go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-04-21 12:17:22 +02:00
Code Issues Releases Activity

Rename CookieOptions to Cookie

Browse Source
This commit is contained in:
Joel Speed 2020-05-25 12:43:24 +01:00
parent 285c65a2d4
commit 211fd3a010
No known key found for this signature in database
GPG Key ID: 6E80578D6751DEFB
13 changed files with 72 additions and 72 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/apis/options/cookie.go
View File

@ -6,8 +6,8 @@ import (
"github.com/spf13/pflag" "github.com/spf13/pflag"
) )
// CookieOptions contains configuration options relating to Cookie configuration // Cookie contains configuration options relating to Cookie configuration
type CookieOptions struct { type Cookie struct {
Name string `flag:"cookie-name" cfg:"cookie_name"` Name string `flag:"cookie-name" cfg:"cookie_name"`
Secret string `flag:"cookie-secret" cfg:"cookie_secret"` Secret string `flag:"cookie-secret" cfg:"cookie_secret"`
Domains []string `flag:"cookie-domain" cfg:"cookie_domains"` Domains []string `flag:"cookie-domain" cfg:"cookie_domains"`
@ -35,9 +35,9 @@ func cookieFlagSet() *pflag.FlagSet {
return flagSet return flagSet
} }
// defaultCookieOptions creates a CookieOptions populating each field with its default value // cookieDefaults creates a Cookie populating each field with its default value
func defaultCookieOptions() CookieOptions { func cookieDefaults() Cookie {
return CookieOptions{ return Cookie{
Name: "_oauth2_proxy", Name: "_oauth2_proxy",
Secret: "", Secret: "",
Domains: nil, Domains: nil,

4
pkg/apis/options/options.go
View File

@ -59,7 +59,7 @@ type Options struct {
Banner string `flag:"banner" cfg:"banner"` Banner string `flag:"banner" cfg:"banner"`
Footer string `flag:"footer" cfg:"footer"` Footer string `flag:"footer" cfg:"footer"`
Cookie CookieOptions `cfg:",squash"` Cookie Cookie `cfg:",squash"`
Session SessionOptions `cfg:",squash"` Session SessionOptions `cfg:",squash"`
Logging Logging `cfg:",squash"` Logging Logging `cfg:",squash"`
@ -153,7 +153,7 @@ func NewOptions() *Options {
RealClientIPHeader: "X-Real-IP", RealClientIPHeader: "X-Real-IP",
ForceHTTPS: false, ForceHTTPS: false,
DisplayHtpasswdForm: true, DisplayHtpasswdForm: true,
Cookie: defaultCookieOptions(), Cookie: cookieDefaults(),
Session: SessionOptions{ Session: SessionOptions{
Type: "cookie", Type: "cookie",
}, },

2
pkg/cookies/cookies.go
View File

@ -38,7 +38,7 @@ func MakeCookie(req *http.Request, name string, value string, path string, domai
// MakeCookieFromOptions constructs a cookie based on the given *options.CookieOptions, // MakeCookieFromOptions constructs a cookie based on the given *options.CookieOptions,
// value and creation time // value and creation time
func MakeCookieFromOptions(req *http.Request, name string, value string, cookieOpts *options.CookieOptions, expiration time.Duration, now time.Time) *http.Cookie { func MakeCookieFromOptions(req *http.Request, name string, value string, cookieOpts *options.Cookie, expiration time.Duration, now time.Time) *http.Cookie {
domain := GetCookieDomain(req, cookieOpts.Domains) domain := GetCookieDomain(req, cookieOpts.Domains)
if domain != "" { if domain != "" {

