oauthproxy_test.go · typeable/oauth2-proxy

1169 expectedResponse: "{\"user\":\"john.doe\",\"email\":\"john.doe@example.com\",\"groups\":[\"example\",\"groups\"],\"preferredUsername\":\"john\"}\n",

1170 },

1171 }

1172

1173 for _, tc := range testCases {

1174 t.Run(tc.name, func(t *testing.T) {

1175 test, err := NewUserInfoEndpointTest()

1176 if err != nil {

1177 t.Fatal(err)

1178 }

1179 err = test.SaveSession(tc.session)

1180 assert.NoError(t, err)

1181

1182 test.proxy.ServeHTTP(test.rw, test.req)

1183 assert.Equal(t, http.StatusOK, test.rw.Code)

1184 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1185 assert.Equal(t, tc.expectedResponse, string(bodyBytes))

1186 })

1187 }

1188}

1189

1190func TestUserInfoEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {

1191 test, err := NewUserInfoEndpointTest()

1192 if err != nil {

1193 t.Fatal(err)

1194 }

1195

1196 test.proxy.ServeHTTP(test.rw, test.req)

1197 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

1198}

1199

1200func NewAuthOnlyEndpointTest(querystring string, modifiers ...OptionsModifier) (*ProcessCookieTest, error) {

1201 pcTest, err := NewProcessCookieTestWithOptionsModifiers(modifiers...)

1202 if err != nil {

1203 return nil, err

1204 }

1205 pcTest.req, _ = http.NewRequest(

1206 "GET",

1207 fmt.Sprintf("%s/auth%s", pcTest.opts.ProxyPrefix, querystring),

1208 nil)

1209 return pcTest, nil

1210}

1211

1212func TestAuthOnlyEndpointAccepted(t *testing.T) {

1213 test, err := NewAuthOnlyEndpointTest("")

1214 if err != nil {

1215 t.Fatal(err)

1216 }

1217

1218 created := time.Now()

1219 startSession := &sessions.SessionState{

1220 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}

1221 err = test.SaveSession(startSession)

1222 assert.NoError(t, err)

1223

1224 test.proxy.ServeHTTP(test.rw, test.req)

1225 assert.Equal(t, http.StatusAccepted, test.rw.Code)

1226 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1227 assert.Equal(t, "", string(bodyBytes))

1228}

1229

1230func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {

1231 test, err := NewAuthOnlyEndpointTest("")

1232 if err != nil {

1233 t.Fatal(err)

1234 }

1235

1236 test.proxy.ServeHTTP(test.rw, test.req)

1237 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

1238 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1239 assert.Equal(t, "Unauthorized\n", string(bodyBytes))

1240}

1241

1242func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {

1243 test, err := NewAuthOnlyEndpointTest("", func(opts *options.Options) {

1244 opts.Cookie.Expire = time.Duration(24) * time.Hour

1245 })

1246 if err != nil {

1247 t.Fatal(err)

1248 }

1249

1250 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)

1251 startSession := &sessions.SessionState{

1252 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}

1253 err = test.SaveSession(startSession)

1254 assert.NoError(t, err)

1255

1256 test.proxy.ServeHTTP(test.rw, test.req)

1257 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

1258 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1259 assert.Equal(t, "Unauthorized\n", string(bodyBytes))

1260}

1261

1262func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {

1263 test, err := NewAuthOnlyEndpointTest("")

1264 if err != nil {

1265 t.Fatal(err)

1266 }

1267

1268 created := time.Now()

1269 startSession := &sessions.SessionState{

1270 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}

1271 err = test.SaveSession(startSession)

1272 assert.NoError(t, err)

1273 test.validateUser = false

1274

1275 test.proxy.ServeHTTP(test.rw, test.req)

1276 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

1277 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1278 assert.Equal(t, "Unauthorized\n", string(bodyBytes))

1279}

1280

1281func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {

1282 var pcTest ProcessCookieTest

1283

1284 pcTest.opts = baseTestOptions()

1285 pcTest.opts.InjectResponseHeaders = []options.Header{

1286 {

1287 Name: "X-Auth-Request-User",

1288 Values: []options.HeaderValue{

1289 {

1290 ClaimSource: &options.ClaimSource{

1291 Claim: "user",

1292 },

1293 },

1294 },

1295 },

1296 {

1297 Name: "X-Auth-Request-Email",

1298 Values: []options.HeaderValue{

1299 {

1300 ClaimSource: &options.ClaimSource{

1301 Claim: "email",

1302 },

1303 },

1304 },

1305 },

1306 {

1307 Name: "X-Auth-Request-Groups",

1308 Values: []options.HeaderValue{

1309 {

1310 ClaimSource: &options.ClaimSource{

1311 Claim: "groups",

1312 },

1313 },

1314 },

1315 },

1316 {

1317 Name: "X-Forwarded-Preferred-Username",

1318 Values: []options.HeaderValue{

1319 {

1320 ClaimSource: &options.ClaimSource{

1321 Claim: "preferred_username",

1322 },

1323 },

1324 },

1325 },

1326 }

1327 pcTest.opts.AllowedGroups = []string{"oauth_groups"}

1328 err := validation.Validate(pcTest.opts)

1329 assert.NoError(t, err)

1330

1331 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {

1332 return pcTest.validateUser

1333 })

1334 if err != nil {

1335 t.Fatal(err)

1336 }

1337 pcTest.proxy.provider = &TestProvider{

1338 ProviderData: &providers.ProviderData{},

1339 ValidToken: true,

1340 }

1341

1342 pcTest.validateUser = true

1343

1344 pcTest.rw = httptest.NewRecorder()

1345 pcTest.req, _ = http.NewRequest("GET",

1346 pcTest.opts.ProxyPrefix+"/auth", nil)

1347

1348 created := time.Now()

1349 startSession := &sessions.SessionState{

1350 User: "oauth_user", Groups: []string{"oauth_groups"}, Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}

1351 err = pcTest.SaveSession(startSession)

1352 assert.NoError(t, err)

1353

1354 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)

1355 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)

1356 assert.Equal(t, "oauth_user", pcTest.rw.Header().Get("X-Auth-Request-User"))

1357 assert.Equal(t, startSession.Groups, pcTest.rw.Header().Values("X-Auth-Request-Groups"))

1358 assert.Equal(t, "oauth_user@example.com", pcTest.rw.Header().Get("X-Auth-Request-Email"))

1359}

1360

1361func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {

1362 var pcTest ProcessCookieTest

1363

1364 pcTest.opts = baseTestOptions()

1365 pcTest.opts.InjectResponseHeaders = []options.Header{

1366 {

1367 Name: "X-Auth-Request-User",

1368 Values: []options.HeaderValue{

1369 {

1370 ClaimSource: &options.ClaimSource{

1371 Claim: "user",

1372 },

1373 },

1374 },

1375 },

1376 {

1377 Name: "X-Auth-Request-Email",

1378 Values: []options.HeaderValue{

1379 {

1380 ClaimSource: &options.ClaimSource{

1381 Claim: "email",

1382 },

1383 },

1384 },

1385 },

1386 {

1387 Name: "X-Auth-Request-Groups",

1388 Values: []options.HeaderValue{

1389 {

1390 ClaimSource: &options.ClaimSource{

1391 Claim: "groups",

1392 },

1393 },

1394 },

1395 },

1396 {

1397 Name: "X-Forwarded-Preferred-Username",

1398 Values: []options.HeaderValue{

1399 {

1400 ClaimSource: &options.ClaimSource{

1401 Claim: "preferred_username",

1402 },

1403 },

1404 },

1405 },

1406 {

1407 Name: "Authorization",

1408 Values: []options.HeaderValue{

1409 {

1410 ClaimSource: &options.ClaimSource{

1411 Claim: "user",

1412 BasicAuthPassword: &options.SecretSource{

1413 Value: []byte("This is a secure password"),

1414 },

1415 },

1416 },

1417 },

1418 },

1419 }

1420

1421 err := validation.Validate(pcTest.opts)

