx, value, store.Cookie.Expire, requestCookie)
if err != nil {
return err
}
@ -159,7 +159,7 @@ func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *se
ticketCookie := store.makeCookie(
req,
ticketString,
store.CookieOptions.Expire,
store.Cookie.Expire,
*s.CreatedAt,
)
@ -170,12 +170,12 @@ func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *se
// Load reads sessions.SessionState information from a ticket
// cookie within the HTTP request object
func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {
requestCookie, err := req.Cookie(store.CookieOptions.Name)
requestCookie, err := req.Cookie(store.Cookie.Name)
if err != nil {
return nil, fmt.Errorf("error loading session: %s", err)
}
val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.Secret, store.CookieOptions.Expire)
val, _, ok := encryption.Validate(requestCookie, store.Cookie.Secret, store.Cookie.Expire)
if !ok {
return nil, fmt.Errorf("cookie signature not valid")
}
@ -189,12 +189,12 @@ func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, erro
// loadSessionFromString loads the session based on the ticket value
func (store *SessionStore) loadSessionFromString(ctx context.Context, value string) (*sessions.SessionState, error) {
ticket, err := decodeTicket(store.CookieOptions.Name, value)
ticket, err := decodeTicket(store.Cookie.Name, value)
if err != nil {
return nil, err
}
resultBytes, err := store.Client.Get(ctx, ticket.asHandle(store.CookieOptions.Name))
resultBytes, err := store.Client.Get(ctx, ticket.asHandle(store.Cookie.Name))
if err != nil {
return nil, err
}
@ -227,7 +227,7 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
http.SetCookie(rw, clearCookie)
// If there was an existing cookie we should clear the session in redis
requestCookie, err := req.Cookie(store.CookieOptions.Name)
requestCookie, err := req.Cookie(store.Cookie.Name)
if err != nil && err == http.ErrNoCookie {
// No existing cookie so can't clear redis
return nil
@ -235,17 +235,17 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
return fmt.Errorf("error retrieving cookie: %v", err)
}
val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.Secret, store.CookieOptions.Expire)
val, _, ok := encryption.Validate(requestCookie, store.Cookie.Secret, store.Cookie.Expire)
if !ok {
return fmt.Errorf("cookie signature not valid")
}
// We only return an error if we had an issue with redis
// If there's an issue decoding the ticket, ignore it
ticket, _ := decodeTicket(store.CookieOptions.Name, string(val))
ticket, _ := decodeTicket(store.Cookie.Name, string(val))
if ticket != nil {
ctx := req.Context()
err := store.Client.Del(ctx, ticket.asHandle(store.CookieOptions.Name))
err := store.Client.Del(ctx, ticket.asHandle(store.Cookie.Name))
if err != nil {
return fmt.Errorf("error clearing cookie from redis: %s", err)
}
@ -256,13 +256,13 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
// makeCookie makes a cookie, signing the value if present
func (store *SessionStore) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) *http.Cookie {
if value != "" {
value = encryption.SignedValue(store.CookieOptions.Secret, store.CookieOptions.Name, []byte(value), now)
value = encryption.SignedValue(store.Cookie.Secret, store.Cookie.Name, []byte(value), now)
}
return cookies.MakeCookieFromOptions(
req,
store.CookieOptions.Name,
store.Cookie.Name,
value,
store.CookieOptions,
store.Cookie,
expires,
now,
)
@ -284,12 +284,12 @@ func (store *SessionStore) storeValue(ctx context.Context, value string, expirat
stream := cipher.NewCFBEncrypter(block, ticket.Secret)
stream.XORKeyStream(ciphertext, []byte(value))
handle := ticket.asHandle(store.CookieOptions.Name)
handle := ticket.asHandle(store.Cookie.Name)
err = store.Client.Set(ctx, handle, ciphertext, expiration)
if err != nil {
return "", err
}
return ticket.encodeTicket(store.CookieOptions.Name), nil
return ticket.encodeTicket(store.Cookie.Name), nil
}
// getTicket retrieves an existing ticket from the cookie if present,
@ -300,14 +300,14 @@ func (store *SessionStore) getTicket(requestCookie *http.Cookie) (*TicketData, e
}
// An existing cookie exists, try to retrieve the ticket
val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.Secret, store.CookieOptions.Expire)
val, _, ok := encryption.Validate(requestCookie, store.Cookie.Secret, store.Cookie.Expire)
if !ok {
// Cookie is invalid, create a new ticket
return newTicket()
}
// Valid cookie, decode the ticket
ticket, err := decodeTicket(store.CookieOptions.Name, string(val))
ticket, err := decodeTicket(store.Cookie.Name, string(val))
if err != nil {
// If we can't decode the ticket we have to create a new one
return newTicket()

