go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2024-11-24 08:52:25 +02:00
Code Issues Releases Activity

Initialise Session Storage in NewOAuthProxy instead of validation

Browse Source
This commit is contained in:
Joel Speed 2020-05-25 14:00:49 +01:00
parent c8dbf1cf60
commit 5ce9e75c21
No known key found for this signature in database
GPG Key ID: 6E80578D6751DEFB
7 changed files with 141 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
go.sum
View File

@ -202,6 +202,7 @@ go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@ -225,6 +226,7 @@ golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20190923162816-aa69164e4478 h1:l5EDrHhldLYb3ZRHDUhXF7Om7MvYXnkV9/iQNo1lX6g=
golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=

6
main.go
View File

@ -45,7 +45,11 @@ func main() {
}
validator := NewValidator(opts.EmailDomains, opts.AuthenticatedEmailsFile)
oauthproxy := NewOAuthProxy(opts, validator)
oauthproxy, err := NewOAuthProxy(opts, validator)
if err != nil {
logger.Printf("ERROR: Failed to initialise OAuth2 Proxy: %v", err)
os.Exit(1)
}
if len(opts.Banner) >= 1 {
if opts.Banner == "-" {

12
oauthproxy.go
View File

@ -26,6 +26,7 @@ import (
"github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"
"github.com/oauth2-proxy/oauth2-proxy/pkg/ip"
"github.com/oauth2-proxy/oauth2-proxy/pkg/logger"
"github.com/oauth2-proxy/oauth2-proxy/pkg/sessions"
"github.com/oauth2-proxy/oauth2-proxy/providers"
"github.com/yhat/wsutil"
)
@ -231,7 +232,12 @@ func NewWebSocketOrRestReverseProxy(u *url.URL, opts *options.Options, auth hmac
}
// NewOAuthProxy creates a new instance of OAuthProxy from the options provided
func NewOAuthProxy(opts *options.Options, validator func(string) bool) *OAuthProxy {
func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthProxy, error) {
sessionStore, err := sessions.NewSessionStore(&opts.Session, &opts.Cookie)
if err != nil {
return nil, fmt.Errorf("error initialising session store: %v", err)
}
serveMux := http.NewServeMux()
var auth hmacauth.HmacAuth
if sigData := opts.GetSignatureData(); sigData != nil {
@ -321,7 +327,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) *OAuthPro
ProxyPrefix: opts.ProxyPrefix,
provider: opts.GetProvider(),
providerNameOverride: opts.ProviderName,
sessionStore: opts.GetSessionStore(),
sessionStore: sessionStore,
serveMux: serveMux,
redirectURL: redirectURL,
whitelistDomains: opts.WhitelistDomains,
@ -345,7 +351,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) *OAuthPro
templates: loadTemplates(opts.CustomTemplatesDir),
Banner: opts.Banner,
Footer: opts.Footer,
}
}, nil
}
// GetRedirectURI returns the redirectURL that the upstream OAuth Provider will