1422 assert.NoError(t, err)

1423

1424 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {

1425 return pcTest.validateUser

1426 })

1427 if err != nil {

1428 t.Fatal(err)

1429 }

1430 pcTest.proxy.provider = &TestProvider{

1431 ProviderData: &providers.ProviderData{},

1432 ValidToken: true,

1433 }

1434

1435 pcTest.validateUser = true

1436

1437 pcTest.rw = httptest.NewRecorder()

1438 pcTest.req, _ = http.NewRequest("GET",

1439 pcTest.opts.ProxyPrefix+"/auth", nil)

1440

1441 created := time.Now()

1442 startSession := &sessions.SessionState{

1443 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}

1444 err = pcTest.SaveSession(startSession)

1445 assert.NoError(t, err)

1446

1447 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)

1448 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)

1449 assert.Equal(t, "oauth_user", pcTest.rw.Header().Values("X-Auth-Request-User")[0])

1450 assert.Equal(t, "oauth_user@example.com", pcTest.rw.Header().Values("X-Auth-Request-Email")[0])

1451 expectedHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte("oauth_user:This is a secure password"))

1452 assert.Equal(t, expectedHeader, pcTest.rw.Header().Values("Authorization")[0])

1453}

1454

1455func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {

1456 var pcTest ProcessCookieTest

1457

1458 pcTest.opts = baseTestOptions()

1459 pcTest.opts.InjectResponseHeaders = []options.Header{

1460 {

1461 Name: "X-Auth-Request-User",

1462 Values: []options.HeaderValue{

1463 {

1464 ClaimSource: &options.ClaimSource{

1465 Claim: "user",

1466 },

1467 },

1468 },

1469 },

1470 {

1471 Name: "X-Auth-Request-Email",

1472 Values: []options.HeaderValue{

1473 {

1474 ClaimSource: &options.ClaimSource{

1475 Claim: "email",

1476 },

1477 },

1478 },

1479 },

1480 {

1481 Name: "X-Auth-Request-Groups",

1482 Values: []options.HeaderValue{

1483 {

1484 ClaimSource: &options.ClaimSource{

1485 Claim: "groups",

1486 },

1487 },

1488 },

1489 },

1490 {

1491 Name: "X-Forwarded-Preferred-Username",

1492 Values: []options.HeaderValue{

1493 {

1494 ClaimSource: &options.ClaimSource{

1495 Claim: "preferred_username",

1496 },

1497 },

1498 },

1499 },

1500 }

1501 err := validation.Validate(pcTest.opts)

1502 assert.NoError(t, err)

1503

1504 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {

1505 return pcTest.validateUser

1506 })

1507 if err != nil {

1508 t.Fatal(err)

1509 }

1510 pcTest.proxy.provider = &TestProvider{

1511 ProviderData: &providers.ProviderData{},

1512 ValidToken: true,

1513 }

1514

1515 pcTest.validateUser = true

1516

1517 pcTest.rw = httptest.NewRecorder()

1518 pcTest.req, _ = http.NewRequest("GET",

1519 pcTest.opts.ProxyPrefix+"/auth", nil)

1520

1521 created := time.Now()

1522 startSession := &sessions.SessionState{

1523 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}

1524 err = pcTest.SaveSession(startSession)

1525 assert.NoError(t, err)

1526

1527 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)

1528 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)

1529 assert.Equal(t, "oauth_user", pcTest.rw.Header().Values("X-Auth-Request-User")[0])

1530 assert.Equal(t, "oauth_user@example.com", pcTest.rw.Header().Values("X-Auth-Request-Email")[0])

1531 assert.Equal(t, 0, len(pcTest.rw.Header().Values("Authorization")), "should not have Authorization header entries")

1532}

1533

1534func TestAuthSkippedForPreflightRequests(t *testing.T) {

1535 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

1536 w.WriteHeader(200)

1537 _, err := w.Write([]byte("response"))

1538 if err != nil {

1539 t.Fatal(err)

1540 }

1541 }))

1542 t.Cleanup(upstreamServer.Close)

1543

1544 opts := baseTestOptions()

1545 opts.UpstreamServers = options.Upstreams{

1546 {

1547 ID: upstreamServer.URL,

1548 Path: "/",

1549 URI: upstreamServer.URL,

1550 },

1551 }

1552 opts.SkipAuthPreflight = true

1553 err := validation.Validate(opts)

1554 assert.NoError(t, err)

1555

1556 upstreamURL, _ := url.Parse(upstreamServer.URL)

1557 opts.SetProvider(NewTestProvider(upstreamURL, ""))

1558

1559 proxy, err := NewOAuthProxy(opts, func(string) bool { return false })

1560 if err != nil {

1561 t.Fatal(err)

1562 }

1563 rw := httptest.NewRecorder()

1564 req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)

1565 proxy.ServeHTTP(rw, req)

1566

1567 assert.Equal(t, 200, rw.Code)

1568 assert.Equal(t, "response", rw.Body.String())

1569}

1570

1571type SignatureAuthenticator struct {

1572 auth hmacauth.HmacAuth

1573}

1574

1575func (v *SignatureAuthenticator) Authenticate(w http.ResponseWriter, r *http.Request) {

1576 result, headerSig, computedSig := v.auth.AuthenticateRequest(r)

1577

1578 var msg string

1579 switch result {

1580 case hmacauth.ResultNoSignature:

1581 msg = "no signature received"

1582 case hmacauth.ResultMatch:

1583 msg = "signatures match"

1584 case hmacauth.ResultMismatch:

1585 msg = fmt.Sprintf(

1586 "signatures do not match:\n received: %s\n computed: %s",

1587 headerSig,

1588 computedSig)

1589 default:

1590 panic("unknown result value: " + result.String())

1591 }

1592

1593 _, err := w.Write([]byte(msg))

1594 if err != nil {

1595 panic(err)

1596 }

1597}

1598

1599type SignatureTest struct {

1600 opts *options.Options

1601 upstream *httptest.Server

1602 upstreamHost string

1603 provider *httptest.Server

1604 header http.Header

1605 rw *httptest.ResponseRecorder

1606 authenticator *SignatureAuthenticator

1607}

1608

1609func NewSignatureTest() (*SignatureTest, error) {

1610 opts := baseTestOptions()

1611 opts.EmailDomains = []string{"acm.org"}

1612

1613 authenticator := &SignatureAuthenticator{}

1614 upstreamServer := httptest.NewServer(

1615 http.HandlerFunc(authenticator.Authenticate))

1616 upstreamURL, err := url.Parse(upstreamServer.URL)

1617 if err != nil {

1618 return nil, err

1619 }

1620 opts.UpstreamServers = options.Upstreams{

1621 {

1622 ID: upstreamServer.URL,

1623 Path: "/",

1624 URI: upstreamServer.URL,

1625 },

1626 }

1627

1628 providerHandler := func(w http.ResponseWriter, r *http.Request) {

1629 _, err := w.Write([]byte(`{"access_token": "my_auth_token"}`))

1630 if err != nil {

1631 panic(err)

1632 }

1633 }

1634 provider := httptest.NewServer(http.HandlerFunc(providerHandler))

1635 providerURL, err := url.Parse(provider.URL)

