oauthproxy_test.go · typeable/oauth2-proxy

1176 expectedResponse: "{\"user\":\"john.doe\",\"email\":\"john.doe@example.com\",\"groups\":[\"example\",\"groups\"],\"preferredUsername\":\"john\"}\n",

1177 },

1178 }

1179

1180 for _, tc := range testCases {

1181 t.Run(tc.name, func(t *testing.T) {

1182 test, err := NewUserInfoEndpointTest()

1183 if err != nil {

1184 t.Fatal(err)

1185 }

1186 err = test.SaveSession(tc.session)

1187 assert.NoError(t, err)

1188

1189 test.proxy.ServeHTTP(test.rw, test.req)

1190 assert.Equal(t, http.StatusOK, test.rw.Code)

1191 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1192 assert.Equal(t, tc.expectedResponse, string(bodyBytes))

1193 })

1194 }

1195}

1196

1197func TestUserInfoEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {

1198 test, err := NewUserInfoEndpointTest()

1199 if err != nil {

1200 t.Fatal(err)

1201 }

1202

1203 test.proxy.ServeHTTP(test.rw, test.req)

1204 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

1205}

1206

1207func NewAuthOnlyEndpointTest(querystring string, modifiers ...OptionsModifier) (*ProcessCookieTest, error) {

1208 pcTest, err := NewProcessCookieTestWithOptionsModifiers(modifiers...)

1209 if err != nil {

1210 return nil, err

1211 }

1212 pcTest.req, _ = http.NewRequest(

1213 "GET",

1214 fmt.Sprintf("%s/auth%s", pcTest.opts.ProxyPrefix, querystring),

1215 nil)

1216 return pcTest, nil

1217}

1218

1219func TestAuthOnlyEndpointAccepted(t *testing.T) {

1220 test, err := NewAuthOnlyEndpointTest("")

1221 if err != nil {

1222 t.Fatal(err)

1223 }

1224

1225 created := time.Now()

1226 startSession := &sessions.SessionState{

1227 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}

1228 err = test.SaveSession(startSession)

1229 assert.NoError(t, err)

1230

1231 test.proxy.ServeHTTP(test.rw, test.req)

1232 assert.Equal(t, http.StatusAccepted, test.rw.Code)

1233 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1234 assert.Equal(t, "", string(bodyBytes))

1235}

1236

1237func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {

1238 test, err := NewAuthOnlyEndpointTest("")

1239 if err != nil {

1240 t.Fatal(err)

1241 }

1242

1243 test.proxy.ServeHTTP(test.rw, test.req)

1244 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

1245 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1246 assert.Equal(t, "Unauthorized\n", string(bodyBytes))

1247}

1248

1249func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {

1250 test, err := NewAuthOnlyEndpointTest("", func(opts *options.Options) {

1251 opts.Cookie.Expire = time.Duration(24) * time.Hour

1252 })

1253 if err != nil {

1254 t.Fatal(err)

1255 }

1256

1257 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)

1258 startSession := &sessions.SessionState{

1259 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}

1260 err = test.SaveSession(startSession)

1261 assert.NoError(t, err)

1262

1263 test.proxy.ServeHTTP(test.rw, test.req)

1264 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

1265 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1266 assert.Equal(t, "Unauthorized\n", string(bodyBytes))

1267}

1268

1269func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {

1270 test, err := NewAuthOnlyEndpointTest("")

1271 if err != nil {

1272 t.Fatal(err)

1273 }

1274

1275 created := time.Now()

1276 startSession := &sessions.SessionState{

1277 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}

1278 err = test.SaveSession(startSession)

1279 assert.NoError(t, err)

1280 test.validateUser = false

1281

1282 test.proxy.ServeHTTP(test.rw, test.req)

1283 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

1284 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1285 assert.Equal(t, "Unauthorized\n", string(bodyBytes))

1286}

1287

1288func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {

1289 var pcTest ProcessCookieTest

1290

1291 pcTest.opts = baseTestOptions()

1292 pcTest.opts.InjectResponseHeaders = []options.Header{

1293 {

1294 Name: "X-Auth-Request-User",

1295 Values: []options.HeaderValue{

1296 {

1297 ClaimSource: &options.ClaimSource{

1298 Claim: "user",

1299 },

1300 },

1301 },

1302 },

1303 {

1304 Name: "X-Auth-Request-Email",

1305 Values: []options.HeaderValue{

1306 {

1307 ClaimSource: &options.ClaimSource{

1308 Claim: "email",

1309 },

1310 },

1311 },

1312 },

1313 {

1314 Name: "X-Auth-Request-Groups",

1315 Values: []options.HeaderValue{

1316 {

1317 ClaimSource: &options.ClaimSource{

1318 Claim: "groups",

1319 },

1320 },

1321 },

1322 },

1323 {

1324 Name: "X-Forwarded-Preferred-Username",

1325 Values: []options.HeaderValue{

1326 {

1327 ClaimSource: &options.ClaimSource{

1328 Claim: "preferred_username",

1329 },

1330 },

1331 },

1332 },

1333 }

1334 pcTest.opts.AllowedGroups = []string{"oauth_groups"}

1335 err := validation.Validate(pcTest.opts)

1336 assert.NoError(t, err)

1337

1338 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {

1339 return pcTest.validateUser

1340 })

1341 if err != nil {

1342 t.Fatal(err)

1343 }

1344 pcTest.proxy.provider = &TestProvider{

1345 ProviderData: &providers.ProviderData{},

1346 ValidToken: true,

1347 }

1348

1349 pcTest.validateUser = true

1350

1351 pcTest.rw = httptest.NewRecorder()

1352 pcTest.req, _ = http.NewRequest("GET",

1353 pcTest.opts.ProxyPrefix+"/auth", nil)

1354

1355 created := time.Now()

1356 startSession := &sessions.SessionState{

1357 User: "oauth_user", Groups: []string{"oauth_groups"}, Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}

1358 err = pcTest.SaveSession(startSession)

1359 assert.NoError(t, err)

1360

1361 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)

1362 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)

1363 assert.Equal(t, "oauth_user", pcTest.rw.Header().Get("X-Auth-Request-User"))

1364 assert.Equal(t, startSession.Groups, pcTest.rw.Header().Values("X-Auth-Request-Groups"))

1365 assert.Equal(t, "oauth_user@example.com", pcTest.rw.Header().Get("X-Auth-Request-Email"))

1366}

1367

1368func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {

1369 var pcTest ProcessCookieTest

1370

1371 pcTest.opts = baseTestOptions()