166
oauthproxy_test.go
View File

@ -22,6 +22,7 @@ import (
"github.com/mbland/hmacauth"
"github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"
"github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
"github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"
"github.com/oauth2-proxy/oauth2-proxy/pkg/logger"
"github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/cookie"
"github.com/oauth2-proxy/oauth2-proxy/pkg/validation"
@ -35,7 +36,7 @@ const (
// The rawCookieSecret is 32 bytes and the base64CookieSecret is the base64
// encoded version of this.
rawCookieSecret = "secretthirtytwobytes+abcdefghijk"
base64CookieSecret = "c2VjcmV0dGhpcnR5dHdvYnl0ZXMrYWJjZGVmZ2hpamsK"
base64CookieSecret = "c2VjcmV0dGhpcnR5dHdvYnl0ZXMrYWJjZGVmZ2hpams"
)
func init() {
@ -82,10 +83,10 @@ func TestWebSocketProxy(t *testing.T) {
backendURL, _ := url.Parse(backend.URL)
options := options.NewOptions()
opts := baseTestOptions()
var auth hmacauth.HmacAuth
options.PassHostHeader = true
proxyHandler := NewWebSocketOrRestReverseProxy(backendURL, options, auth)
opts.PassHostHeader = true
proxyHandler := NewWebSocketOrRestReverseProxy(backendURL, opts, auth)
frontend := httptest.NewServer(proxyHandler)
defer frontend.Close()
@ -172,13 +173,14 @@ func TestEncodedSlashes(t *testing.T) {
}
func TestRobotsTxt(t *testing.T) {
opts := options.NewOptions()
opts := baseTestOptions()
opts.ClientID = "asdlkjx"
opts.ClientSecret = "alkgks"
opts.Cookie.Secret = rawCookieSecret
validation.Validate(opts)
proxy := NewOAuthProxy(opts, func(string) bool { return true })
proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
assert.NoError(t, err)
rw := httptest.NewRecorder()
req, _ := http.NewRequest("GET", "/robots.txt", nil)
proxy.ServeHTTP(rw, req)
@ -187,7 +189,7 @@ func TestRobotsTxt(t *testing.T) {
}
func TestIsValidRedirect(t *testing.T) {
opts := options.NewOptions()
opts := baseTestOptions()
opts.ClientID = "skdlfj"
opts.ClientSecret = "fgkdsgj"
opts.Cookie.Secret = base64CookieSecret
@ -202,7 +204,8 @@ func TestIsValidRedirect(t *testing.T) {
}
validation.Validate(opts)
proxy := NewOAuthProxy(opts, func(string) bool { return true })
proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
assert.NoError(t, err)
testCases := []struct {
Desc, Redirect string
@ -453,11 +456,10 @@ func TestOpenRedirects(t *testing.T) {
"www.whitelisteddomain.tld",
}
err := validation.Validate(opts)
if err != nil {
t.Fatal(err)
}
assert.NoError(t, err)
proxy := NewOAuthProxy(opts, func(string) bool { return true })
proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
assert.NoError(t, err)
file, err := os.Open("./test/openredirects.txt")
if err != nil {
@ -545,7 +547,7 @@ func TestBasicAuthPassword(t *testing.T) {
w.WriteHeader(200)
w.Write([]byte(payload))
}))
opts := options.NewOptions()
opts := baseTestOptions()
opts.Upstreams = append(opts.Upstreams, providerServer.URL)
// The CookieSecret must be 32 bytes in order to create the AES
// cipher.
@ -564,9 +566,10 @@ func TestBasicAuthPassword(t *testing.T) {
const emailAddress = "john.doe@example.com"
opts.SetProvider(NewTestProvider(providerURL, emailAddress))
proxy := NewOAuthProxy(opts, func(email string) bool {
proxy, err := NewOAuthProxy(opts, func(email string) bool {
return email == emailAddress
})
assert.NoError(t, err)
rw := httptest.NewRecorder()
req, _ := http.NewRequest("GET", "/oauth2/callback?code=callback_code&state=nonce:", strings.NewReader(""))
@ -611,11 +614,12 @@ func TestBasicAuthPassword(t *testing.T) {
}
func TestBasicAuthWithEmail(t *testing.T) {
opts := options.NewOptions()
opts := baseTestOptions()
opts.PassBasicAuth = true
opts.PassUserHeaders = false