1636 if err != nil {

1637 return nil, err

1638 }

1639 opts.SetProvider(NewTestProvider(providerURL, "mbland@acm.org"))

1640

1641 return &SignatureTest{

1642 opts,

1643 upstreamServer,

1644 upstreamURL.Host,

1645 provider,

1646 make(http.Header),

1647 httptest.NewRecorder(),

1648 authenticator,

1649 }, nil

1650}

1651

1652func (st *SignatureTest) Close() {

1653 st.provider.Close()

1654 st.upstream.Close()

1655}

1656

1657// fakeNetConn simulates an http.Request.Body buffer that will be consumed

1658// when it is read by the hmacauth.HmacAuth if not handled properly. See:

1659// https://github.com/18F/hmacauth/pull/4

1660type fakeNetConn struct {

1661 reqBody string

1662}

1663

1664func (fnc *fakeNetConn) Read(p []byte) (n int, err error) {

1665 if bodyLen := len(fnc.reqBody); bodyLen != 0 {

1666 copy(p, fnc.reqBody)

1667 fnc.reqBody = ""

1668 return bodyLen, io.EOF

1669 }

1670 return 0, io.EOF

1671}

1672

1673func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) error {

1674 err := validation.Validate(st.opts)

1675 if err != nil {

1676 return err

1677 }

1678 proxy, err := NewOAuthProxy(st.opts, func(email string) bool { return true })

1679 if err != nil {

1680 return err

1681 }

1682

1683 var bodyBuf io.ReadCloser

1684 if body != "" {

1685 bodyBuf = ioutil.NopCloser(&fakeNetConn{reqBody: body})

1686 }

1687 req := httptest.NewRequest(method, "/foo/bar", bodyBuf)

1688 req.Header = st.header

1689

1690 state := &sessions.SessionState{

1691 Email: "mbland@acm.org", AccessToken: "my_access_token"}

1692 err = proxy.SaveSession(st.rw, req, state)

1693 if err != nil {

1694 return err

1695 }

1696 for _, c := range st.rw.Result().Cookies() {

1697 req.AddCookie(c)

1698 }

1699 // This is used by the upstream to validate the signature.

1700 st.authenticator.auth = hmacauth.NewHmacAuth(

1701 crypto.SHA1, []byte(key), upstream.SignatureHeader, upstream.SignatureHeaders)

1702 proxy.ServeHTTP(st.rw, req)

1703

1704 return nil

1705}

1706

1707func TestRequestSignature(t *testing.T) {

1708 testCases := map[string]struct {

1709 method string

1710 body string

1711 key string

1712 resp string

1713 }{

1714 "No request signature": {

1715 method: "GET",

1716 body: "",

1717 key: "",

1718 resp: "no signature received",

1719 },

1720 "Get request": {

1721 method: "GET",

1722 body: "",

1723 key: "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d",

1724 resp: "signatures match",

1725 },

1726 "Post request": {

1727 method: "POST",

1728 body: `{ "hello": "world!" }`,

1729 key: "d90df39e2d19282840252612dd7c81421a372f61",

1730 resp: "signatures match",

1731 },

1732 }

1733 for name, tc := range testCases {

1734 t.Run(name, func(t *testing.T) {

1735 st, err := NewSignatureTest()

1736 if err != nil {

1737 t.Fatal(err)

1738 }

1739 t.Cleanup(st.Close)

1740 if tc.key != "" {

1741 st.opts.SignatureKey = fmt.Sprintf("sha1:%s", tc.key)

1742 }

1743 err = st.MakeRequestWithExpectedKey(tc.method, tc.body, tc.key)

1744 assert.NoError(t, err)

1745 assert.Equal(t, 200, st.rw.Code)

1746 assert.Equal(t, tc.resp, st.rw.Body.String())

1747 })

1748 }

1749}

1750

1751func TestGetRedirect(t *testing.T) {

1752 opts := baseTestOptions()

1753 opts.WhitelistDomains = append(opts.WhitelistDomains, ".example.com")

1754 opts.WhitelistDomains = append(opts.WhitelistDomains, ".example.com:8443")

1755 err := validation.Validate(opts)

1756 assert.NoError(t, err)

1757 require.NotEmpty(t, opts.ProxyPrefix)

1758 proxy, err := NewOAuthProxy(opts, func(s string) bool { return false })

1759 if err != nil {

1760 t.Fatal(err)

1761 }

1762

1763 tests := []struct {

1764 name string

1765 url string

1766 headers map[string]string

1767 reverseProxy bool

1768 expectedRedirect string

1769 }{

1770 {

1771 name: "request outside of ProxyPrefix redirects to original URL",

1772 url: "/foo/bar",

1773 headers: nil,

1774 reverseProxy: false,

1775 expectedRedirect: "/foo/bar",

1776 },

1777 {

1778 name: "request with query preserves query",

1779 url: "/foo?bar",

1780 headers: nil,

1781 reverseProxy: false,

1782 expectedRedirect: "/foo?bar",

1783 },

1784 {

1785 name: "request under ProxyPrefix redirects to root",

1786 url: proxy.ProxyPrefix + "/foo/bar",

1787 headers: nil,

1788 reverseProxy: false,

1789 expectedRedirect: "/",

1790 },

1791 {

1792 name: "proxied request outside of ProxyPrefix redirects to proxied URL",

1793 url: "https://oauth.example.com/foo/bar",

1794 headers: map[string]string{

1795 "X-Forwarded-Proto": "https",

1796 "X-Forwarded-Host": "a-service.example.com",

1797 "X-Forwarded-Uri": "/foo/bar",

1798 },

1799 reverseProxy: true,

1800 expectedRedirect: "https://a-service.example.com/foo/bar",

1801 },

1802 {

1803 name: "non-proxied request with spoofed proxy headers wouldn't redirect",

1804 url: "https://oauth.example.com/foo?bar",

1805 headers: map[string]string{

1806 "X-Forwarded-Proto": "https",

1807 "X-Forwarded-Host": "a-service.example.com",

1808 "X-Forwarded-Uri": "/foo/bar",

1809 },

1810 reverseProxy: false,

1811 expectedRedirect: "/foo?bar",

1812 },

1813 {

1814 name: "proxied request under ProxyPrefix redirects to root",

1815 url: "https://oauth.example.com" + proxy.ProxyPrefix + "/foo/bar",

1816 headers: map[string]string{

1817 "X-Forwarded-Proto": "https",

1818 "X-Forwarded-Host": "a-service.example.com",

1819 "X-Forwarded-Uri": proxy.ProxyPrefix + "/foo/bar",

1820 },

1821 reverseProxy: true,

1822 expectedRedirect: "https://a-service.example.com/",

1823 },

1824 {

1825 name: "proxied request with port under ProxyPrefix redirects to root",

1826 url: "https://oauth.example.com" + proxy.ProxyPrefix + "/foo/bar",

1827 headers: map[string]string{

1828 "X-Forwarded-Proto": "https",

1829 "X-Forwarded-Host": "a-service.example.com:8443",

1830 "X-Forwarded-Uri": proxy.ProxyPrefix + "/foo/bar",

1831 },

1832 reverseProxy: true,

1833 expectedRedirect: "https://a-service.example.com:8443/",

1834 },

1835 {

1836 name: "proxied request with missing uri header would still redirect to desired redirect",

1837 url: "https://oauth.example.com/foo?bar",

1838 headers: map[string]string{

1839 "X-Forwarded-Proto": "https",

1840 "X-Forwarded-Host": "a-service.example.com",

1841 },

1842 reverseProxy: true,

1843 expectedRedirect: "https://a-service.example.com/foo?bar",

1844 },

1845 {

1846 name: "request with headers proxy not being set (and reverse proxy enabled) would still redirect to desired redirect",