1372 pcTest.opts.InjectResponseHeaders = []options.Header{

1373 {

1374 Name: "X-Auth-Request-User",

1375 Values: []options.HeaderValue{

1376 {

1377 ClaimSource: &options.ClaimSource{

1378 Claim: "user",

1379 },

1380 },

1381 },

1382 },

1383 {

1384 Name: "X-Auth-Request-Email",

1385 Values: []options.HeaderValue{

1386 {

1387 ClaimSource: &options.ClaimSource{

1388 Claim: "email",

1389 },

1390 },

1391 },

1392 },

1393 {

1394 Name: "X-Auth-Request-Groups",

1395 Values: []options.HeaderValue{

1396 {

1397 ClaimSource: &options.ClaimSource{

1398 Claim: "groups",

1399 },

1400 },

1401 },

1402 },

1403 {

1404 Name: "X-Forwarded-Preferred-Username",

1405 Values: []options.HeaderValue{

1406 {

1407 ClaimSource: &options.ClaimSource{

1408 Claim: "preferred_username",

1409 },

1410 },

1411 },

1412 },

1413 {

1414 Name: "Authorization",

1415 Values: []options.HeaderValue{

1416 {

1417 ClaimSource: &options.ClaimSource{

1418 Claim: "user",

1419 BasicAuthPassword: &options.SecretSource{

1420 Value: []byte("This is a secure password"),

1421 },

1422 },

1423 },

1424 },

1425 },

1426 }

1427

1428 err := validation.Validate(pcTest.opts)

1429 assert.NoError(t, err)

1430

1431 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {

1432 return pcTest.validateUser

1433 })

1434 if err != nil {

1435 t.Fatal(err)

1436 }

1437 pcTest.proxy.provider = &TestProvider{

1438 ProviderData: &providers.ProviderData{},

1439 ValidToken: true,

1440 }

1441

1442 pcTest.validateUser = true

1443

1444 pcTest.rw = httptest.NewRecorder()

1445 pcTest.req, _ = http.NewRequest("GET",

1446 pcTest.opts.ProxyPrefix+"/auth", nil)

1447

1448 created := time.Now()

1449 startSession := &sessions.SessionState{

1450 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}

1451 err = pcTest.SaveSession(startSession)

1452 assert.NoError(t, err)

1453

1454 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)

1455 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)

1456 assert.Equal(t, "oauth_user", pcTest.rw.Header().Values("X-Auth-Request-User")[0])

1457 assert.Equal(t, "oauth_user@example.com", pcTest.rw.Header().Values("X-Auth-Request-Email")[0])

1458 expectedHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte("oauth_user:This is a secure password"))

1459 assert.Equal(t, expectedHeader, pcTest.rw.Header().Values("Authorization")[0])

1460}

1461

1462func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {

1463 var pcTest ProcessCookieTest

1464

1465 pcTest.opts = baseTestOptions()

1466 pcTest.opts.InjectResponseHeaders = []options.Header{

1467 {

1468 Name: "X-Auth-Request-User",

1469 Values: []options.HeaderValue{

1470 {

1471 ClaimSource: &options.ClaimSource{

1472 Claim: "user",

1473 },

1474 },

1475 },

1476 },

1477 {

1478 Name: "X-Auth-Request-Email",

1479 Values: []options.HeaderValue{

1480 {

1481 ClaimSource: &options.ClaimSource{

1482 Claim: "email",

1483 },

1484 },

1485 },

1486 },

1487 {

1488 Name: "X-Auth-Request-Groups",

1489 Values: []options.HeaderValue{

1490 {

1491 ClaimSource: &options.ClaimSource{

1492 Claim: "groups",

1493 },

1494 },

1495 },

1496 },

1497 {

1498 Name: "X-Forwarded-Preferred-Username",

1499 Values: []options.HeaderValue{

1500 {

1501 ClaimSource: &options.ClaimSource{

1502 Claim: "preferred_username",

1503 },

1504 },

1505 },

1506 },

1507 }

1508 err := validation.Validate(pcTest.opts)

1509 assert.NoError(t, err)

1510

1511 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {

1512 return pcTest.validateUser

1513 })

1514 if err != nil {

1515 t.Fatal(err)

1516 }

1517 pcTest.proxy.provider = &TestProvider{

1518 ProviderData: &providers.ProviderData{},

1519 ValidToken: true,

1520 }

1521

1522 pcTest.validateUser = true

1523

1524 pcTest.rw = httptest.NewRecorder()

1525 pcTest.req, _ = http.NewRequest("GET",

1526 pcTest.opts.ProxyPrefix+"/auth", nil)

1527

1528 created := time.Now()

1529 startSession := &sessions.SessionState{

1530 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}

1531 err = pcTest.SaveSession(startSession)

1532 assert.NoError(t, err)

1533

1534 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)

1535 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)

1536 assert.Equal(t, "oauth_user", pcTest.rw.Header().Values("X-Auth-Request-User")[0])

1537 assert.Equal(t, "oauth_user@example.com", pcTest.rw.Header().Values("X-Auth-Request-Email")[0])

1538 assert.Equal(t, 0, len(pcTest.rw.Header().Values("Authorization")), "should not have Authorization header entries")

1539}

1540

1541func TestAuthSkippedForPreflightRequests(t *testing.T) {

1542 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

1543 w.WriteHeader(200)

1544 _, err := w.Write([]byte("response"))

1545 if err != nil {

1546 t.Fatal(err)

1547 }

1548 }))

1549 t.Cleanup(upstreamServer.Close)

1550

1551 opts := baseTestOptions()

1552 opts.UpstreamServers = options.Upstreams{

1553 {

1554 ID: upstreamServer.URL,

1555 Path: "/",

1556 URI: upstreamServer.URL,

1557 },

1558 }

1559 opts.SkipAuthPreflight = true

1560 err := validation.Validate(opts)

1561 assert.NoError(t, err)

1562

1563 upstreamURL, _ := url.Parse(upstreamServer.URL)

1564 opts.SetProvider(NewTestProvider(upstreamURL, ""))

1565

1566 proxy, err := NewOAuthProxy(opts, func(string) bool { return false })

1567 if err != nil {

1568 t.Fatal(err)

1569 }

1570 rw := httptest.NewRecorder()

1571 req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)

1572 proxy.ServeHTTP(rw, req)

1573

1574 assert.Equal(t, 200, rw.Code)

1575 assert.Equal(t, "response", rw.Body.String())

1576}

1577

1578type SignatureAuthenticator struct {

1579 auth hmacauth.HmacAuth

1580}

1581

1582func (v *SignatureAuthenticator) Authenticate(w http.ResponseWriter, r *http.Request) {

1583 result, headerSig, computedSig := v.auth.AuthenticateRequest(r)

1584

1585 var msg string

1586 switch result {

1587 case hmacauth.ResultNoSignature:

1588 msg = "no signature received"

1589 case hmacauth.ResultMatch:

1590 msg = "signatures match"

1591 case hmacauth.ResultMismatch:

1592 msg = fmt.Sprintf(

1593 "signatures do not match:\n received: %s\n computed: %s",

1594 headerSig,

1595 computedSig)

1596 default:

1597 panic("unknown result value: " + result.String())

1598 }

1599

1600 _, err := w.Write([]byte(msg))

1601 if err != nil {

1602 panic(err)