24
pkg/sessions/cookie/session_store.go
View File

@ -28,8 +28,8 @@ var _ sessions.SessionStore = &SessionStore{}
// SessionStore is an implementation of the sessions.SessionStore // SessionStore is an implementation of the sessions.SessionStore
// interface that stores sessions in client side cookies // interface that stores sessions in client side cookies
type SessionStore struct { type SessionStore struct {
CookieOptions *options.CookieOptions Cookie *options.Cookie
CookieCipher encryption.Cipher CookieCipher encryption.Cipher
} }
// Save takes a sessions.SessionState and stores the information from it // Save takes a sessions.SessionState and stores the information from it
@ -50,12 +50,12 @@ func (s *SessionStore) Save(rw http.ResponseWriter, req *http.Request, ss *sessi
// Load reads sessions.SessionState information from Cookies within the // Load reads sessions.SessionState information from Cookies within the
// HTTP request object // HTTP request object
func (s *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) { func (s *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {
c, err := loadCookie(req, s.CookieOptions.Name) c, err := loadCookie(req, s.Cookie.Name)
if err != nil { if err != nil {
// always http.ErrNoCookie // always http.ErrNoCookie
return nil, fmt.Errorf("cookie %q not present", s.CookieOptions.Name) return nil, fmt.Errorf("cookie %q not present", s.Cookie.Name)
} }
val, _, ok := encryption.Validate(c, s.CookieOptions.Secret, s.CookieOptions.Expire) val, _, ok := encryption.Validate(c, s.Cookie.Secret, s.Cookie.Expire)
if !ok { if !ok {
return nil, errors.New("cookie signature not valid") return nil, errors.New("cookie signature not valid")
} }
@ -71,7 +71,7 @@ func (s *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {
// clear the session // clear the session
func (s *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) error { func (s *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) error {
// matches CookieName, CookieName_<number> // matches CookieName, CookieName_<number>
var cookieNameRegex = regexp.MustCompile(fmt.Sprintf("^%s(_\\d+)?$", s.CookieOptions.Name)) var cookieNameRegex = regexp.MustCompile(fmt.Sprintf("^%s(_\\d+)?$", s.Cookie.Name))
for _, c := range req.Cookies() { for _, c := range req.Cookies() {
if cookieNameRegex.MatchString(c.Name) { if cookieNameRegex.MatchString(c.Name) {
@ -105,9 +105,9 @@ func (s *SessionStore) setSessionCookie(rw http.ResponseWriter, req *http.Reques
// authentication details // authentication details
func (s *SessionStore) makeSessionCookie(req *http.Request, value string, now time.Time) []*http.Cookie { func (s *SessionStore) makeSessionCookie(req *http.Request, value string, now time.Time) []*http.Cookie {
if value != "" { if value != "" {
value = encryption.SignedValue(s.CookieOptions.Secret, s.CookieOptions.Name, []byte(value), now) value = encryption.SignedValue(s.Cookie.Secret, s.Cookie.Name, []byte(value), now)
} }
c := s.makeCookie(req, s.CookieOptions.Name, value, s.CookieOptions.Expire, now) c := s.makeCookie(req, s.Cookie.Name, value, s.Cookie.Expire, now)
if len(c.String()) > maxCookieLength { if len(c.String()) > maxCookieLength {
return splitCookie(c) return splitCookie(c)
@ -120,7 +120,7 @@ func (s *SessionStore) makeCookie(req *http.Request, name string, value string,
req, req,
name, name,
value, value,
s.CookieOptions, s.Cookie,
expiration, expiration,
now, now,
) )
@ -128,15 +128,15 @@ func (s *SessionStore) makeCookie(req *http.Request, name string, value string,
// NewCookieSessionStore initialises a new instance of the SessionStore from // NewCookieSessionStore initialises a new instance of the SessionStore from
// the configuration given // the configuration given
func NewCookieSessionStore(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) { func NewCookieSessionStore(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessions.SessionStore, error) {
cipher, err := encryption.NewBase64Cipher(encryption.NewCFBCipher, encryption.SecretBytes(cookieOpts.Secret)) cipher, err := encryption.NewBase64Cipher(encryption.NewCFBCipher, encryption.SecretBytes(cookieOpts.Secret))
if err != nil { if err != nil {
return nil, fmt.Errorf("error initialising cipher: %v", err) return nil, fmt.Errorf("error initialising cipher: %v", err)
} }
return &SessionStore{ return &SessionStore{
CookieCipher: cipher, CookieCipher: cipher,
CookieOptions: cookieOpts, Cookie: cookieOpts,
}, nil }, nil
} }