1847 url: "https://oauth.example.com/foo?bar",

1848 headers: nil,

1849 reverseProxy: true,

1850 expectedRedirect: "/foo?bar",

1851 },

1852 {

1853 name: "proxied request with X-Auth-Request-Redirect being set outside of ProxyPrefix redirects to proxied URL",

1854 url: "https://oauth.example.com/foo/bar",

1855 headers: map[string]string{

1856 "X-Auth-Request-Redirect": "https://a-service.example.com/foo/bar",

1857 "X-Forwarded-Proto": "",

1858 "X-Forwarded-Host": "",

1859 "X-Forwarded-Uri": "",

1860 },

1861 reverseProxy: true,

1862 expectedRedirect: "https://a-service.example.com/foo/bar",

1863 },

1864 {

1865 name: "proxied request with rd query string redirects to proxied URL",

1866 url: "https://oauth.example.com/foo/bar?rd=https%3A%2F%2Fa%2Dservice%2Eexample%2Ecom%2Ffoo%2Fbar",

1867 headers: nil,

1868 reverseProxy: false,

1869 expectedRedirect: "https://a-service.example.com/foo/bar",

1870 },

1871 {

1872 name: "proxied request with rd query string and all headers set (and reverse proxy not enabled) redirects to proxied URL on rd query string",

1873 url: "https://oauth.example.com/foo/bar?rd=https%3A%2F%2Fa%2Dservice%2Eexample%2Ecom%2Ffoo%2Fjazz",

1874 headers: map[string]string{

1875 "X-Auth-Request-Redirect": "https://a-service.example.com/foo/baz",

1876 "X-Forwarded-Proto": "http",

1877 "X-Forwarded-Host": "another-service.example.com",

1878 "X-Forwarded-Uri": "/seasons/greetings",

1879 },

1880 reverseProxy: false,

1881 expectedRedirect: "https://a-service.example.com/foo/jazz",

1882 },

1883 {

1884 name: "proxied request with rd query string and some headers set redirects to proxied URL on rd query string",

1885 url: "https://oauth.example.com/foo/bar?rd=https%3A%2F%2Fa%2Dservice%2Eexample%2Ecom%2Ffoo%2Fbaz",

1886 headers: map[string]string{

1887 "X-Auth-Request-Redirect": "",

1888 "X-Forwarded-Proto": "https",

1889 "X-Forwarded-Host": "another-service.example.com",

1890 "X-Forwarded-Uri": "/seasons/greetings",

1891 },

1892 reverseProxy: true,

1893 expectedRedirect: "https://a-service.example.com/foo/baz",

1894 },

1895 }

1896 for _, tt := range tests {

1897 t.Run(tt.name, func(t *testing.T) {

1898 req, _ := http.NewRequest("GET", tt.url, nil)

1899 for header, value := range tt.headers {

1900 if value != "" {

1901 req.Header.Add(header, value)

1902 }

1903 }

1904 proxy.ReverseProxy = tt.reverseProxy

1905 redirect, err := proxy.GetRedirect(req)

1906

1907 assert.NoError(t, err)

1908 assert.Equal(t, tt.expectedRedirect, redirect)

1909 })

1910 }

1911}

1912

1913type ajaxRequestTest struct {

1914 opts *options.Options

1915 proxy *OAuthProxy

1916}

1917

1918func newAjaxRequestTest() (*ajaxRequestTest, error) {

1919 test := &ajaxRequestTest{}

1920 test.opts = baseTestOptions()

1921 err := validation.Validate(test.opts)

1922 if err != nil {

1923 return nil, err

1924 }

1925

1926 test.proxy, err = NewOAuthProxy(test.opts, func(email string) bool {

1927 return true

1928 })

1929 if err != nil {

1930 return nil, err

1931 }

1932 return test, nil

1933}

1934

1935func (test *ajaxRequestTest) getEndpoint(endpoint string, header http.Header) (int, http.Header, error) {

1936 rw := httptest.NewRecorder()

1937 req, err := http.NewRequest(http.MethodGet, endpoint, strings.NewReader(""))

1938 if err != nil {

1939 return 0, nil, err

1940 }

1941 req.Header = header

1942 test.proxy.ServeHTTP(rw, req)

1943 return rw.Code, rw.Header(), nil

1944}

1945

1946func testAjaxUnauthorizedRequest(t *testing.T, header http.Header) {

1947 test, err := newAjaxRequestTest()

1948 if err != nil {

1949 t.Fatal(err)

1950 }

1951 endpoint := "/test"

1952

1953 code, rh, err := test.getEndpoint(endpoint, header)

1954 assert.NoError(t, err)

1955 assert.Equal(t, http.StatusUnauthorized, code)

1956 mime := rh.Get("Content-Type")

1957 assert.Equal(t, applicationJSON, mime)

1958}

1959func TestAjaxUnauthorizedRequest1(t *testing.T) {

1960 header := make(http.Header)

1961 header.Add("accept", applicationJSON)

1962

1963 testAjaxUnauthorizedRequest(t, header)

1964}

1965

1966func TestAjaxUnauthorizedRequest2(t *testing.T) {

1967 header := make(http.Header)

1968 header.Add("Accept", applicationJSON)

1969

1970 testAjaxUnauthorizedRequest(t, header)

1971}

1972

1973func TestAjaxForbiddendRequest(t *testing.T) {

1974 test, err := newAjaxRequestTest()

1975 if err != nil {

1976 t.Fatal(err)

1977 }

1978 endpoint := "/test"

1979 header := make(http.Header)

1980 code, rh, err := test.getEndpoint(endpoint, header)

1981 assert.NoError(t, err)

1982 assert.Equal(t, http.StatusForbidden, code)

1983 mime := rh.Get("Content-Type")

1984 assert.NotEqual(t, applicationJSON, mime)

1985}

1986

1987func TestClearSplitCookie(t *testing.T) {

1988 opts := baseTestOptions()

1989 opts.Cookie.Secret = base64CookieSecret

1990 opts.Cookie.Name = "oauth2"

1991 opts.Cookie.Domains = []string{"abc"}

1992 err := validation.Validate(opts)

1993 assert.NoError(t, err)

1994

1995 store, err := sessionscookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)

1996 if err != nil {

1997 t.Fatal(err)

1998 }

1999

2000 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}

2001 var rw = httptest.NewRecorder()

2002 req := httptest.NewRequest("get", "/", nil)

2003

2004 req.AddCookie(&http.Cookie{

2005 Name: "test1",

2006 Value: "test1",

2007 })

2008 req.AddCookie(&http.Cookie{

2009 Name: "oauth2_0",

2010 Value: "oauth2_0",

2011 })

2012 req.AddCookie(&http.Cookie{

2013 Name: "oauth2_1",

2014 Value: "oauth2_1",

2015 })

2016

2017 err = p.ClearSessionCookie(rw, req)

2018 assert.NoError(t, err)

2019 header := rw.Header()

2020

2021 assert.Equal(t, 2, len(header["Set-Cookie"]), "should have 3 set-cookie header entries")

2022}

2023

2024func TestClearSingleCookie(t *testing.T) {

2025 opts := baseTestOptions()

2026 opts.Cookie.Name = "oauth2"

2027 opts.Cookie.Domains = []string{"abc"}

2028 store, err := sessionscookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)

2029 if err != nil {

2030 t.Fatal(err)

2031 }

2032

2033 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}

2034 var rw = httptest.NewRecorder()

2035 req := httptest.NewRequest("get", "/", nil)

2036

2037 req.AddCookie(&http.Cookie{

2038 Name: "test1",

2039 Value: "test1",

2040 })

2041 req.AddCookie(&http.Cookie{

2042 Name: "oauth2",

2043 Value: "oauth2",

2044 })

2045

2046 err = p.ClearSessionCookie(rw, req)

2047 assert.NoError(t, err)

2048 header := rw.Header()

2049

2050 assert.Equal(t, 1, len(header["Set-Cookie"]), "should have 1 set-cookie header entries")

2051}

2052

2053type NoOpKeySet struct {

2054}

2055

2056func (NoOpKeySet) VerifySignature(_ context.Context, jwt string) (payload []byte, err error) {

2057 splitStrings := strings.Split(jwt, ".")