6
pkg/sessions/redis/session_store_test.go
View File

@ -58,7 +58,7 @@ var _ = Describe("Redis SessionStore Tests", func() {
})
tests.RunSessionStoreTests(
func(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessionsapi.SessionStore, error) {
func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
// Set the connection URL
opts.Type = options.RedisSessionStoreType
opts.Redis.ConnectionURL = "redis://" + mr.Addr()
@ -87,7 +87,7 @@ var _ = Describe("Redis SessionStore Tests", func() {
})
tests.RunSessionStoreTests(
func(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessionsapi.SessionStore, error) {
func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
// Set the sentinel connection URL
sentinelAddr := "redis://" + ms.Addr()
opts.Type = options.RedisSessionStoreType
@ -109,7 +109,7 @@ var _ = Describe("Redis SessionStore Tests", func() {
Context("with cluster", func() {
tests.RunSessionStoreTests(
func(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessionsapi.SessionStore, error) {
func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
clusterAddr := "redis://" + mr.Addr()
opts.Type = options.RedisSessionStoreType
opts.Redis.ClusterConnectionURLs = []string{clusterAddr}

2
pkg/sessions/session_store.go
View File

@ -10,7 +10,7 @@ import (
)
// NewSessionStore creates a SessionStore from the provided configuration
func NewSessionStore(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) {
func NewSessionStore(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessions.SessionStore, error) {
switch opts.Type {
case options.CookieSessionStoreType:
return cookie.NewCookieSessionStore(opts, cookieOpts)

4
pkg/sessions/session_store_test.go
View File

@ -24,7 +24,7 @@ func TestSessionStore(t *testing.T) {
var _ = Describe("NewSessionStore", func() {
var opts *options.SessionOptions
var cookieOpts *options.CookieOptions
var cookieOpts *options.Cookie
BeforeEach(func() {
opts = &options.SessionOptions{}
@ -36,7 +36,7 @@ var _ = Describe("NewSessionStore", func() {
Expect(err).ToNot(HaveOccurred())
// Set default options in CookieOptions
cookieOpts = &options.CookieOptions{
cookieOpts = &options.Cookie{
Name: "_oauth2_proxy",
Secret: base64.URLEncoding.EncodeToString(secret),
Path: "/",

8
pkg/sessions/tests/session_store_tests.go
View File

@ -21,7 +21,7 @@ import (
// Ginkgo has unpacked the tests.
// Interfaces have to be wrapped in closures otherwise nil pointers are thrown.
type testInput struct {
cookieOpts *options.CookieOptions
cookieOpts *options.Cookie
ss sessionStoreFunc
session *sessionsapi.SessionState
request *http.Request
@ -38,7 +38,7 @@ type PersistentStoreFastForwardFunc func(time.Duration) error
// NewSessionStoreFunc allows any session store implementation to configure their
// own session store before each test.
type NewSessionStoreFunc func(sessionOpts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessionsapi.SessionStore, error)
type NewSessionStoreFunc func(sessionOpts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error)
func RunSessionStoreTests(newSS NewSessionStoreFunc, persistentFastForward PersistentStoreFastForwardFunc) {
Describe("Session Store Suite", func() {
@ -62,7 +62,7 @@ func RunSessionStoreTests(newSS NewSessionStoreFunc, persistentFastForward Persi
Expect(err).ToNot(HaveOccurred())
// Set default options in CookieOptions
cookieOpts := &options.CookieOptions{
cookieOpts := &options.Cookie{
Name: "_oauth2_proxy",
Path: "/",
Expire: time.Duration(168) * time.Hour,
@ -111,7 +111,7 @@ func RunSessionStoreTests(newSS NewSessionStoreFunc, persistentFastForward Persi
Context("with non-default options", func() {
BeforeEach(func() {
input.cookieOpts = &options.CookieOptions{
input.cookieOpts = &options.Cookie{
Name: "_cookie_name",
Path: "/path",
Expire: time.Duration(72) * time.Hour,