2
pkg/sessions/cookie/session_store_test.go
View File

@ -25,7 +25,7 @@ func TestSessionStore(t *testing.T) {
var _ = Describe("Cookie SessionStore Tests", func() { var _ = Describe("Cookie SessionStore Tests", func() {
tests.RunSessionStoreTests( tests.RunSessionStoreTests(
func(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessionsapi.SessionStore, error) { func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
// Set the connection URL // Set the connection URL
opts.Type = options.CookieSessionStoreType opts.Type = options.CookieSessionStoreType
return NewCookieSessionStore(opts, cookieOpts) return NewCookieSessionStore(opts, cookieOpts)

50
pkg/sessions/redis/redis_store.go
View File

@ -32,14 +32,14 @@ type TicketData struct {
// SessionStore is an implementation of the sessions.SessionStore // SessionStore is an implementation of the sessions.SessionStore
// interface that stores sessions in redis // interface that stores sessions in redis
type SessionStore struct { type SessionStore struct {
CookieCipher encryption.Cipher CookieCipher encryption.Cipher
CookieOptions *options.CookieOptions Cookie *options.Cookie
Client Client Client Client
} }
// NewRedisSessionStore initialises a new instance of the SessionStore from // NewRedisSessionStore initialises a new instance of the SessionStore from
// the configuration given // the configuration given
func NewRedisSessionStore(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) { func NewRedisSessionStore(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessions.SessionStore, error) {
cipher, err := encryption.NewBase64Cipher(encryption.NewCFBCipher, encryption.SecretBytes(cookieOpts.Secret)) cipher, err := encryption.NewBase64Cipher(encryption.NewCFBCipher, encryption.SecretBytes(cookieOpts.Secret))
if err != nil { if err != nil {
return nil, fmt.Errorf("error initialising cipher: %v", err) return nil, fmt.Errorf("error initialising cipher: %v", err)
@ -51,9 +51,9 @@ func NewRedisSessionStore(opts *options.SessionOptions, cookieOpts *options.Cook
} }
rs := &SessionStore{ rs := &SessionStore{
Client: client, Client: client,
CookieCipher: cipher, CookieCipher: cipher,
CookieOptions: cookieOpts, Cookie: cookieOpts,
} }
return rs, nil return rs, nil
@ -145,13 +145,13 @@ func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *se
// Old sessions that we are refreshing would have a request cookie // Old sessions that we are refreshing would have a request cookie
// New sessions don't, so we ignore the error. storeValue will check requestCookie // New sessions don't, so we ignore the error. storeValue will check requestCookie
requestCookie, _ := req.Cookie(store.CookieOptions.Name) requestCookie, _ := req.Cookie(store.Cookie.Name)
value, err := s.EncodeSessionState(store.CookieCipher) value, err := s.EncodeSessionState(store.CookieCipher)
if err != nil { if err != nil {
return err return err
} }
ctx := req.Context() ctx := req.Context()
ticketString, err := store.storeValue(ctx, value, store.CookieOptions.Expire, requestCookie) ticketString, err := store.storeValue(ctx, value, store.Cookie.Expire, requestCookie)
if err != nil { if err != nil {
return err return err
} }
@ -159,7 +159,7 @@ func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *se
ticketCookie := store.makeCookie( ticketCookie := store.makeCookie(
req, req,
ticketString, ticketString,
store.CookieOptions.Expire, store.Cookie.Expire,
*s.CreatedAt, *s.CreatedAt,
) )
@ -170,12 +170,12 @@ func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *se
// Load reads sessions.SessionState information from a ticket // Load reads sessions.SessionState information from a ticket
// cookie within the HTTP request object // cookie within the HTTP request object
func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) { func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {
requestCookie, err := req.Cookie(store.CookieOptions.Name) requestCookie, err := req.Cookie(store.Cookie.Name)
if err != nil { if err != nil {
return nil, fmt.Errorf("error loading session: %s", err) return nil, fmt.Errorf("error loading session: %s", err)
} }
val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.Secret, store.CookieOptions.Expire) val, _, ok := encryption.Validate(requestCookie, store.Cookie.Secret, store.Cookie.Expire)
if !ok { if !ok {
return nil, fmt.Errorf("cookie signature not valid") return nil, fmt.Errorf("cookie signature not valid")
} }
@ -189,12 +189,12 @@ func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, erro
// loadSessionFromString loads the session based on the ticket value // loadSessionFromString loads the session based on the ticket value
func (store *SessionStore) loadSessionFromString(ctx context.Context, value string) (*sessions.SessionState, error) { func (store *SessionStore) loadSessionFromString(ctx context.Context, value string) (*sessions.SessionState, error) {