2058 payloadString := splitStrings[1]

2059 return base64.RawURLEncoding.DecodeString(payloadString)

2060}

2061

2062func TestGetJwtSession(t *testing.T) {

2063 /* token payload:

2064 {

2065 "sub": "1234567890",

2066 "aud": "https://test.myapp.com",

2067 "name": "John Doe",

2068 "email": "john@example.com",

2069 "iss": "https://issuer.example.com",

2070 "iat": 1553691215,

2071 "exp": 1912151821

2072 }

2073 */

2074 goodJwt := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9." +

2075 "eyJzdWIiOiIxMjM0NTY3ODkwIiwiYXVkIjoiaHR0cHM6Ly90ZXN0Lm15YXBwLmNvbSIsIm5hbWUiOiJKb2huIERvZSIsImVtY" +

2076 "WlsIjoiam9obkBleGFtcGxlLmNvbSIsImlzcyI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUuY29tIiwiaWF0IjoxNTUzNjkxMj" +

2077 "E1LCJleHAiOjE5MTIxNTE4MjF9." +

2078 "rLVyzOnEldUq_pNkfa-WiV8TVJYWyZCaM2Am_uo8FGg11zD7l-qmz3x1seTvqpH6Y0Ty00fmv6dJnGnC8WMnPXQiodRTfhBSe" +

2079 "OKZMu0HkMD2sg52zlKkbfLTO6ic5VnbVgwjjrB8am_Ta6w7kyFUaB5C1BsIrrLMldkWEhynbb8"

2080

2081 keyset := NoOpKeySet{}

2082 verifier := oidc.NewVerifier("https://issuer.example.com", keyset,

2083 &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})

2084

2085 test, err := NewAuthOnlyEndpointTest("", func(opts *options.Options) {

2086 opts.InjectRequestHeaders = []options.Header{

2087 {

2088 Name: "Authorization",

2089 Values: []options.HeaderValue{

2090 {

2091 ClaimSource: &options.ClaimSource{

2092 Claim: "id_token",

2093 Prefix: "Bearer ",

2094 },

2095 },

2096 },

2097 },

2098 {

2099 Name: "X-Forwarded-User",

2100 Values: []options.HeaderValue{

2101 {

2102 ClaimSource: &options.ClaimSource{

2103 Claim: "user",

2104 },

2105 },

2106 },

2107 },

2108 {

2109 Name: "X-Forwarded-Email",

2110 Values: []options.HeaderValue{

2111 {

2112 ClaimSource: &options.ClaimSource{

2113 Claim: "email",

2114 },

2115 },

2116 },

2117 },

2118 }

2119

2120 opts.InjectResponseHeaders = []options.Header{

2121 {

2122 Name: "Authorization",

2123 Values: []options.HeaderValue{

2124 {

2125 ClaimSource: &options.ClaimSource{

2126 Claim: "id_token",

2127 Prefix: "Bearer ",

2128 },

2129 },

2130 },

2131 },

2132 {

2133 Name: "X-Auth-Request-User",

2134 Values: []options.HeaderValue{

2135 {

2136 ClaimSource: &options.ClaimSource{

2137 Claim: "user",

2138 },

2139 },

2140 },

2141 },

2142 {

2143 Name: "X-Auth-Request-Email",

2144 Values: []options.HeaderValue{

2145 {

2146 ClaimSource: &options.ClaimSource{

2147 Claim: "email",

2148 },

2149 },

2150 },

2151 },

2152 }

2153 opts.SkipJwtBearerTokens = true

2154 opts.SetJWTBearerVerifiers(append(opts.GetJWTBearerVerifiers(), verifier))

2155 })

2156 if err != nil {

2157 t.Fatal(err)

2158 }

2159 tp, _ := test.proxy.provider.(*TestProvider)

2160 tp.GroupValidator = func(s string) bool {

2161 return true

2162 }

2163

2164 authHeader := fmt.Sprintf("Bearer %s", goodJwt)

2165 test.req.Header = map[string][]string{

2166 "Authorization": {authHeader},

2167 }

2168

2169 test.proxy.ServeHTTP(test.rw, test.req)

2170 if test.rw.Code >= 400 {

2171 t.Fatalf("expected 3xx got %d", test.rw.Code)

2172 }

2173

2174 // Check PassAuthorization, should overwrite Basic header

2175 assert.Equal(t, test.req.Header.Get("Authorization"), authHeader)

2176 assert.Equal(t, test.req.Header.Get("X-Forwarded-User"), "1234567890")

2177 assert.Equal(t, test.req.Header.Get("X-Forwarded-Email"), "john@example.com")

2178

2179 // SetAuthorization and SetXAuthRequest

2180 assert.Equal(t, test.rw.Header().Get("Authorization"), authHeader)

2181 assert.Equal(t, test.rw.Header().Get("X-Auth-Request-User"), "1234567890")

2182 assert.Equal(t, test.rw.Header().Get("X-Auth-Request-Email"), "john@example.com")

2183}

2184

2185func Test_prepareNoCache(t *testing.T) {

2186 handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

2187 prepareNoCache(w)

2188 })

2189 mux := http.NewServeMux()

2190 mux.Handle("/", handler)

2191

2192 rec := httptest.NewRecorder()

2193 req := httptest.NewRequest(http.MethodGet, "/", nil)

2194 mux.ServeHTTP(rec, req)

2195

2196 for k, v := range noCacheHeaders {

2197 assert.Equal(t, rec.Header().Get(k), v)

2198 }

2199}

2200

2201func Test_noCacheHeaders(t *testing.T) {

2202 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

2203 _, err := w.Write([]byte("upstream"))

2204 if err != nil {

2205 t.Error(err)

2206 }

2207 }))

2208 t.Cleanup(upstreamServer.Close)

2209

2210 opts := baseTestOptions()

2211 opts.UpstreamServers = options.Upstreams{

2212 {

2213 ID: upstreamServer.URL,

2214 Path: "/",

2215 URI: upstreamServer.URL,

2216 },

2217 }

2218 opts.SkipAuthRegex = []string{".*"}

2219 err := validation.Validate(opts)

2220 assert.NoError(t, err)

2221 proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })

2222 if err != nil {

2223 t.Fatal(err)

2224 }

2225

2226 t.Run("not exist in response from upstream", func(t *testing.T) {

2227 rec := httptest.NewRecorder()

2228 req := httptest.NewRequest(http.MethodGet, "/upstream", nil)

2229 proxy.ServeHTTP(rec, req)

2230

2231 assert.Equal(t, http.StatusOK, rec.Code)

2232 assert.Equal(t, "upstream", rec.Body.String())

2233

2234 // checking noCacheHeaders does not exists in response headers from upstream

2235 for k := range noCacheHeaders {

2236 assert.Equal(t, "", rec.Header().Get(k))

2237 }

2238 })

