git.iko.soy/typeable/oauth2-proxy
on 2bb7ea5 help sign in
typeable/oauth2-proxy/pkg/validation/header.go
63 lines 1.7 kB history raw
1package validation
3import (
4 "fmt"
6 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
7)
9func validateHeaders(headers []options.Header) []string {
10 msgs := []string{}
11 names := make(map[string]struct{})
13 for _, header := range headers {
14 msgs = append(msgs, validateHeader(header, names)...)
15 }
16 return msgs
19func validateHeader(header options.Header, names map[string]struct{}) []string {
20 msgs := []string{}
22 if header.Name == "" {
23 msgs = append(msgs, "header has empty name: names are required for all headers")
24 }
26 if _, ok := names[header.Name]; ok {
27 msgs = append(msgs, fmt.Sprintf("multiple headers found with name %q: header names must be unique", header.Name))
28 }
29 names[header.Name] = struct{}{}
31 for _, value := range header.Values {
32 msgs = append(msgs,
33 prefixValues(fmt.Sprintf("invalid header %q: invalid values: ", header.Name),
34 validateHeaderValue(header.Name, value)...,
35 )...,
36 )
37 }
38 return msgs
41func validateHeaderValue(_ string, value options.HeaderValue) []string {
42 switch {
43 case value.SecretSource != nil && value.ClaimSource == nil:
44 return []string{validateSecretSource(*value.SecretSource)}
45 case value.SecretSource == nil && value.ClaimSource != nil:
46 return validateHeaderValueClaimSource(*value.ClaimSource)
47 default:
48 return []string{"header value has multiple entries: only one entry per value is allowed"}
49 }
52func validateHeaderValueClaimSource(claim options.ClaimSource) []string {
53 msgs := []string{}
55 if claim.Claim == "" {
56 msgs = append(msgs, "claim should not be empty")
57 }
59 if claim.BasicAuthPassword != nil {
60 msgs = append(msgs, prefixValues("invalid basicAuthPassword: ", validateSecretSource(*claim.BasicAuthPassword))...)
61 }
62 return msgs