ticket, err := decodeTicket(store.CookieOptions.Name, value) ticket, err := decodeTicket(store.Cookie.Name, value)
if err != nil { if err != nil {
return nil, err return nil, err
} }
resultBytes, err := store.Client.Get(ctx, ticket.asHandle(store.CookieOptions.Name)) resultBytes, err := store.Client.Get(ctx, ticket.asHandle(store.Cookie.Name))
if err != nil { if err != nil {
return nil, err return nil, err
} }
@ -227,7 +227,7 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
http.SetCookie(rw, clearCookie) http.SetCookie(rw, clearCookie)
// If there was an existing cookie we should clear the session in redis // If there was an existing cookie we should clear the session in redis
requestCookie, err := req.Cookie(store.CookieOptions.Name) requestCookie, err := req.Cookie(store.Cookie.Name)
if err != nil && err == http.ErrNoCookie { if err != nil && err == http.ErrNoCookie {
// No existing cookie so can't clear redis // No existing cookie so can't clear redis
return nil return nil
@ -235,17 +235,17 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
return fmt.Errorf("error retrieving cookie: %v", err) return fmt.Errorf("error retrieving cookie: %v", err)
} }
val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.Secret, store.CookieOptions.Expire) val, _, ok := encryption.Validate(requestCookie, store.Cookie.Secret, store.Cookie.Expire)
if !ok { if !ok {
return fmt.Errorf("cookie signature not valid") return fmt.Errorf("cookie signature not valid")
} }
// We only return an error if we had an issue with redis // We only return an error if we had an issue with redis
// If there's an issue decoding the ticket, ignore it // If there's an issue decoding the ticket, ignore it
ticket, _ := decodeTicket(store.CookieOptions.Name, string(val)) ticket, _ := decodeTicket(store.Cookie.Name, string(val))
if ticket != nil { if ticket != nil {
ctx := req.Context() ctx := req.Context()
err := store.Client.Del(ctx, ticket.asHandle(store.CookieOptions.Name)) err := store.Client.Del(ctx, ticket.asHandle(store.Cookie.Name))
if err != nil { if err != nil {
return fmt.Errorf("error clearing cookie from redis: %s", err) return fmt.Errorf("error clearing cookie from redis: %s", err)
} }
@ -256,13 +256,13 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
// makeCookie makes a cookie, signing the value if present // makeCookie makes a cookie, signing the value if present
func (store *SessionStore) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) *http.Cookie { func (store *SessionStore) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) *http.Cookie {
if value != "" { if value != "" {
value = encryption.SignedValue(store.CookieOptions.Secret, store.CookieOptions.Name, []byte(value), now) value = encryption.SignedValue(store.Cookie.Secret, store.Cookie.Name, []byte(value), now)
} }
return cookies.MakeCookieFromOptions( return cookies.MakeCookieFromOptions(
req, req,
store.CookieOptions.Name, store.Cookie.Name,
value, value,
store.CookieOptions, store.Cookie,
expires, expires,
now, now,
) )
@ -284,12 +284,12 @@ func (store *SessionStore) storeValue(ctx context.Context, value string, expirat
stream := cipher.NewCFBEncrypter(block, ticket.Secret) stream := cipher.NewCFBEncrypter(block, ticket.Secret)
stream.XORKeyStream(ciphertext, []byte(value)) stream.XORKeyStream(ciphertext, []byte(value))
handle := ticket.asHandle(store.CookieOptions.Name) handle := ticket.asHandle(store.Cookie.Name)
err = store.Client.Set(ctx, handle, ciphertext, expiration) err = store.Client.Set(ctx, handle, ciphertext, expiration)
if err != nil { if err != nil {
return "", err return "", err
} }
return ticket.encodeTicket(store.CookieOptions.Name), nil return ticket.encodeTicket(store.Cookie.Name), nil
} }
// getTicket retrieves an existing ticket from the cookie if present, // getTicket retrieves an existing ticket from the cookie if present,
@ -300,14 +300,14 @@ func (store *SessionStore) getTicket(requestCookie *http.Cookie) (*TicketData, e
} }
// An existing cookie exists, try to retrieve the ticket // An existing cookie exists, try to retrieve the ticket
val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.Secret, store.CookieOptions.Expire) val, _, ok := encryption.Validate(requestCookie, store.Cookie.Secret, store.Cookie.Expire)
if !ok { if !ok {
// Cookie is invalid, create a new ticket // Cookie is invalid, create a new ticket
return newTicket() return newTicket()
} }
// Valid cookie, decode the ticket // Valid cookie, decode the ticket
ticket, err := decodeTicket(store.CookieOptions.Name, string(val)) ticket, err := decodeTicket(store.Cookie.Name, string(val))
if err != nil { if err != nil {
// If we can't decode the ticket we have to create a new one // If we can't decode the ticket we have to create a new one
return newTicket() return newTicket()