2239

2240 t.Run("has no-cache", func(t *testing.T) {

2241 tests := []struct {

2242 path string

2243 hasNoCache bool

2244 }{

2245 {

2246 path: "/oauth2/sign_in",

2247 hasNoCache: true,

2248 },

2249 {

2250 path: "/oauth2/sign_out",

2251 hasNoCache: true,

2252 },

2253 {

2254 path: "/oauth2/start",

2255 hasNoCache: true,

2256 },

2257 {

2258 path: "/oauth2/callback",

2259 hasNoCache: true,

2260 },

2261 {

2262 path: "/oauth2/auth",

2263 hasNoCache: false,

2264 },

2265 {

2266 path: "/oauth2/userinfo",

2267 hasNoCache: true,

2268 },

2269 {

2270 path: "/upstream",

2271 hasNoCache: false,

2272 },

2273 }

2274

2275 for _, tt := range tests {

2276 t.Run(tt.path, func(t *testing.T) {

2277 rec := httptest.NewRecorder()

2278 req := httptest.NewRequest(http.MethodGet, tt.path, nil)

2279 proxy.ServeHTTP(rec, req)

2280 cacheControl := rec.Result().Header.Get("Cache-Control")

2281 if tt.hasNoCache != (strings.Contains(cacheControl, "no-cache")) {

2282 t.Errorf(`unexpected "Cache-Control" header: %s`, cacheControl)

2283 }

2284 })

2285 }

2286

2287 })

2288}

2289

2290func baseTestOptions() *options.Options {

2291 opts := options.NewOptions()

2292 opts.Cookie.Secret = rawCookieSecret

2293 opts.ClientID = clientID

2294 opts.ClientSecret = clientSecret

2295 opts.EmailDomains = []string{"*"}

2296

2297 // Default injected headers for legacy configuration

2298 opts.InjectRequestHeaders = []options.Header{

2299 {

2300 Name: "Authorization",

2301 Values: []options.HeaderValue{

2302 {

2303 ClaimSource: &options.ClaimSource{

2304 Claim: "user",

2305 BasicAuthPassword: &options.SecretSource{

2306 Value: []byte(base64.StdEncoding.EncodeToString([]byte("This is a secure password"))),

2307 },

2308 },

2309 },

2310 },

2311 },

2312 {

2313 Name: "X-Forwarded-User",

2314 Values: []options.HeaderValue{

2315 {

2316 ClaimSource: &options.ClaimSource{

2317 Claim: "user",

2318 },

2319 },

2320 },

2321 },

2322 {

2323 Name: "X-Forwarded-Email",

2324 Values: []options.HeaderValue{

2325 {

2326 ClaimSource: &options.ClaimSource{

2327 Claim: "email",

2328 },

2329 },

2330 },

2331 },

2332 }

2333 return opts

2334}

2335

2336func TestTrustedIPs(t *testing.T) {

2337 tests := []struct {

2338 name string

2339 trustedIPs []string

2340 reverseProxy bool

2341 realClientIPHeader string

2342 req *http.Request

2343 expectTrusted bool

2344 }{

2345 // Check unconfigured behavior.

2346 {

2347 name: "Default",

2348 trustedIPs: nil,

2349 reverseProxy: false,

2350 realClientIPHeader: "X-Real-IP", // Default value

2351 req: func() *http.Request {

2352 req, _ := http.NewRequest("GET", "/", nil)

2353 return req

2354 }(),

2355 expectTrusted: false,

2356 },

2357 // Check using req.RemoteAddr (Options.ReverseProxy == false).

2358 {

2359 name: "WithRemoteAddr",

2360 trustedIPs: []string{"127.0.0.1"},

2361 reverseProxy: false,

2362 realClientIPHeader: "X-Real-IP", // Default value

2363 req: func() *http.Request {

2364 req, _ := http.NewRequest("GET", "/", nil)

2365 req.RemoteAddr = "127.0.0.1:43670"

2366 return req

2367 }(),

2368 expectTrusted: true,

2369 },

2370 // Check ignores req.RemoteAddr match when behind a reverse proxy / missing header.

2371 {

2372 name: "IgnoresRemoteAddrInReverseProxyMode",

2373 trustedIPs: []string{"127.0.0.1"},

2374 reverseProxy: true,

2375 realClientIPHeader: "X-Real-IP", // Default value

2376 req: func() *http.Request {

2377 req, _ := http.NewRequest("GET", "/", nil)

2378 req.RemoteAddr = "127.0.0.1:44324"

2379 return req

2380 }(),

2381 expectTrusted: false,

2382 },

2383 // Check successful trusting of localhost in IPv4.

2384 {

2385 name: "TrustsLocalhostInReverseProxyMode",

2386 trustedIPs: []string{"127.0.0.0/8", "::1"},

2387 reverseProxy: true,

2388 realClientIPHeader: "X-Forwarded-For",

2389 req: func() *http.Request {

2390 req, _ := http.NewRequest("GET", "/", nil)

2391 req.Header.Add("X-Forwarded-For", "127.0.0.1")

2392 return req

2393 }(),

2394 expectTrusted: true,

2395 },

2396 // Check successful trusting of localhost in IPv6.

2397 {

2398 name: "TrustsIP6LocalostInReverseProxyMode",

2399 trustedIPs: []string{"127.0.0.0/8", "::1"},

2400 reverseProxy: true,

2401 realClientIPHeader: "X-Forwarded-For",

2402 req: func() *http.Request {

2403 req, _ := http.NewRequest("GET", "/", nil)

2404 req.Header.Add("X-Forwarded-For", "::1")

2405 return req

2406 }(),

2407 expectTrusted: true,

2408 },

2409 // Check does not trust random IPv4 address.

2410 {

2411 name: "DoesNotTrustRandomIP4Address",

2412 trustedIPs: []string{"127.0.0.0/8", "::1"},

2413 reverseProxy: true,

2414 realClientIPHeader: "X-Forwarded-For",

2415 req: func() *http.Request {

2416 req, _ := http.NewRequest("GET", "/", nil)

2417 req.Header.Add("X-Forwarded-For", "12.34.56.78")

2418 return req

2419 }(),

2420 expectTrusted: false,

2421 },

2422 // Check does not trust random IPv6 address.

2423 {

2424 name: "DoesNotTrustRandomIP6Address",

2425 trustedIPs: []string{"127.0.0.0/8", "::1"},

2426 reverseProxy: true,

2427 realClientIPHeader: "X-Forwarded-For",

2428 req: func() *http.Request {

2429 req, _ := http.NewRequest("GET", "/", nil)

2430 req.Header.Add("X-Forwarded-For", "::2")

2431 return req

2432 }(),

2433 expectTrusted: false,

2434 },

2435 // Check respects correct header.

2436 {

2437 name: "RespectsCorrectHeaderInReverseProxyMode",

2438 trustedIPs: []string{"127.0.0.0/8", "::1"},

2439 reverseProxy: true,

2440 realClientIPHeader: "X-Forwarded-For",

2441 req: func() *http.Request {

2442 req, _ := http.NewRequest("GET", "/", nil)

2443 req.Header.Add("X-Real-IP", "::1")

2444 return req

2445 }(),

2446 expectTrusted: false,

2447 },

2448 // Check doesn't trust if garbage is provided.

2449 {

2450 name: "DoesNotTrustGarbageInReverseProxyMode",

2451 trustedIPs: []string{"127.0.0.0/8", "::1"},

2452 reverseProxy: true,

2453 realClientIPHeader: "X-Forwarded-For",

2454 req: func() *http.Request {

2455 req, _ := http.NewRequest("GET", "/", nil)

2456 req.Header.Add("X-Forwarded-For", "adsfljk29242as!!")