1603 }

1604}

1605

1606type SignatureTest struct {

1607 opts *options.Options

1608 upstream *httptest.Server

1609 upstreamHost string

1610 provider *httptest.Server

1611 header http.Header

1612 rw *httptest.ResponseRecorder

1613 authenticator *SignatureAuthenticator

1614}

1615

1616func NewSignatureTest() (*SignatureTest, error) {

1617 opts := baseTestOptions()

1618 opts.EmailDomains = []string{"acm.org"}

1619

1620 authenticator := &SignatureAuthenticator{}

1621 upstreamServer := httptest.NewServer(

1622 http.HandlerFunc(authenticator.Authenticate))

1623 upstreamURL, err := url.Parse(upstreamServer.URL)

1624 if err != nil {

1625 return nil, err

1626 }

1627 opts.UpstreamServers = options.Upstreams{

1628 {

1629 ID: upstreamServer.URL,

1630 Path: "/",

1631 URI: upstreamServer.URL,

1632 },

1633 }

1634

1635 providerHandler := func(w http.ResponseWriter, r *http.Request) {

1636 _, err := w.Write([]byte(`{"access_token": "my_auth_token"}`))

1637 if err != nil {

1638 panic(err)

1639 }

1640 }

1641 provider := httptest.NewServer(http.HandlerFunc(providerHandler))

1642 providerURL, err := url.Parse(provider.URL)

1643 if err != nil {

1644 return nil, err

1645 }

1646 opts.SetProvider(NewTestProvider(providerURL, "mbland@acm.org"))

1647

1648 return &SignatureTest{

1649 opts,

1650 upstreamServer,

1651 upstreamURL.Host,

1652 provider,

1653 make(http.Header),

1654 httptest.NewRecorder(),

1655 authenticator,

1656 }, nil

1657}

1658

1659func (st *SignatureTest) Close() {

1660 st.provider.Close()

1661 st.upstream.Close()

1662}

1663

1664// fakeNetConn simulates an http.Request.Body buffer that will be consumed

1665// when it is read by the hmacauth.HmacAuth if not handled properly. See:

1666// https://github.com/18F/hmacauth/pull/4

1667type fakeNetConn struct {

1668 reqBody string

1669}

1670

1671func (fnc *fakeNetConn) Read(p []byte) (n int, err error) {

1672 if bodyLen := len(fnc.reqBody); bodyLen != 0 {

1673 copy(p, fnc.reqBody)

1674 fnc.reqBody = ""

1675 return bodyLen, io.EOF

1676 }

1677 return 0, io.EOF

1678}

1679

1680func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) error {

1681 err := validation.Validate(st.opts)

1682 if err != nil {

1683 return err

1684 }

1685 proxy, err := NewOAuthProxy(st.opts, func(email string) bool { return true })

1686 if err != nil {

1687 return err

1688 }

1689

1690 var bodyBuf io.ReadCloser

1691 if body != "" {

1692 bodyBuf = ioutil.NopCloser(&fakeNetConn{reqBody: body})

1693 }

1694 req := httptest.NewRequest(method, "/foo/bar", bodyBuf)

1695 req.Header = st.header

1696

1697 state := &sessions.SessionState{

1698 Email: "mbland@acm.org", AccessToken: "my_access_token"}

1699 err = proxy.SaveSession(st.rw, req, state)

1700 if err != nil {

1701 return err

1702 }

1703 for _, c := range st.rw.Result().Cookies() {

1704 req.AddCookie(c)

1705 }

1706 // This is used by the upstream to validate the signature.

1707 st.authenticator.auth = hmacauth.NewHmacAuth(

1708 crypto.SHA1, []byte(key), upstream.SignatureHeader, upstream.SignatureHeaders)

1709 proxy.ServeHTTP(st.rw, req)

1710

1711 return nil

1712}

1713

1714func TestRequestSignature(t *testing.T) {

1715 testCases := map[string]struct {

1716 method string

1717 body string

1718 key string

1719 resp string

1720 }{

1721 "No request signature": {

1722 method: "GET",

1723 body: "",

1724 key: "",

1725 resp: "no signature received",

1726 },

1727 "Get request": {

1728 method: "GET",

1729 body: "",

1730 key: "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d",

1731 resp: "signatures match",

1732 },

1733 "Post request": {

1734 method: "POST",

1735 body: `{ "hello": "world!" }`,

1736 key: "d90df39e2d19282840252612dd7c81421a372f61",

1737 resp: "signatures match",

1738 },

1739 }

1740 for name, tc := range testCases {

1741 t.Run(name, func(t *testing.T) {

1742 st, err := NewSignatureTest()

1743 if err != nil {

1744 t.Fatal(err)

1745 }

1746 t.Cleanup(st.Close)

1747 if tc.key != "" {

1748 st.opts.SignatureKey = fmt.Sprintf("sha1:%s", tc.key)

1749 }

1750 err = st.MakeRequestWithExpectedKey(tc.method, tc.body, tc.key)

1751 assert.NoError(t, err)

1752 assert.Equal(t, 200, st.rw.Code)

1753 assert.Equal(t, tc.resp, st.rw.Body.String())

1754 })

1755 }

1756}

1757

1758func Test_getAppRedirect(t *testing.T) {

1759 opts := baseTestOptions()

1760 opts.WhitelistDomains = append(opts.WhitelistDomains, ".example.com", ".example.com:8443")

1761 err := validation.Validate(opts)

1762 assert.NoError(t, err)

1763 require.NotEmpty(t, opts.ProxyPrefix)

1764 proxy, err := NewOAuthProxy(opts, func(s string) bool { return false })

1765 if err != nil {

1766 t.Fatal(err)