opts.PreferEmailToUser = false
opts.BasicAuthPassword = "This is a secure password"
opts.Cookie.Secret = rawCookieSecret
validation.Validate(opts)
const emailAddress = "john.doe@example.com"
@ -635,9 +639,10 @@ func TestBasicAuthWithEmail(t *testing.T) {
{
rw := httptest.NewRecorder()
req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase0", nil)
proxy := NewOAuthProxy(opts, func(email string) bool {
proxy, err := NewOAuthProxy(opts, func(email string) bool {
return email == emailAddress
})
assert.NoError(t, err)
proxy.addHeadersForProxying(rw, req, session)
assert.Equal(t, expectedUserHeader, req.Header["Authorization"][0])
assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
@ -648,9 +653,10 @@ func TestBasicAuthWithEmail(t *testing.T) {
rw := httptest.NewRecorder()
req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase1", nil)
proxy := NewOAuthProxy(opts, func(email string) bool {
proxy, err := NewOAuthProxy(opts, func(email string) bool {
return email == emailAddress
})
assert.NoError(t, err)
proxy.addHeadersForProxying(rw, req, session)
assert.Equal(t, expectedEmailHeader, req.Header["Authorization"][0])
assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
@ -658,10 +664,11 @@ func TestBasicAuthWithEmail(t *testing.T) {
}
func TestPassUserHeadersWithEmail(t *testing.T) {
opts := options.NewOptions()
opts := baseTestOptions()
opts.PassBasicAuth = false
opts.PassUserHeaders = true
opts.PreferEmailToUser = false
opts.Cookie.Secret = base64CookieSecret
validation.Validate(opts)
const emailAddress = "john.doe@example.com"
@ -677,9 +684,10 @@ func TestPassUserHeadersWithEmail(t *testing.T) {
{
rw := httptest.NewRecorder()
req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase0", nil)
proxy := NewOAuthProxy(opts, func(email string) bool {
proxy, err := NewOAuthProxy(opts, func(email string) bool {
return email == emailAddress
})
assert.NoError(t, err)
proxy.addHeadersForProxying(rw, req, session)
assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
}
@ -689,9 +697,10 @@ func TestPassUserHeadersWithEmail(t *testing.T) {
rw := httptest.NewRecorder()
req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase1", nil)
proxy := NewOAuthProxy(opts, func(email string) bool {
proxy, err := NewOAuthProxy(opts, func(email string) bool {
return email == emailAddress
})
assert.NoError(t, err)
proxy.addHeadersForProxying(rw, req, session)
assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
}
@ -727,7 +736,7 @@ func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTes
w.Write([]byte(payload))
}))
t.opts = options.NewOptions()
t.opts = baseTestOptions()
t.opts.Upstreams = append(t.opts.Upstreams, t.providerServer.URL)
if opts.ProxyUpstream != "" {
t.opts.Upstreams = append(t.opts.Upstreams, opts.ProxyUpstream)
@ -745,9 +754,13 @@ func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTes
const emailAddress = "michael.bland@gsa.gov"
t.opts.SetProvider(NewTestProvider(providerURL, emailAddress))
t.proxy = NewOAuthProxy(t.opts, func(email string) bool {
var err error
t.proxy, err = NewOAuthProxy(t.opts, func(email string) bool {
return email == emailAddress
})
if err != nil {
panic(err)
}
return t
}
@ -886,16 +899,20 @@ const signInSkipProvider = `>Found<`
func NewSignInPageTest(skipProvider bool) *SignInPageTest {
var sipTest SignInPageTest
sipTest.opts = options.NewOptions()
sipTest.opts = baseTestOptions()
sipTest.opts.Cookie.Secret = rawCookieSecret
sipTest.opts.ClientID = "lkdgj"
sipTest.opts.ClientSecret = "sgiufgoi"
sipTest.opts.SkipProviderButton = skipProvider
validation.Validate(sipTest.opts)
sipTest.proxy = NewOAuthProxy(sipTest.opts, func(email string) bool {
var err error