2457 return req

2458 }(),

2459 expectTrusted: false,

2460 },

2461 // Check doesn't trust if garbage is provided (no reverse-proxy).

2462 {

2463 name: "DoesNotTrustGarbage",

2464 trustedIPs: []string{"127.0.0.0/8", "::1"},

2465 reverseProxy: false,

2466 realClientIPHeader: "X-Real-IP",

2467 req: func() *http.Request {

2468 req, _ := http.NewRequest("GET", "/", nil)

2469 req.RemoteAddr = "adsfljk29242as!!"

2470 return req

2471 }(),

2472 expectTrusted: false,

2473 },

2474 }

2475

2476 for _, tt := range tests {

2477 t.Run(tt.name, func(t *testing.T) {

2478 opts := baseTestOptions()

2479 opts.UpstreamServers = options.Upstreams{

2480 {

2481 ID: "static",

2482 Path: "/",

2483 Static: true,

2484 },

2485 }

2486 opts.TrustedIPs = tt.trustedIPs

2487 opts.ReverseProxy = tt.reverseProxy

2488 opts.RealClientIPHeader = tt.realClientIPHeader

2489 err := validation.Validate(opts)

2490 assert.NoError(t, err)

2491

2492 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })

2493 assert.NoError(t, err)

2494 rw := httptest.NewRecorder()

2495

2496 proxy.ServeHTTP(rw, tt.req)

2497 if tt.expectTrusted {

2498 assert.Equal(t, 200, rw.Code)

2499 } else {

2500 assert.Equal(t, 403, rw.Code)

2501 }

2502 })

2503 }

2504}

2505

2506func Test_buildRoutesAllowlist(t *testing.T) {

2507 type expectedAllowedRoute struct {

2508 method string

2509 regexString string

2510 }

2511

2512 testCases := []struct {

2513 name string

2514 skipAuthRegex []string

2515 skipAuthRoutes []string

2516 expectedRoutes []expectedAllowedRoute

2517 shouldError bool

2518 }{

2519 {

2520 name: "No skip auth configured",

2521 skipAuthRegex: []string{},

2522 skipAuthRoutes: []string{},

2523 expectedRoutes: []expectedAllowedRoute{},

2524 shouldError: false,

2525 },

2526 {

2527 name: "Only skipAuthRegex configured",

2528 skipAuthRegex: []string{

2529 "^/foo/bar",

2530 "^/baz/[0-9]+/thing",

2531 },

2532 skipAuthRoutes: []string{},

2533 expectedRoutes: []expectedAllowedRoute{

2534 {

2535 method: "",

2536 regexString: "^/foo/bar",

2537 },

2538 {

2539 method: "",

2540 regexString: "^/baz/[0-9]+/thing",

2541 },

2542 },

2543 shouldError: false,

2544 },

2545 {

2546 name: "Only skipAuthRoutes configured",

2547 skipAuthRegex: []string{},

2548 skipAuthRoutes: []string{

2549 "GET=^/foo/bar",

2550 "POST=^/baz/[0-9]+/thing",

2551 "^/all/methods$",

2552 "WEIRD=^/methods/are/allowed",

2553 "PATCH=/second/equals?are=handled&just=fine",

2554 },

2555 expectedRoutes: []expectedAllowedRoute{

2556 {

2557 method: "GET",

2558 regexString: "^/foo/bar",

2559 },

2560 {

2561 method: "POST",

2562 regexString: "^/baz/[0-9]+/thing",

2563 },

2564 {

2565 method: "",

2566 regexString: "^/all/methods$",

2567 },

2568 {

2569 method: "WEIRD",

2570 regexString: "^/methods/are/allowed",

2571 },

2572 {

2573 method: "PATCH",

2574 regexString: "/second/equals?are=handled&just=fine",

2575 },

2576 },

2577 shouldError: false,

2578 },

2579 {

2580 name: "Both skipAuthRegexes and skipAuthRoutes configured",

2581 skipAuthRegex: []string{

2582 "^/foo/bar/regex",

2583 "^/baz/[0-9]+/thing/regex",

2584 },

2585 skipAuthRoutes: []string{

2586 "GET=^/foo/bar",

2587 "POST=^/baz/[0-9]+/thing",

2588 "^/all/methods$",

2589 },

2590 expectedRoutes: []expectedAllowedRoute{

2591 {

2592 method: "",

2593 regexString: "^/foo/bar/regex",

2594 },

2595 {

2596 method: "",

2597 regexString: "^/baz/[0-9]+/thing/regex",

2598 },

2599 {

2600 method: "GET",

2601 regexString: "^/foo/bar",

2602 },

2603 {

2604 method: "POST",

2605 regexString: "^/baz/[0-9]+/thing",

2606 },

2607 {

2608 method: "",

2609 regexString: "^/all/methods$",

2610 },

2611 },

2612 shouldError: false,

2613 },

2614 {

2615 name: "Invalid skipAuthRegex entry",

2616 skipAuthRegex: []string{

2617 "^/foo/bar",

2618 "^/baz/[0-9]+/thing",

2619 "(bad[regex",

2620 },

2621 skipAuthRoutes: []string{},

2622 expectedRoutes: []expectedAllowedRoute{},

2623 shouldError: true,

2624 },

2625 {

2626 name: "Invalid skipAuthRoutes entry",

2627 skipAuthRegex: []string{},

2628 skipAuthRoutes: []string{

2629 "GET=^/foo/bar",

2630 "POST=^/baz/[0-9]+/thing",

2631 "^/all/methods$",

2632 "PUT=(bad[regex",

2633 },

2634 expectedRoutes: []expectedAllowedRoute{},

2635 shouldError: true,

2636 },

2637 }

2638

2639 for _, tc := range testCases {

2640 t.Run(tc.name, func(t *testing.T) {

2641 opts := &options.Options{

2642 SkipAuthRegex: tc.skipAuthRegex,

2643 SkipAuthRoutes: tc.skipAuthRoutes,

2644 }

2645 routes, err := buildRoutesAllowlist(opts)

2646 if tc.shouldError {

2647 assert.Error(t, err)

2648 return

2649 }

2650 assert.NoError(t, err)

2651

2652 for i, route := range routes {

2653 assert.Greater(t, len(tc.expectedRoutes), i)

2654 assert.Equal(t, route.method, tc.expectedRoutes[i].method)

2655 assert.Equal(t, route.pathRegex.String(), tc.expectedRoutes[i].regexString)

2656 }

2657 })

2658 }

2659}

2660

2661func TestAllowedRequest(t *testing.T) {

2662 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

2663 w.WriteHeader(200)

2664 _, err := w.Write([]byte("Allowed Request"))

2665 if err != nil {

2666 t.Fatal(err)

2667 }

2668 }))

2669 t.Cleanup(upstreamServer.Close)

2670

2671 opts := baseTestOptions()

2672 opts.UpstreamServers = options.Upstreams{

2673 {

2674 ID: upstreamServer.URL,

2675 Path: "/",

2676 URI: upstreamServer.URL,

2677 },

2678 }

2679 opts.SkipAuthRegex = []string{

2680 "^/skip/auth/regex$",

2681 }

2682 opts.SkipAuthRoutes = []string{

2683 "GET=^/skip/auth/routes/get",

2684 }

2685 err := validation.Validate(opts)

2686 assert.NoError(t, err)

2687 proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })

2688 if err != nil {

2689 t.Fatal(err)