1767 }

1768

1769 tests := []struct {

1770 name string

1771 url string

1772 headers map[string]string

1773 reverseProxy bool

1774 expectedRedirect string

1775 }{

1776 {

1777 name: "request outside of ProxyPrefix redirects to original URL",

1778 url: "/foo/bar",

1779 headers: nil,

1780 reverseProxy: false,

1781 expectedRedirect: "/foo/bar",

1782 },

1783 {

1784 name: "request with query preserves query",

1785 url: "/foo?bar",

1786 headers: nil,

1787 reverseProxy: false,

1788 expectedRedirect: "/foo?bar",

1789 },

1790 {

1791 name: "request under ProxyPrefix redirects to root",

1792 url: proxy.ProxyPrefix + "/foo/bar",

1793 headers: nil,

1794 reverseProxy: false,

1795 expectedRedirect: "/",

1796 },

1797 {

1798 name: "proxied request outside of ProxyPrefix redirects to proxied URL",

1799 url: "https://oauth.example.com/foo/bar",

1800 headers: map[string]string{

1801 "X-Forwarded-Proto": "https",

1802 "X-Forwarded-Host": "a-service.example.com",

1803 "X-Forwarded-Uri": "/foo/bar",

1804 },

1805 reverseProxy: true,

1806 expectedRedirect: "https://a-service.example.com/foo/bar",

1807 },

1808 {

1809 name: "non-proxied request with spoofed proxy headers wouldn't redirect",

1810 url: "https://oauth.example.com/foo?bar",

1811 headers: map[string]string{

1812 "X-Forwarded-Proto": "https",

1813 "X-Forwarded-Host": "a-service.example.com",

1814 "X-Forwarded-Uri": "/foo/bar",

1815 },

1816 reverseProxy: false,

1817 expectedRedirect: "/foo?bar",

1818 },

1819 {

1820 name: "proxied request under ProxyPrefix redirects to root",

1821 url: "https://oauth.example.com" + proxy.ProxyPrefix + "/foo/bar",

1822 headers: map[string]string{

1823 "X-Forwarded-Proto": "https",

1824 "X-Forwarded-Host": "a-service.example.com",

1825 "X-Forwarded-Uri": proxy.ProxyPrefix + "/foo/bar",

1826 },

1827 reverseProxy: true,

1828 expectedRedirect: "https://a-service.example.com/",

1829 },

1830 {

1831 name: "proxied request with port under ProxyPrefix redirects to root",

1832 url: "https://oauth.example.com" + proxy.ProxyPrefix + "/foo/bar",

1833 headers: map[string]string{

1834 "X-Forwarded-Proto": "https",

1835 "X-Forwarded-Host": "a-service.example.com:8443",

1836 "X-Forwarded-Uri": proxy.ProxyPrefix + "/foo/bar",

1837 },

1838 reverseProxy: true,

1839 expectedRedirect: "https://a-service.example.com:8443/",

1840 },

1841 {

1842 name: "proxied request with missing uri header would still redirect to desired redirect",

1843 url: "https://oauth.example.com/foo?bar",

1844 headers: map[string]string{

1845 "X-Forwarded-Proto": "https",

1846 "X-Forwarded-Host": "a-service.example.com",

1847 },

1848 reverseProxy: true,

1849 expectedRedirect: "https://a-service.example.com/foo?bar",

1850 },

1851 {

1852 name: "request with headers proxy not being set (and reverse proxy enabled) would still redirect to desired redirect",

1853 url: "https://oauth.example.com/foo?bar",

1854 headers: nil,

1855 reverseProxy: true,

1856 expectedRedirect: "/foo?bar",

1857 },

1858 {

1859 name: "proxied request with X-Auth-Request-Redirect being set outside of ProxyPrefix redirects to proxied URL",

1860 url: "https://oauth.example.com/foo/bar",

1861 headers: map[string]string{

1862 "X-Auth-Request-Redirect": "https://a-service.example.com/foo/bar",

1863 },

1864 reverseProxy: true,

1865 expectedRedirect: "https://a-service.example.com/foo/bar",

1866 },

1867 {

1868 name: "proxied request with rd query string redirects to proxied URL",

1869 url: "https://oauth.example.com/foo/bar?rd=https%3A%2F%2Fa%2Dservice%2Eexample%2Ecom%2Ffoo%2Fbar",

1870 headers: nil,

1871 reverseProxy: false,

1872 expectedRedirect: "https://a-service.example.com/foo/bar",

1873 },

1874 {

1875 name: "proxied request with rd query string and all headers set (and reverse proxy not enabled) redirects to proxied URL on rd query string",

1876 url: "https://oauth.example.com/foo/bar?rd=https%3A%2F%2Fa%2Dservice%2Eexample%2Ecom%2Ffoo%2Fjazz",

1877 headers: map[string]string{

1878 "X-Auth-Request-Redirect": "https://a-service.example.com/foo/baz",

1879 "X-Forwarded-Proto": "http",

1880 "X-Forwarded-Host": "another-service.example.com",

1881 "X-Forwarded-Uri": "/seasons/greetings",

1882 },

1883 reverseProxy: false,

1884 expectedRedirect: "https://a-service.example.com/foo/jazz",

1885 },

1886 {

1887 name: "proxied request with rd query string and some headers set redirects to proxied URL on rd query string",

1888 url: "https://oauth.example.com/foo/bar?rd=https%3A%2F%2Fa%2Dservice%2Eexample%2Ecom%2Ffoo%2Fbaz",

1889 headers: map[string]string{

1890 "X-Forwarded-Proto": "https",

1891 "X-Forwarded-Host": "another-service.example.com",

1892 "X-Forwarded-Uri": "/seasons/greetings",

1893 },

1894 reverseProxy: true,

1895 expectedRedirect: "https://a-service.example.com/foo/baz",

1896 },

1897 }

1898 for _, tt := range tests {

1899 t.Run(tt.name, func(t *testing.T) {

1900 req, _ := http.NewRequest("GET", tt.url, nil)

1901 for header, value := range tt.headers {

1902 if value != "" {

1903 req.Header.Add(header, value)

1904 }

1905 }

1906 req = middleware.AddRequestScope(req, &middleware.RequestScope{

1907 ReverseProxy: tt.reverseProxy,

1908 })

1909 redirect, err := proxy.getAppRedirect(req)

1910

1911 assert.NoError(t, err)

1912 assert.Equal(t, tt.expectedRedirect, redirect)

1913 })

1914 }

1915}

1916

1917type ajaxRequestTest struct {

1918 opts *options.Options

1919 proxy *OAuthProxy

1920}

1921

1922func newAjaxRequestTest() (*ajaxRequestTest, error) {

1923 test := &ajaxRequestTest{}

1924 test.opts = baseTestOptions()

1925 err := validation.Validate(test.opts)

1926 if err != nil {

1927 return nil, err

1928 }

1929

1930 test.proxy, err = NewOAuthProxy(test.opts, func(email string) bool {

1931 return true

1932 })

1933 if err != nil {

1934 return nil, err

1935 }

1936 return test, nil

1937}

1938

1939func (test *ajaxRequestTest) getEndpoint(endpoint string, header http.Header) (int, http.Header, error) {

1940 rw := httptest.NewRecorder()

1941 req, err := http.NewRequest(http.MethodGet, endpoint, strings.NewReader(""))

1942 if err != nil {

1943 return 0, nil, err

1944 }

1945 req.Header = header

1946 test.proxy.ServeHTTP(rw, req)

1947 return rw.Code, rw.Header(), nil

1948}

1949

1950func testAjaxUnauthorizedRequest(t *testing.T, header http.Header) {

1951 test, err := newAjaxRequestTest()

1952 if err != nil {

1953 t.Fatal(err)

1954 }

1955 endpoint := "/test"

1956

1957 code, rh, err := test.getEndpoint(endpoint, header)

1958 assert.NoError(t, err)

1959 assert.Equal(t, http.StatusUnauthorized, code)

1960 mime := rh.Get("Content-Type")

1961 assert.Equal(t, applicationJSON, mime)

1962}

1963func TestAjaxUnauthorizedRequest1(t *testing.T) {

1964 header := make(http.Header)

1965 header.Add("accept", applicationJSON)

1966

1967 testAjaxUnauthorizedRequest(t, header)

1968}

1969

1970func TestAjaxUnauthorizedRequest2(t *testing.T) {

1971 header := make(http.Header)