6
pkg/sessions/redis/session_store_test.go
View File

@ -58,7 +58,7 @@ var _ = Describe("Redis SessionStore Tests", func() {
}) })
tests.RunSessionStoreTests( tests.RunSessionStoreTests(
func(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessionsapi.SessionStore, error) { func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
// Set the connection URL // Set the connection URL
opts.Type = options.RedisSessionStoreType opts.Type = options.RedisSessionStoreType
opts.Redis.ConnectionURL = "redis://" + mr.Addr() opts.Redis.ConnectionURL = "redis://" + mr.Addr()
@ -87,7 +87,7 @@ var _ = Describe("Redis SessionStore Tests", func() {
}) })
tests.RunSessionStoreTests( tests.RunSessionStoreTests(
func(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessionsapi.SessionStore, error) { func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
// Set the sentinel connection URL // Set the sentinel connection URL
sentinelAddr := "redis://" + ms.Addr() sentinelAddr := "redis://" + ms.Addr()
opts.Type = options.RedisSessionStoreType opts.Type = options.RedisSessionStoreType
@ -109,7 +109,7 @@ var _ = Describe("Redis SessionStore Tests", func() {
Context("with cluster", func() { Context("with cluster", func() {
tests.RunSessionStoreTests( tests.RunSessionStoreTests(
func(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessionsapi.SessionStore, error) { func(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error) {
clusterAddr := "redis://" + mr.Addr() clusterAddr := "redis://" + mr.Addr()
opts.Type = options.RedisSessionStoreType opts.Type = options.RedisSessionStoreType
opts.Redis.ClusterConnectionURLs = []string{clusterAddr} opts.Redis.ClusterConnectionURLs = []string{clusterAddr}

2
pkg/sessions/session_store.go
View File

@ -10,7 +10,7 @@ import (
) )
// NewSessionStore creates a SessionStore from the provided configuration // NewSessionStore creates a SessionStore from the provided configuration
func NewSessionStore(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) { func NewSessionStore(opts *options.SessionOptions, cookieOpts *options.Cookie) (sessions.SessionStore, error) {
switch opts.Type { switch opts.Type {
case options.CookieSessionStoreType: case options.CookieSessionStoreType:
return cookie.NewCookieSessionStore(opts, cookieOpts) return cookie.NewCookieSessionStore(opts, cookieOpts)

4
pkg/sessions/session_store_test.go
View File

@ -24,7 +24,7 @@ func TestSessionStore(t *testing.T) {
var _ = Describe("NewSessionStore", func() { var _ = Describe("NewSessionStore", func() {
var opts *options.SessionOptions var opts *options.SessionOptions
var cookieOpts *options.CookieOptions var cookieOpts *options.Cookie
BeforeEach(func() { BeforeEach(func() {
opts = &options.SessionOptions{} opts = &options.SessionOptions{}
@ -36,7 +36,7 @@ var _ = Describe("NewSessionStore", func() {
Expect(err).ToNot(HaveOccurred()) Expect(err).ToNot(HaveOccurred())
// Set default options in CookieOptions // Set default options in CookieOptions
cookieOpts = &options.CookieOptions{ cookieOpts = &options.Cookie{
Name: "_oauth2_proxy", Name: "_oauth2_proxy",
Secret: base64.URLEncoding.EncodeToString(secret), Secret: base64.URLEncoding.EncodeToString(secret),
Path: "/", Path: "/",