2690 }

2691

2692 testCases := []struct {

2693 name string

2694 method string

2695 url string

2696 allowed bool

2697 }{

2698 {

2699 name: "Regex GET allowed",

2700 method: "GET",

2701 url: "/skip/auth/regex",

2702 allowed: true,

2703 },

2704 {

2705 name: "Regex POST allowed ",

2706 method: "POST",

2707 url: "/skip/auth/regex",

2708 allowed: true,

2709 },

2710 {

2711 name: "Regex denied",

2712 method: "GET",

2713 url: "/wrong/denied",

2714 allowed: false,

2715 },

2716 {

2717 name: "Route allowed",

2718 method: "GET",

2719 url: "/skip/auth/routes/get",

2720 allowed: true,

2721 },

2722 {

2723 name: "Route denied with wrong method",

2724 method: "PATCH",

2725 url: "/skip/auth/routes/get",

2726 allowed: false,

2727 },

2728 {

2729 name: "Route denied with wrong path",

2730 method: "GET",

2731 url: "/skip/auth/routes/wrong/path",

2732 allowed: false,

2733 },

2734 }

2735

2736 for _, tc := range testCases {

2737 t.Run(tc.name, func(t *testing.T) {

2738 req, err := http.NewRequest(tc.method, tc.url, nil)

2739 assert.NoError(t, err)

2740 assert.Equal(t, tc.allowed, proxy.isAllowedRoute(req))

2741

2742 rw := httptest.NewRecorder()

2743 proxy.ServeHTTP(rw, req)

2744

2745 if tc.allowed {

2746 assert.Equal(t, 200, rw.Code)

2747 assert.Equal(t, "Allowed Request", rw.Body.String())

2748 } else {

2749 assert.Equal(t, 403, rw.Code)

2750 }

2751 })

2752 }

2753}

2754

2755func TestProxyAllowedGroups(t *testing.T) {

2756 tests := []struct {

2757 name string

2758 allowedGroups []string

2759 groups []string

2760 expectUnauthorized bool

2761 }{

2762 {"NoAllowedGroups", []string{}, []string{}, false},

2763 {"NoAllowedGroupsUserHasGroups", []string{}, []string{"a", "b"}, false},

2764 {"UserInAllowedGroup", []string{"a"}, []string{"a", "b"}, false},

2765 {"UserNotInAllowedGroup", []string{"a"}, []string{"c"}, true},

2766 }

2767

2768 for _, tt := range tests {

2769 t.Run(tt.name, func(t *testing.T) {

2770 emailAddress := "test"

2771 created := time.Now()

2772

2773 session := &sessions.SessionState{

2774 Groups: tt.groups,

2775 Email: emailAddress,

2776 AccessToken: "oauth_token",

2777 CreatedAt: &created,

2778 }

2779

2780 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

2781 w.WriteHeader(200)

2782 }))

2783 t.Cleanup(upstreamServer.Close)

2784

2785 test, err := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {

2786 opts.AllowedGroups = tt.allowedGroups

2787 opts.UpstreamServers = options.Upstreams{

2788 {

2789 ID: upstreamServer.URL,

2790 Path: "/",

2791 URI: upstreamServer.URL,

2792 },

2793 }

2794 })

2795 if err != nil {

2796 t.Fatal(err)

2797 }

2798

2799 test.req, _ = http.NewRequest("GET", "/", nil)

2800

2801 test.req.Header.Add("accept", applicationJSON)

2802 err = test.SaveSession(session)

2803 assert.NoError(t, err)

2804 test.proxy.ServeHTTP(test.rw, test.req)

2805

2806 if tt.expectUnauthorized {

2807 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

2808 } else {

2809 assert.Equal(t, http.StatusOK, test.rw.Code)

2810 }

2811 })

2812 }

2813}

2814

2815func TestAuthOnlyAllowedGroups(t *testing.T) {

2816 testCases := []struct {

2817 name string

2818 allowedGroups []string

2819 groups []string

2820 querystring string

2821 expectedStatusCode int

2822 }{

2823 {

2824 name: "NoAllowedGroups",

2825 allowedGroups: []string{},

2826 groups: []string{},

2827 querystring: "",

2828 expectedStatusCode: http.StatusAccepted,

2829 },

2830 {

2831 name: "NoAllowedGroupsUserHasGroups",

2832 allowedGroups: []string{},

2833 groups: []string{"a", "b"},

2834 querystring: "",

2835 expectedStatusCode: http.StatusAccepted,

2836 },

2837 {

2838 name: "UserInAllowedGroup",

2839 allowedGroups: []string{"a"},

2840 groups: []string{"a", "b"},

2841 querystring: "",

2842 expectedStatusCode: http.StatusAccepted,

2843 },

2844 {

2845 name: "UserNotInAllowedGroup",

2846 allowedGroups: []string{"a"},

2847 groups: []string{"c"},

2848 querystring: "",

2849 expectedStatusCode: http.StatusUnauthorized,

2850 },

2851 {

2852 name: "UserInQuerystringGroup",

2853 allowedGroups: []string{"a", "b"},

2854 groups: []string{"a", "c"},

2855 querystring: "?allowed_groups=a",

2856 expectedStatusCode: http.StatusAccepted,

2857 },

2858 {

2859 name: "UserInMultiParamQuerystringGroup",

2860 allowedGroups: []string{"a", "b"},

2861 groups: []string{"b"},

2862 querystring: "?allowed_groups=a&allowed_groups=b,d",

2863 expectedStatusCode: http.StatusAccepted,

2864 },

2865 {

2866 name: "UserInOnlyQuerystringGroup",

2867 allowedGroups: []string{},

2868 groups: []string{"a", "c"},

2869 querystring: "?allowed_groups=a,b",

2870 expectedStatusCode: http.StatusAccepted,

2871 },

2872 {

2873 name: "UserInDelimitedQuerystringGroup",

2874 allowedGroups: []string{"a", "b", "c"},

2875 groups: []string{"c"},

2876 querystring: "?allowed_groups=a,c",

2877 expectedStatusCode: http.StatusAccepted,

2878 },

2879 {

2880 name: "UserNotInQuerystringGroup",

2881 allowedGroups: []string{},

2882 groups: []string{"c"},

2883 querystring: "?allowed_groups=a,b",

2884 expectedStatusCode: http.StatusForbidden,

2885 },

2886 {

2887 name: "UserInConfigGroupNotInQuerystringGroup",

2888 allowedGroups: []string{"a", "b", "c"},

2889 groups: []string{"c"},

2890 querystring: "?allowed_groups=a,b",

2891 expectedStatusCode: http.StatusForbidden,

2892 },

2893 {

2894 name: "UserInQuerystringGroupNotInConfigGroup",

2895 allowedGroups: []string{"a", "b"},

2896 groups: []string{"c"},

2897 querystring: "?allowed_groups=b,c",

2898 expectedStatusCode: http.StatusUnauthorized,

2899 },

2900 }

2901

2902 for _, tc := range testCases {

2903 t.Run(tc.name, func(t *testing.T) {

2904 emailAddress := "test"

2905 created := time.Now()

2906

2907 session := &sessions.SessionState{

2908 Groups: tc.groups,

2909 Email: emailAddress,

2910 AccessToken: "oauth_token",

2911 CreatedAt: &created,

2912 }

2913

2914 test, err := NewAuthOnlyEndpointTest(tc.querystring, func(opts *options.Options) {

2915 opts.AllowedGroups = tc.allowedGroups

2916 })

2917 if err != nil {

2918 t.Fatal(err)

2919 }

2920

2921 err = test.SaveSession(session)

2922 assert.NoError(t, err)

2923

2924 test.proxy.ServeHTTP(test.rw, test.req)

2925

2926 assert.Equal(t, tc.expectedStatusCode, test.rw.Code)

2927 })

2928 }

2929}