sipTest.proxy, err = NewOAuthProxy(sipTest.opts, func(email string) bool {
return true
})
if err != nil {
panic(err)
}
sipTest.signInRegexp = regexp.MustCompile(signInRedirectPattern)
sipTest.signInProviderRegexp = regexp.MustCompile(signInSkipProvider)
@ -987,7 +1004,7 @@ type OptionsModifier func(*options.Options)
func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifier) *ProcessCookieTest {
var pcTest ProcessCookieTest
pcTest.opts = options.NewOptions()
pcTest.opts = baseTestOptions()
for _, modifier := range modifiers {
modifier(pcTest.opts)
}
@ -999,9 +1016,13 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifi
pcTest.opts.Cookie.Refresh = time.Hour
validation.Validate(pcTest.opts)
pcTest.proxy = NewOAuthProxy(pcTest.opts, func(email string) bool {
var err error
pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
return pcTest.validateUser
})
if err != nil {
panic(err)
}
pcTest.proxy.provider = &TestProvider{
ValidToken: opts.providerValidateCookieResponse,
}
@ -1201,13 +1222,19 @@ func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {
func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
var pcTest ProcessCookieTest
pcTest.opts = options.NewOptions()
pcTest.opts = baseTestOptions()
pcTest.opts.SetXAuthRequest = true
validation.Validate(pcTest.opts)
err := validation.Validate(pcTest.opts)
if err != nil {
panic(err)
}
pcTest.proxy = NewOAuthProxy(pcTest.opts, func(email string) bool {
pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
return pcTest.validateUser
})
if err != nil {
panic(err)
}
pcTest.proxy.provider = &TestProvider{
ValidToken: true,
}
@ -1232,14 +1259,18 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
var pcTest ProcessCookieTest
pcTest.opts = options.NewOptions()
pcTest.opts = baseTestOptions()
pcTest.opts.SetXAuthRequest = true
pcTest.opts.SetBasicAuth = true
validation.Validate(pcTest.opts)
pcTest.proxy = NewOAuthProxy(pcTest.opts, func(email string) bool {
var err error
pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
return pcTest.validateUser
})
if err != nil {
panic(err)
}
pcTest.proxy.provider = &TestProvider{
ValidToken: true,
}
@ -1266,14 +1297,18 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
var pcTest ProcessCookieTest
pcTest.opts = options.NewOptions()
pcTest.opts = baseTestOptions()
pcTest.opts.SetXAuthRequest = true
pcTest.opts.SetBasicAuth = false
validation.Validate(pcTest.opts)
pcTest.proxy = NewOAuthProxy(pcTest.opts, func(email string) bool {
var err error
pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
return pcTest.validateUser
})
if err != nil {
panic(err)
}
pcTest.proxy.provider = &TestProvider{
ValidToken: true,
}
@ -1303,18 +1338,16 @@ func TestAuthSkippedForPreflightRequests(t *testing.T) {
}))
defer upstream.Close()
opts := options.NewOptions()
opts := baseTestOptions()
opts.Upstreams = append(opts.Upstreams, upstream.URL)
opts.ClientID = "aljsal"
opts.ClientSecret = "jglkfsdgj"
opts.Cookie.Secret = base64CookieSecret
opts.SkipAuthPreflight = true
validation.Validate(opts)
upstreamURL, _ := url.Parse(upstream.URL)
opts.SetProvider(NewTestProvider(upstreamURL, ""))
proxy := NewOAuthProxy(opts, func(string) bool { return false })
proxy, err := NewOAuthProxy(opts, func(string) bool { return false })
assert.NoError(t, err)
rw := httptest.NewRecorder()
req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)
proxy.ServeHTTP(rw, req)
@ -1353,7 +1386,7 @@ type SignatureTest struct {
}
func NewSignatureTest() *SignatureTest {
opts := options.NewOptions()
opts := baseTestOptions()
opts.Cookie.Secret = rawCookieSecret
opts.ClientID = "client ID"
opts.ClientSecret = "client secret"
@ -1409,7 +1442,10 @@ func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) {