8
pkg/sessions/tests/session_store_tests.go
View File

@ -21,7 +21,7 @@ import (
// Ginkgo has unpacked the tests. // Ginkgo has unpacked the tests.
// Interfaces have to be wrapped in closures otherwise nil pointers are thrown. // Interfaces have to be wrapped in closures otherwise nil pointers are thrown.
type testInput struct { type testInput struct {
cookieOpts *options.CookieOptions cookieOpts *options.Cookie
ss sessionStoreFunc ss sessionStoreFunc
session *sessionsapi.SessionState session *sessionsapi.SessionState
request *http.Request request *http.Request
@ -38,7 +38,7 @@ type PersistentStoreFastForwardFunc func(time.Duration) error
// NewSessionStoreFunc allows any session store implementation to configure their // NewSessionStoreFunc allows any session store implementation to configure their
// own session store before each test. // own session store before each test.
type NewSessionStoreFunc func(sessionOpts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessionsapi.SessionStore, error) type NewSessionStoreFunc func(sessionOpts *options.SessionOptions, cookieOpts *options.Cookie) (sessionsapi.SessionStore, error)
func RunSessionStoreTests(newSS NewSessionStoreFunc, persistentFastForward PersistentStoreFastForwardFunc) { func RunSessionStoreTests(newSS NewSessionStoreFunc, persistentFastForward PersistentStoreFastForwardFunc) {
Describe("Session Store Suite", func() { Describe("Session Store Suite", func() {
@ -62,7 +62,7 @@ func RunSessionStoreTests(newSS NewSessionStoreFunc, persistentFastForward Persi
Expect(err).ToNot(HaveOccurred()) Expect(err).ToNot(HaveOccurred())
// Set default options in CookieOptions // Set default options in CookieOptions
cookieOpts := &options.CookieOptions{ cookieOpts := &options.Cookie{
Name: "_oauth2_proxy", Name: "_oauth2_proxy",
Path: "/", Path: "/",
Expire: time.Duration(168) * time.Hour, Expire: time.Duration(168) * time.Hour,
@ -111,7 +111,7 @@ func RunSessionStoreTests(newSS NewSessionStoreFunc, persistentFastForward Persi
Context("with non-default options", func() { Context("with non-default options", func() {
BeforeEach(func() { BeforeEach(func() {
input.cookieOpts = &options.CookieOptions{ input.cookieOpts = &options.Cookie{
Name: "_cookie_name", Name: "_cookie_name",
Path: "/path", Path: "/path",
Expire: time.Duration(72) * time.Hour, Expire: time.Duration(72) * time.Hour,

2
pkg/validation/cookie.go
View File

@ -9,7 +9,7 @@ import (
"github.com/oauth2-proxy/oauth2-proxy/pkg/encryption" "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"
) )
func validateCookieOptions(o options.CookieOptions) []string { func validateCookie(o options.Cookie) []string {
msgs := validateCookieSecret(o.Secret) msgs := validateCookieSecret(o.Secret)
if o.Refresh >= o.Expire { if o.Refresh >= o.Expire {