2
pkg/validation/cookie.go
View File

@ -9,7 +9,7 @@ import (
"github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"
)
func validateCookieOptions(o options.CookieOptions) []string {
func validateCookie(o options.Cookie) []string {
msgs := validateCookieSecret(o.Secret)
if o.Refresh >= o.Expire {

28
pkg/validation/cookie_test.go
View File

@ -33,12 +33,12 @@ func TestValidateCookie(t *testing.T) {
testCases := []struct {
name string
cookie options.CookieOptions
cookie options.Cookie
errStrings []string
}{
{
name: "with valid configuration",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: validName,
Secret: validSecret,
Domains: domains,
@ -53,7 +53,7 @@ func TestValidateCookie(t *testing.T) {
},
{
name: "with no cookie secret",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: validName,
Secret: "",
Domains: emptyDomains,
@ -70,7 +70,7 @@ func TestValidateCookie(t *testing.T) {
},
{
name: "with an invalid cookie secret",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: validName,
Secret: invalidSecret,
Domains: emptyDomains,
@ -87,7 +87,7 @@ func TestValidateCookie(t *testing.T) {
},
{
name: "with a valid Base64 secret",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: validName,
Secret: validBase64Secret,
Domains: emptyDomains,
@ -102,7 +102,7 @@ func TestValidateCookie(t *testing.T) {
},
{
name: "with an invalid Base64 secret",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: validName,
Secret: invalidBase64Secret,
Domains: emptyDomains,
@ -119,7 +119,7 @@ func TestValidateCookie(t *testing.T) {
},
{
name: "with an invalid name",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: invalidName,
Secret: validSecret,
Domains: emptyDomains,
@ -136,7 +136,7 @@ func TestValidateCookie(t *testing.T) {
},
{
name: "with refresh longer than expire",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: validName,
Secret: validSecret,
Domains: emptyDomains,
@ -153,7 +153,7 @@ func TestValidateCookie(t *testing.T) {
},
{
name: "with samesite \"none\"",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: validName,
Secret: validSecret,
Domains: emptyDomains,
@ -168,7 +168,7 @@ func TestValidateCookie(t *testing.T) {
},
{
name: "with samesite \"lax\"",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: validName,
Secret: validSecret,
Domains: emptyDomains,
@ -183,7 +183,7 @@ func TestValidateCookie(t *testing.T) {
},
{
name: "with samesite \"strict\"",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: validName,
Secret: validSecret,
Domains: emptyDomains,
@ -198,7 +198,7 @@ func TestValidateCookie(t *testing.T) {
},
{
name: "with samesite \"invalid\"",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: validName,
Secret: validSecret,
Domains: emptyDomains,
@ -215,7 +215,7 @@ func TestValidateCookie(t *testing.T) {
},
{
name: "with a combination of configuration errors",
cookie: options.CookieOptions{
cookie: options.Cookie{
Name: invalidName,
Secret: invalidSecret,
Domains: domains,
@ -237,7 +237,7 @@ func TestValidateCookie(t *testing.T) {
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
errStrings := validateCookieOptions(tc.cookie)
errStrings := validateCookie(tc.cookie)
g := NewWithT(t)
g.Expect(errStrings).To(ConsistOf(tc.errStrings))

2
pkg/validation/options.go
View File

@ -26,7 +26,7 @@ import (
// Validate checks that required options are set and validates those that they
// are of the correct format
func Validate(o *options.Options) error {
msgs := validateCookieOptions(o.Cookie)
msgs := validateCookie(o.Cookie)
if o.SSLInsecureSkipVerify {
insecureTransport := &http.Transport{