if err != nil {
panic(err)
}
proxy := NewOAuthProxy(st.opts, func(email string) bool { return true })
proxy, err := NewOAuthProxy(st.opts, func(email string) bool { return true })
if err != nil {
panic(err)
}
var bodyBuf io.ReadCloser
if body != "" {
@ -1461,10 +1497,12 @@ func TestRequestSignaturePostRequest(t *testing.T) {
}
func TestGetRedirect(t *testing.T) {
options := options.NewOptions()
_ = validation.Validate(options)
require.NotEmpty(t, options.ProxyPrefix)
proxy := NewOAuthProxy(options, func(s string) bool { return false })
opts := baseTestOptions()
err := validation.Validate(opts)
assert.NoError(t, err)
require.NotEmpty(t, opts.ProxyPrefix)
proxy, err := NewOAuthProxy(opts, func(s string) bool { return false })
assert.NoError(t, err)
tests := []struct {
name string
@ -1500,14 +1538,19 @@ type ajaxRequestTest struct {
func newAjaxRequestTest() *ajaxRequestTest {
test := &ajaxRequestTest{}
test.opts = options.NewOptions()
test.opts = baseTestOptions()
test.opts.Cookie.Secret = base64CookieSecret
test.opts.ClientID = "gkljfdl"
test.opts.ClientSecret = "sdflkjs"
validation.Validate(test.opts)
test.proxy = NewOAuthProxy(test.opts, func(email string) bool {
var err error
test.proxy, err = NewOAuthProxy(test.opts, func(email string) bool {
return true
})
if err != nil {
panic(err)
}
return test
}
@ -1558,11 +1601,14 @@ func TestAjaxForbiddendRequest(t *testing.T) {
}
func TestClearSplitCookie(t *testing.T) {
opts := options.NewOptions()
opts := baseTestOptions()
opts.Cookie.Secret = base64CookieSecret
opts.Cookie.Name = "oauth2"
opts.Cookie.Domains = []string{"abc"}
store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
assert.Equal(t, err, nil)
cipher, err := encryption.NewBase64Cipher(encryption.NewCFBCipher, encryption.SecretBytes(opts.Cookie.Secret))
assert.Equal(t, nil, err)
store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie, cipher)
assert.Equal(t, nil, err)
p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}
var rw = httptest.NewRecorder()
req := httptest.NewRequest("get", "/", nil)
@ -1587,11 +1633,13 @@ func TestClearSplitCookie(t *testing.T) {
}
func TestClearSingleCookie(t *testing.T) {
opts := options.NewOptions()
opts := baseTestOptions()
opts.Cookie.Name = "oauth2"
opts.Cookie.Domains = []string{"abc"}
store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
assert.Equal(t, err, nil)
cipher, err := encryption.NewBase64Cipher(encryption.NewCFBCipher, encryption.SecretBytes(opts.Cookie.Secret))
assert.Equal(t, nil, err)
store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie, cipher)
assert.Equal(t, nil, err)
p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}
var rw = httptest.NewRecorder()
req := httptest.NewRequest("get", "/", nil)
@ -1768,13 +1816,14 @@ func Test_noCacheHeadersDoesNotExistsInResponseHeadersFromUpstream(t *testing.T)
}))
t.Cleanup(upstream.Close)
opts := options.NewOptions()
opts := baseTestOptions()
opts.Upstreams = []string{upstream.URL}
opts.SkipAuthRegex = []string{".*"}
_ = validation.Validate(opts)
proxy := NewOAuthProxy(opts, func(email string) bool {
proxy, err := NewOAuthProxy(opts, func(email string) bool {
return true
})
assert.NoError(t, err)
rec := httptest.NewRecorder()
req := httptest.NewRequest(http.MethodGet, "/upstream", nil)
@ -1788,3 +1837,12 @@ func Test_noCacheHeadersDoesNotExistsInResponseHeadersFromUpstream(t *testing.T)
assert.Equal(t, "", rec.Header().Get(k))
}
}
func baseTestOptions() *options.Options {
opts := options.NewOptions()
opts.Cookie.Secret = rawCookieSecret
opts.ClientID = "cliend-id"
opts.ClientSecret = "client-secret"
opts.EmailDomains = []string{"*"}
return opts
}