1972 header.Add("Accept", applicationJSON)

1973

1974 testAjaxUnauthorizedRequest(t, header)

1975}

1976

1977func TestAjaxUnauthorizedRequestAccept1(t *testing.T) {

1978 header := make(http.Header)

1979 header.Add("Accept", "application/json, text/plain, */*")

1980

1981 testAjaxUnauthorizedRequest(t, header)

1982}

1983

1984func TestAjaxForbiddendRequest(t *testing.T) {

1985 test, err := newAjaxRequestTest()

1986 if err != nil {

1987 t.Fatal(err)

1988 }

1989 endpoint := "/test"

1990 header := make(http.Header)

1991 code, rh, err := test.getEndpoint(endpoint, header)

1992 assert.NoError(t, err)

1993 assert.Equal(t, http.StatusForbidden, code)

1994 mime := rh.Get("Content-Type")

1995 assert.NotEqual(t, applicationJSON, mime)

1996}

1997

1998func TestClearSplitCookie(t *testing.T) {

1999 opts := baseTestOptions()

2000 opts.Cookie.Secret = base64CookieSecret

2001 opts.Cookie.Name = "oauth2"

2002 opts.Cookie.Domains = []string{"abc"}

2003 err := validation.Validate(opts)

2004 assert.NoError(t, err)

2005

2006 store, err := sessionscookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)

2007 if err != nil {

2008 t.Fatal(err)

2009 }

2010

2011 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}

2012 var rw = httptest.NewRecorder()

2013 req := httptest.NewRequest("get", "/", nil)

2014

2015 req.AddCookie(&http.Cookie{

2016 Name: "test1",

2017 Value: "test1",

2018 })

2019 req.AddCookie(&http.Cookie{

2020 Name: "oauth2_0",

2021 Value: "oauth2_0",

2022 })

2023 req.AddCookie(&http.Cookie{

2024 Name: "oauth2_1",

2025 Value: "oauth2_1",

2026 })

2027

2028 err = p.ClearSessionCookie(rw, req)

2029 assert.NoError(t, err)

2030 header := rw.Header()

2031

2032 assert.Equal(t, 2, len(header["Set-Cookie"]), "should have 3 set-cookie header entries")

2033}

2034

2035func TestClearSingleCookie(t *testing.T) {

2036 opts := baseTestOptions()

2037 opts.Cookie.Name = "oauth2"

2038 opts.Cookie.Domains = []string{"abc"}

2039 store, err := sessionscookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)

2040 if err != nil {

2041 t.Fatal(err)

2042 }

2043

2044 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}

2045 var rw = httptest.NewRecorder()

2046 req := httptest.NewRequest("get", "/", nil)

2047

2048 req.AddCookie(&http.Cookie{

2049 Name: "test1",

2050 Value: "test1",

2051 })

2052 req.AddCookie(&http.Cookie{

2053 Name: "oauth2",

2054 Value: "oauth2",

2055 })

2056

2057 err = p.ClearSessionCookie(rw, req)

2058 assert.NoError(t, err)

2059 header := rw.Header()

2060

2061 assert.Equal(t, 1, len(header["Set-Cookie"]), "should have 1 set-cookie header entries")

2062}

2063

2064type NoOpKeySet struct {

2065}

2066

2067func (NoOpKeySet) VerifySignature(_ context.Context, jwt string) (payload []byte, err error) {

2068 splitStrings := strings.Split(jwt, ".")

2069 payloadString := splitStrings[1]

2070 return base64.RawURLEncoding.DecodeString(payloadString)

2071}

2072

2073func TestGetJwtSession(t *testing.T) {

2074 /* token payload:

2075 {

2076 "sub": "1234567890",

2077 "aud": "https://test.myapp.com",

2078 "name": "John Doe",

2079 "email": "john@example.com",

2080 "iss": "https://issuer.example.com",

2081 "iat": 1553691215,

2082 "exp": 1912151821

2083 }

2084 */

2085 goodJwt := "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9." +

2086 "eyJzdWIiOiIxMjM0NTY3ODkwIiwiYXVkIjoiaHR0cHM6Ly90ZXN0Lm15YXBwLmNvbSIsIm5hbWUiOiJKb2huIERvZSIsImVtY" +

2087 "WlsIjoiam9obkBleGFtcGxlLmNvbSIsImlzcyI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUuY29tIiwiaWF0IjoxNTUzNjkxMj" +

2088 "E1LCJleHAiOjE5MTIxNTE4MjF9." +

2089 "rLVyzOnEldUq_pNkfa-WiV8TVJYWyZCaM2Am_uo8FGg11zD7l-qmz3x1seTvqpH6Y0Ty00fmv6dJnGnC8WMnPXQiodRTfhBSe" +

2090 "OKZMu0HkMD2sg52zlKkbfLTO6ic5VnbVgwjjrB8am_Ta6w7kyFUaB5C1BsIrrLMldkWEhynbb8"

2091

2092 keyset := NoOpKeySet{}

2093 verifier := oidc.NewVerifier("https://issuer.example.com", keyset,

2094 &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})

2095

2096 test, err := NewAuthOnlyEndpointTest("", func(opts *options.Options) {

2097 opts.InjectRequestHeaders = []options.Header{

2098 {

2099 Name: "Authorization",

2100 Values: []options.HeaderValue{

2101 {

2102 ClaimSource: &options.ClaimSource{

2103 Claim: "id_token",

2104 Prefix: "Bearer ",

2105 },

2106 },

2107 },

2108 },

2109 {

2110 Name: "X-Forwarded-User",

2111 Values: []options.HeaderValue{

2112 {

2113 ClaimSource: &options.ClaimSource{

2114 Claim: "user",

2115 },

2116 },

2117 },

2118 },

2119 {

2120 Name: "X-Forwarded-Email",

2121 Values: []options.HeaderValue{

2122 {

2123 ClaimSource: &options.ClaimSource{

2124 Claim: "email",

2125 },

2126 },

2127 },

2128 },

2129 }

2130

2131 opts.InjectResponseHeaders = []options.Header{

2132 {

2133 Name: "Authorization",

2134 Values: []options.HeaderValue{

2135 {

2136 ClaimSource: &options.ClaimSource{

2137 Claim: "id_token",

2138 Prefix: "Bearer ",

2139 },

2140 },

2141 },

2142 },

2143 {

2144 Name: "X-Auth-Request-User",

2145 Values: []options.HeaderValue{

2146 {

2147 ClaimSource: &options.ClaimSource{

2148 Claim: "user",

2149 },

2150 },

2151 },

2152 },

2153 {

2154 Name: "X-Auth-Request-Email",

2155 Values: []options.HeaderValue{

2156 {

2157 ClaimSource: &options.ClaimSource{

2158 Claim: "email",

2159 },

2160 },

2161 },

2162 },

2163 }

2164 opts.SkipJwtBearerTokens = true

2165 opts.SetJWTBearerVerifiers(append(opts.GetJWTBearerVerifiers(), verifier))

2166 })

