go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-08-06 22:42:56 +02:00
Code Issues Releases Activity

better handling of default transport modification

Browse Source
This commit is contained in:
tuunit
2024-10-06 21:43:38 +02:00
parent 8fd7312a90
commit bae168f06a
2 changed files with 9 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/requests/http.go
View File

@ -7,22 +7,22 @@ import (
) )
type userAgentTransport struct { type userAgentTransport struct {
Next http.RoundTripper next http.RoundTripper
userAgent string userAgent string
} }
func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) { func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
r := req.Clone(req.Context()) r := req.Clone(req.Context())
setDefaultUserAgent(r.Header, t.userAgent) setDefaultUserAgent(r.Header, t.userAgent)
return t.Next.RoundTrip(r) return t.next.RoundTrip(r)
} }
var DefaultHTTPClient = &http.Client{Transport: &DefaultTransport} var DefaultHTTPClient = &http.Client{Transport: &userAgentTransport{
next: DefaultTransport,
var DefaultTransport = userAgentTransport{
Next: http.DefaultTransport,
userAgent: "oauth2-proxy/" + version.VERSION, userAgent: "oauth2-proxy/" + version.VERSION,
} }}
var DefaultTransport = http.DefaultTransport
func setDefaultUserAgent(header http.Header, userAgent string) { func setDefaultUserAgent(header http.Header, userAgent string) {
if header != nil && len(header.Values("User-Agent")) == 0 { if header != nil && len(header.Values("User-Agent")) == 0 {

8
pkg/validation/options.go
View File

@ -31,20 +31,16 @@ func Validate(o *options.Options) error {
msgs = parseSignatureKey(o, msgs) msgs = parseSignatureKey(o, msgs)
if o.SSLInsecureSkipVerify { if o.SSLInsecureSkipVerify {
transport := requests.DefaultTransport.Next.(*http.Transport).Clone() transport := requests.DefaultTransport.(*http.Transport)
transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
requests.DefaultHTTPClient = &http.Client{Transport: transport}
} else if len(o.Providers[0].CAFiles) > 0 { } else if len(o.Providers[0].CAFiles) > 0 {
pool, err := util.GetCertPool(o.Providers[0].CAFiles, o.Providers[0].UseSystemTrustStore) pool, err := util.GetCertPool(o.Providers[0].CAFiles, o.Providers[0].UseSystemTrustStore)
if err == nil { if err == nil {
transport := requests.DefaultTransport.Next.(*http.Transport).Clone() transport := requests.DefaultTransport.(*http.Transport)
transport.TLSClientConfig = &tls.Config{ transport.TLSClientConfig = &tls.Config{
RootCAs: pool, RootCAs: pool,
MinVersion: tls.VersionTLS12, MinVersion: tls.VersionTLS12,
} }
requests.DefaultHTTPClient = &http.Client{Transport: transport}
} else { } else {
msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err)) msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err))
} }