4
pkg/apis/options/options.go
View File

@ -8,7 +8,6 @@ import (
oidc "github.com/coreos/go-oidc"
ipapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/ip"
sessionsapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
"github.com/oauth2-proxy/oauth2-proxy/providers"
"github.com/spf13/pflag"
)
@ -115,7 +114,6 @@ type Options struct {
proxyURLs []*url.URL
compiledRegex []*regexp.Regexp
provider providers.Provider
sessionStore sessionsapi.SessionStore
signatureData *SignatureData
oidcVerifier *oidc.IDTokenVerifier
jwtBearerVerifiers []*oidc.IDTokenVerifier
@ -127,7 +125,6 @@ func (o *Options) GetRedirectURL() *url.URL { return o.re
func (o *Options) GetProxyURLs() []*url.URL { return o.proxyURLs }
func (o *Options) GetCompiledRegex() []*regexp.Regexp { return o.compiledRegex }
func (o *Options) GetProvider() providers.Provider { return o.provider }
func (o *Options) GetSessionStore() sessionsapi.SessionStore { return o.sessionStore }
func (o *Options) GetSignatureData() *SignatureData { return o.signatureData }
func (o *Options) GetOIDCVerifier() *oidc.IDTokenVerifier { return o.oidcVerifier }
func (o *Options) GetJWTBearerVerifiers() []*oidc.IDTokenVerifier { return o.jwtBearerVerifiers }
@ -138,7 +135,6 @@ func (o *Options) SetRedirectURL(s *url.URL) { o.redirect
func (o *Options) SetProxyURLs(s []*url.URL) { o.proxyURLs = s }
func (o *Options) SetCompiledRegex(s []*regexp.Regexp) { o.compiledRegex = s }
func (o *Options) SetProvider(s providers.Provider) { o.provider = s }
func (o *Options) SetSessionStore(s sessionsapi.SessionStore) { o.sessionStore = s }
func (o *Options) SetSignatureData(s *SignatureData) { o.signatureData = s }
func (o *Options) SetOIDCVerifier(s *oidc.IDTokenVerifier) { o.oidcVerifier = s }
func (o *Options) SetJWTBearerVerifiers(s []*oidc.IDTokenVerifier) { o.jwtBearerVerifiers = s }

13
pkg/sessions/session_store_test.go
View File

@ -455,4 +455,17 @@ var _ = Describe("NewSessionStore", func() {
Expect(ss).To(BeNil())
})
})
Context("with an invalid cookie secret", func() {
BeforeEach(func() {
cookieOpts.Secret = "invalid"
})
It("returns an error", func() {
ss, err := sessions.NewSessionStore(opts, cookieOpts)
Expect(err).To(HaveOccurred())
Expect(err.Error()).To(Equal("error initialising cipher: crypto/aes: invalid key size 7"))
Expect(ss).To(BeNil())
})
})
})

8
pkg/validation/options.go
View File

@ -21,7 +21,6 @@ import (
"github.com/oauth2-proxy/oauth2-proxy/pkg/ip"
"github.com/oauth2-proxy/oauth2-proxy/pkg/logger"
"github.com/oauth2-proxy/oauth2-proxy/pkg/requests"
"github.com/oauth2-proxy/oauth2-proxy/pkg/sessions"
"github.com/oauth2-proxy/oauth2-proxy/providers"
)
@ -210,13 +209,6 @@ func Validate(o *options.Options) error {
}
msgs = parseProviderInfo(o, msgs)
sessionStore, err := sessions.NewSessionStore(&o.Session, &o.Cookie)
if err != nil {
msgs = append(msgs, fmt.Sprintf("error initialising session storage: %v", err))
} else {
o.SetSessionStore(sessionStore)
}
if o.Cookie.Refresh >= o.Cookie.Expire {
msgs = append(msgs, fmt.Sprintf(
"cookie_refresh (%s) must be less than "+