2167 if err != nil {

2168 t.Fatal(err)

2169 }

2170 tp, _ := test.proxy.provider.(*TestProvider)

2171 tp.GroupValidator = func(s string) bool {

2172 return true

2173 }

2174

2175 authHeader := fmt.Sprintf("Bearer %s", goodJwt)

2176 test.req.Header = map[string][]string{

2177 "Authorization": {authHeader},

2178 }

2179

2180 test.proxy.ServeHTTP(test.rw, test.req)

2181 if test.rw.Code >= 400 {

2182 t.Fatalf("expected 3xx got %d", test.rw.Code)

2183 }

2184

2185 // Check PassAuthorization, should overwrite Basic header

2186 assert.Equal(t, test.req.Header.Get("Authorization"), authHeader)

2187 assert.Equal(t, test.req.Header.Get("X-Forwarded-User"), "1234567890")

2188 assert.Equal(t, test.req.Header.Get("X-Forwarded-Email"), "john@example.com")

2189

2190 // SetAuthorization and SetXAuthRequest

2191 assert.Equal(t, test.rw.Header().Get("Authorization"), authHeader)

2192 assert.Equal(t, test.rw.Header().Get("X-Auth-Request-User"), "1234567890")

2193 assert.Equal(t, test.rw.Header().Get("X-Auth-Request-Email"), "john@example.com")

2194}

2195

2196func Test_prepareNoCache(t *testing.T) {

2197 handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

2198 prepareNoCache(w)

2199 })

2200 mux := http.NewServeMux()

2201 mux.Handle("/", handler)

2202

2203 rec := httptest.NewRecorder()

2204 req := httptest.NewRequest(http.MethodGet, "/", nil)

2205 mux.ServeHTTP(rec, req)

2206

2207 for k, v := range noCacheHeaders {

2208 assert.Equal(t, rec.Header().Get(k), v)

2209 }

2210}

2211

2212func Test_noCacheHeaders(t *testing.T) {

2213 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

2214 _, err := w.Write([]byte("upstream"))

2215 if err != nil {

2216 t.Error(err)

2217 }

2218 }))

2219 t.Cleanup(upstreamServer.Close)

2220

2221 opts := baseTestOptions()

2222 opts.UpstreamServers = options.Upstreams{

2223 {

2224 ID: upstreamServer.URL,

2225 Path: "/",

2226 URI: upstreamServer.URL,

2227 },

2228 }

2229 opts.SkipAuthRegex = []string{".*"}

2230 err := validation.Validate(opts)

2231 assert.NoError(t, err)

2232 proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })

2233 if err != nil {

2234 t.Fatal(err)

2235 }

2236

2237 t.Run("not exist in response from upstream", func(t *testing.T) {

2238 rec := httptest.NewRecorder()

2239 req := httptest.NewRequest(http.MethodGet, "/upstream", nil)

2240 proxy.ServeHTTP(rec, req)

2241

2242 assert.Equal(t, http.StatusOK, rec.Code)

2243 assert.Equal(t, "upstream", rec.Body.String())

2244

2245 // checking noCacheHeaders does not exists in response headers from upstream

2246 for k := range noCacheHeaders {

2247 assert.Equal(t, "", rec.Header().Get(k))

2248 }

2249 })

2250

2251 t.Run("has no-cache", func(t *testing.T) {

2252 tests := []struct {

2253 path string

2254 hasNoCache bool

2255 }{

2256 {

2257 path: "/oauth2/sign_in",

2258 hasNoCache: true,

2259 },

2260 {

2261 path: "/oauth2/sign_out",

2262 hasNoCache: true,

2263 },

2264 {

2265 path: "/oauth2/start",

2266 hasNoCache: true,

2267 },

2268 {

2269 path: "/oauth2/callback",

2270 hasNoCache: true,

2271 },

2272 {

2273 path: "/oauth2/auth",

2274 hasNoCache: false,

2275 },

2276 {

2277 path: "/oauth2/userinfo",

2278 hasNoCache: true,

2279 },

2280 {

2281 path: "/upstream",

2282 hasNoCache: false,

2283 },

2284 }

2285

2286 for _, tt := range tests {

2287 t.Run(tt.path, func(t *testing.T) {

2288 rec := httptest.NewRecorder()

2289 req := httptest.NewRequest(http.MethodGet, tt.path, nil)

2290 proxy.ServeHTTP(rec, req)

2291 cacheControl := rec.Result().Header.Get("Cache-Control")

2292 if tt.hasNoCache != (strings.Contains(cacheControl, "no-cache")) {

2293 t.Errorf(`unexpected "Cache-Control" header: %s`, cacheControl)

2294 }

2295 })

2296 }

2297

2298 })

2299}

2300

2301func baseTestOptions() *options.Options {

2302 opts := options.NewOptions()

2303 opts.Cookie.Secret = rawCookieSecret

2304 opts.ClientID = clientID

2305 opts.ClientSecret = clientSecret

2306 opts.EmailDomains = []string{"*"}

2307

2308 // Default injected headers for legacy configuration

2309 opts.InjectRequestHeaders = []options.Header{

2310 {

2311 Name: "Authorization",

2312 Values: []options.HeaderValue{

2313 {

2314 ClaimSource: &options.ClaimSource{

2315 Claim: "user",

2316 BasicAuthPassword: &options.SecretSource{

2317 Value: []byte(base64.StdEncoding.EncodeToString([]byte("This is a secure password"))),

2318 },

2319 },

2320 },

2321 },

2322 },

2323 {

2324 Name: "X-Forwarded-User",

2325 Values: []options.HeaderValue{

2326 {

2327 ClaimSource: &options.ClaimSource{

2328 Claim: "user",

2329 },

2330 },

2331 },

2332 },

2333 {

2334 Name: "X-Forwarded-Email",

2335 Values: []options.HeaderValue{

2336 {

2337 ClaimSource: &options.ClaimSource{

2338 Claim: "email",

2339 },

2340 },

2341 },

2342 },

2343 }

2344

2345 return opts

2346}

2347

2348func TestTrustedIPs(t *testing.T) {

2349 tests := []struct {

2350 name string

2351 trustedIPs []string

2352 reverseProxy bool

2353 realClientIPHeader string

2354 req *http.Request

2355 expectTrusted bool

2356 }{

2357 // Check unconfigured behavior.

2358 {

2359 name: "Default",

2360 trustedIPs: nil,

2361 reverseProxy: false,

2362 realClientIPHeader: "X-Real-IP", // Default value

2363 req: func() *http.Request {

2364 req, _ := http.NewRequest("GET", "/", nil)

2365 return req

2366 }(),

2367 expectTrusted: false,

2368 },

2369 // Check using req.RemoteAddr (Options.ReverseProxy == false).