28
pkg/validation/cookie_test.go
View File

@ -33,12 +33,12 @@ func TestValidateCookie(t *testing.T) {
testCases := []struct { testCases := []struct {
name string name string
cookie options.CookieOptions cookie options.Cookie
errStrings []string errStrings []string
}{ }{
{ {
name: "with valid configuration", name: "with valid configuration",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: validName, Name: validName,
Secret: validSecret, Secret: validSecret,
Domains: domains, Domains: domains,
@ -53,7 +53,7 @@ func TestValidateCookie(t *testing.T) {
}, },
{ {
name: "with no cookie secret", name: "with no cookie secret",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: validName, Name: validName,
Secret: "", Secret: "",
Domains: emptyDomains, Domains: emptyDomains,
@ -70,7 +70,7 @@ func TestValidateCookie(t *testing.T) {
}, },
{ {
name: "with an invalid cookie secret", name: "with an invalid cookie secret",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: validName, Name: validName,
Secret: invalidSecret, Secret: invalidSecret,
Domains: emptyDomains, Domains: emptyDomains,
@ -87,7 +87,7 @@ func TestValidateCookie(t *testing.T) {
}, },
{ {
name: "with a valid Base64 secret", name: "with a valid Base64 secret",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: validName, Name: validName,
Secret: validBase64Secret, Secret: validBase64Secret,
Domains: emptyDomains, Domains: emptyDomains,
@ -102,7 +102,7 @@ func TestValidateCookie(t *testing.T) {
}, },
{ {
name: "with an invalid Base64 secret", name: "with an invalid Base64 secret",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: validName, Name: validName,
Secret: invalidBase64Secret, Secret: invalidBase64Secret,
Domains: emptyDomains, Domains: emptyDomains,
@ -119,7 +119,7 @@ func TestValidateCookie(t *testing.T) {
}, },
{ {
name: "with an invalid name", name: "with an invalid name",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: invalidName, Name: invalidName,
Secret: validSecret, Secret: validSecret,
Domains: emptyDomains, Domains: emptyDomains,
@ -136,7 +136,7 @@ func TestValidateCookie(t *testing.T) {
}, },
{ {
name: "with refresh longer than expire", name: "with refresh longer than expire",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: validName, Name: validName,
Secret: validSecret, Secret: validSecret,
Domains: emptyDomains, Domains: emptyDomains,
@ -153,7 +153,7 @@ func TestValidateCookie(t *testing.T) {
}, },
{ {
name: "with samesite \"none\"", name: "with samesite \"none\"",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: validName, Name: validName,
Secret: validSecret, Secret: validSecret,
Domains: emptyDomains, Domains: emptyDomains,
@ -168,7 +168,7 @@ func TestValidateCookie(t *testing.T) {
}, },
{ {
name: "with samesite \"lax\"", name: "with samesite \"lax\"",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: validName, Name: validName,
Secret: validSecret, Secret: validSecret,
Domains: emptyDomains, Domains: emptyDomains,
@ -183,7 +183,7 @@ func TestValidateCookie(t *testing.T) {
}, },
{ {
name: "with samesite \"strict\"", name: "with samesite \"strict\"",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: validName, Name: validName,
Secret: validSecret, Secret: validSecret,
Domains: emptyDomains, Domains: emptyDomains,
@ -198,7 +198,7 @@ func TestValidateCookie(t *testing.T) {
}, },
{ {
name: "with samesite \"invalid\"", name: "with samesite \"invalid\"",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: validName, Name: validName,
Secret: validSecret, Secret: validSecret,
Domains: emptyDomains, Domains: emptyDomains,
@ -215,7 +215,7 @@ func TestValidateCookie(t *testing.T) {
}, },
{ {
name: "with a combination of configuration errors", name: "with a combination of configuration errors",
cookie: options.CookieOptions{ cookie: options.Cookie{
Name: invalidName, Name: invalidName,
Secret: invalidSecret, Secret: invalidSecret,
Domains: domains, Domains: domains,
@ -237,7 +237,7 @@ func TestValidateCookie(t *testing.T) {
for _, tc := range testCases { for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) { t.Run(tc.name, func(t *testing.T) {
errStrings := validateCookieOptions(tc.cookie) errStrings := validateCookie(tc.cookie)
g := NewWithT(t) g := NewWithT(t)
g.Expect(errStrings).To(ConsistOf(tc.errStrings)) g.Expect(errStrings).To(ConsistOf(tc.errStrings))

2
pkg/validation/options.go
View File

@ -26,7 +26,7 @@ import (
// Validate checks that required options are set and validates those that they // Validate checks that required options are set and validates those that they
// are of the correct format // are of the correct format
func Validate(o *options.Options) error { func Validate(o *options.Options) error {
msgs := validateCookieOptions(o.Cookie) msgs := validateCookie(o.Cookie)
if o.SSLInsecureSkipVerify { if o.SSLInsecureSkipVerify {
insecureTransport := &http.Transport{ insecureTransport := &http.Transport{