2370 {

2371 name: "WithRemoteAddr",

2372 trustedIPs: []string{"127.0.0.1"},

2373 reverseProxy: false,

2374 realClientIPHeader: "X-Real-IP", // Default value

2375 req: func() *http.Request {

2376 req, _ := http.NewRequest("GET", "/", nil)

2377 req.RemoteAddr = "127.0.0.1:43670"

2378 return req

2379 }(),

2380 expectTrusted: true,

2381 },

2382 // Check ignores req.RemoteAddr match when behind a reverse proxy / missing header.

2383 {

2384 name: "IgnoresRemoteAddrInReverseProxyMode",

2385 trustedIPs: []string{"127.0.0.1"},

2386 reverseProxy: true,

2387 realClientIPHeader: "X-Real-IP", // Default value

2388 req: func() *http.Request {

2389 req, _ := http.NewRequest("GET", "/", nil)

2390 req.RemoteAddr = "127.0.0.1:44324"

2391 return req

2392 }(),

2393 expectTrusted: false,

2394 },

2395 // Check successful trusting of localhost in IPv4.

2396 {

2397 name: "TrustsLocalhostInReverseProxyMode",

2398 trustedIPs: []string{"127.0.0.0/8", "::1"},

2399 reverseProxy: true,

2400 realClientIPHeader: "X-Forwarded-For",

2401 req: func() *http.Request {

2402 req, _ := http.NewRequest("GET", "/", nil)

2403 req.Header.Add("X-Forwarded-For", "127.0.0.1")

2404 return req

2405 }(),

2406 expectTrusted: true,

2407 },

2408 // Check successful trusting of localhost in IPv6.

2409 {

2410 name: "TrustsIP6LocalostInReverseProxyMode",

2411 trustedIPs: []string{"127.0.0.0/8", "::1"},

2412 reverseProxy: true,

2413 realClientIPHeader: "X-Forwarded-For",

2414 req: func() *http.Request {

2415 req, _ := http.NewRequest("GET", "/", nil)

2416 req.Header.Add("X-Forwarded-For", "::1")

2417 return req

2418 }(),

2419 expectTrusted: true,

2420 },

2421 // Check does not trust random IPv4 address.

2422 {

2423 name: "DoesNotTrustRandomIP4Address",

2424 trustedIPs: []string{"127.0.0.0/8", "::1"},

2425 reverseProxy: true,

2426 realClientIPHeader: "X-Forwarded-For",

2427 req: func() *http.Request {

2428 req, _ := http.NewRequest("GET", "/", nil)

2429 req.Header.Add("X-Forwarded-For", "12.34.56.78")

2430 return req

2431 }(),

2432 expectTrusted: false,

2433 },

2434 // Check does not trust random IPv6 address.

2435 {

2436 name: "DoesNotTrustRandomIP6Address",

2437 trustedIPs: []string{"127.0.0.0/8", "::1"},

2438 reverseProxy: true,

2439 realClientIPHeader: "X-Forwarded-For",

2440 req: func() *http.Request {

2441 req, _ := http.NewRequest("GET", "/", nil)

2442 req.Header.Add("X-Forwarded-For", "::2")

2443 return req

2444 }(),

2445 expectTrusted: false,

2446 },

2447 // Check respects correct header.

2448 {

2449 name: "RespectsCorrectHeaderInReverseProxyMode",

2450 trustedIPs: []string{"127.0.0.0/8", "::1"},

2451 reverseProxy: true,

2452 realClientIPHeader: "X-Forwarded-For",

2453 req: func() *http.Request {

2454 req, _ := http.NewRequest("GET", "/", nil)

2455 req.Header.Add("X-Real-IP", "::1")

2456 return req

2457 }(),

2458 expectTrusted: false,

2459 },

2460 // Check doesn't trust if garbage is provided.

2461 {

2462 name: "DoesNotTrustGarbageInReverseProxyMode",

2463 trustedIPs: []string{"127.0.0.0/8", "::1"},

2464 reverseProxy: true,

2465 realClientIPHeader: "X-Forwarded-For",

2466 req: func() *http.Request {

2467 req, _ := http.NewRequest("GET", "/", nil)

2468 req.Header.Add("X-Forwarded-For", "adsfljk29242as!!")

2469 return req

2470 }(),

2471 expectTrusted: false,

2472 },

2473 // Check doesn't trust if garbage is provided (no reverse-proxy).

2474 {

2475 name: "DoesNotTrustGarbage",

2476 trustedIPs: []string{"127.0.0.0/8", "::1"},

2477 reverseProxy: false,

2478 realClientIPHeader: "X-Real-IP",

2479 req: func() *http.Request {

2480 req, _ := http.NewRequest("GET", "/", nil)

2481 req.RemoteAddr = "adsfljk29242as!!"

2482 return req

2483 }(),

2484 expectTrusted: false,

2485 },

2486 }

2487

2488 for _, tt := range tests {

2489 t.Run(tt.name, func(t *testing.T) {

2490 opts := baseTestOptions()

2491 opts.UpstreamServers = options.Upstreams{

2492 {

2493 ID: "static",

2494 Path: "/",

2495 Static: true,

2496 },

2497 }

2498 opts.TrustedIPs = tt.trustedIPs

2499 opts.ReverseProxy = tt.reverseProxy

2500 opts.RealClientIPHeader = tt.realClientIPHeader

2501 err := validation.Validate(opts)

2502 assert.NoError(t, err)

2503

2504 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })

2505 assert.NoError(t, err)

2506 rw := httptest.NewRecorder()

2507

2508 proxy.ServeHTTP(rw, tt.req)

2509 if tt.expectTrusted {

2510 assert.Equal(t, 200, rw.Code)

2511 } else {

2512 assert.Equal(t, 403, rw.Code)

2513 }

2514 })

2515 }

2516}

2517

2518func Test_buildRoutesAllowlist(t *testing.T) {

2519 type expectedAllowedRoute struct {

2520 method string

2521 regexString string

2522 }

2523

2524 testCases := []struct {

2525 name string

2526 skipAuthRegex []string

2527 skipAuthRoutes []string

2528 expectedRoutes []expectedAllowedRoute

2529 shouldError bool

2530 }{

2531 {

2532 name: "No skip auth configured",

2533 skipAuthRegex: []string{},

2534 skipAuthRoutes: []string{},

2535 expectedRoutes: []expectedAllowedRoute{},

2536 shouldError: false,

2537 },

2538 {

2539 name: "Only skipAuthRegex configured",

2540 skipAuthRegex: []string{

2541 "^/foo/bar",

2542 "^/baz/[0-9]+/thing",

2543 },

2544 skipAuthRoutes: []string{},

2545 expectedRoutes: []expectedAllowedRoute{

2546 {

2547 method: "",

2548 regexString: "^/foo/bar",

2549 },

2550 {

2551 method: "",

2552 regexString: "^/baz/[0-9]+/thing",

2553 },

2554 },

2555 shouldError: false,

2556 },

2557 {

2558 name: "Only skipAuthRoutes configured",

2559 skipAuthRegex: []string{},

2560 skipAuthRoutes: []string{

2561 "GET=^/foo/bar",

2562 "POST=^/baz/[0-9]+/thing",

2563 "^/all/methods$",

2564 "WEIRD=^/methods/are/allowed",

2565 "PATCH=/second/equals?are=handled&just=fine",

2566 },

2567 expectedRoutes: []expectedAllowedRoute{

2568 {

2569 method: "GET",

2570 regexString: "^/foo/bar",

2571 },

2572 {

2573 method: "POST",

2574 regexString: "^/baz/[0-9]+/thing",

2575 },

2576 {

2577 method: "",

2578 regexString: "^/all/methods$",

2579 },

2580 {

2581 method: "WEIRD",

2582 regexString: "^/methods/are/allowed",

2583 },

2584 {

2585 method: "PATCH",

2586 regexString: "/second/equals?are=handled&just=fine",

2587 },

2588 },

2589 shouldError: false,

2590 },

2591 {

2592 name: "Both skipAuthRegexes and skipAuthRoutes configured",

2593 skipAuthRegex: []string{

2594 "^/foo/bar/regex",

2595 "^/baz/[0-9]+/thing/regex",

2596 },

2597 skipAuthRoutes: []string{

2598 "GET=^/foo/bar",

2599 "POST=^/baz/[0-9]+/thing",

2600 "^/all/methods$",

2601 },

2602 expectedRoutes: []expectedAllowedRoute{

2603 {

2604 method: "",

2605 regexString: "^/foo/bar/regex",

2606 },

2607 {

2608 method: "",

2609 regexString: "^/baz/[0-9]+/thing/regex",

2610 },

2611 {

2612 method: "GET",

2613 regexString: "^/foo/bar",

2614 },

2615 {

2616 method: "POST",

2617 regexString: "^/baz/[0-9]+/thing",

2618 },

2619 {

2620 method: "",

2621 regexString: "^/all/methods$",

2622 },

2623 },

2624 shouldError: false,

2625 },

2626 {

2627 name: "Invalid skipAuthRegex entry",

2628 skipAuthRegex: []string{

2629 "^/foo/bar",

2630 "^/baz/[0-9]+/thing",

2631 "(bad[regex",

2632 },

2633 skipAuthRoutes: []string{},

2634 expectedRoutes: []expectedAllowedRoute{},

2635 shouldError: true,

2636 },

2637 {

2638 name: "Invalid skipAuthRoutes entry",

2639 skipAuthRegex: []string{},

2640 skipAuthRoutes: []string{

2641 "GET=^/foo/bar",

2642 "POST=^/baz/[0-9]+/thing",

2643 "^/all/methods$",

2644 "PUT=(bad[regex",

2645 },

2646 expectedRoutes: []expectedAllowedRoute{},

2647 shouldError: true,

2648 },

2649 }

2650

2651 for _, tc := range testCases {

2652 t.Run(tc.name, func(t *testing.T) {

2653 opts := &options.Options{

2654 SkipAuthRegex: tc.skipAuthRegex,

2655 SkipAuthRoutes: tc.skipAuthRoutes,

2656 }

2657 routes, err := buildRoutesAllowlist(opts)

2658 if tc.shouldError {

2659 assert.Error(t, err)

2660 return

2661 }

2662 assert.NoError(t, err)

2663

2664 for i, route := range routes {

2665 assert.Greater(t, len(tc.expectedRoutes), i)

2666 assert.Equal(t, route.method, tc.expectedRoutes[i].method)

2667 assert.Equal(t, route.pathRegex.String(), tc.expectedRoutes[i].regexString)

2668 }

2669 })

2670 }

2671}

2672

2673func TestAllowedRequest(t *testing.T) {

2674 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

2675 w.WriteHeader(200)

2676 _, err := w.Write([]byte("Allowed Request"))

2677 if err != nil {

2678 t.Fatal(err)

2679 }

2680 }))

2681 t.Cleanup(upstreamServer.Close)

2682

2683 opts := baseTestOptions()

2684 opts.UpstreamServers = options.Upstreams{

2685 {

2686 ID: upstreamServer.URL,

2687 Path: "/",

2688 URI: upstreamServer.URL,

2689 },

2690 }

2691 opts.SkipAuthRegex = []string{

2692 "^/skip/auth/regex$",

2693 }

2694 opts.SkipAuthRoutes = []string{

2695 "GET=^/skip/auth/routes/get",

2696 }

2697 err := validation.Validate(opts)

2698 assert.NoError(t, err)

2699 proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })

2700 if err != nil {

2701 t.Fatal(err)

2702 }

2703

2704 testCases := []struct {

2705 name string

2706 method string

2707 url string

2708 allowed bool

2709 }{

2710 {

2711 name: "Regex GET allowed",

2712 method: "GET",

2713 url: "/skip/auth/regex",

2714 allowed: true,

2715 },

2716 {

2717 name: "Regex POST allowed ",

2718 method: "POST",

2719 url: "/skip/auth/regex",

2720 allowed: true,

2721 },

2722 {

2723 name: "Regex denied",

2724 method: "GET",

2725 url: "/wrong/denied",

2726 allowed: false,

2727 },

2728 {

2729 name: "Route allowed",

2730 method: "GET",

2731 url: "/skip/auth/routes/get",

2732 allowed: true,

2733 },

2734 {

2735 name: "Route denied with wrong method",

2736 method: "PATCH",

2737 url: "/skip/auth/routes/get",

2738 allowed: false,

2739 },

2740 {

2741 name: "Route denied with wrong path",

2742 method: "GET",

2743 url: "/skip/auth/routes/wrong/path",

2744 allowed: false,

2745 },

2746 }

2747

2748 for _, tc := range testCases {

2749 t.Run(tc.name, func(t *testing.T) {

2750 req, err := http.NewRequest(tc.method, tc.url, nil)

2751 assert.NoError(t, err)

2752 assert.Equal(t, tc.allowed, proxy.isAllowedRoute(req))

2753

2754 rw := httptest.NewRecorder()

2755 proxy.ServeHTTP(rw, req)

2756

2757 if tc.allowed {

2758 assert.Equal(t, 200, rw.Code)

2759 assert.Equal(t, "Allowed Request", rw.Body.String())

2760 } else {

2761 assert.Equal(t, 403, rw.Code)

2762 }

2763 })

2764 }

2765}

2766

2767func TestProxyAllowedGroups(t *testing.T) {

2768 tests := []struct {

2769 name string

2770 allowedGroups []string

2771 groups []string

2772 expectUnauthorized bool

2773 }{

2774 {"NoAllowedGroups", []string{}, []string{}, false},

2775 {"NoAllowedGroupsUserHasGroups", []string{}, []string{"a", "b"}, false},

2776 {"UserInAllowedGroup", []string{"a"}, []string{"a", "b"}, false},

2777 {"UserNotInAllowedGroup", []string{"a"}, []string{"c"}, true},

2778 }

2779

2780 for _, tt := range tests {

2781 t.Run(tt.name, func(t *testing.T) {

2782 emailAddress := "test"

2783 created := time.Now()

2784

2785 session := &sessions.SessionState{

2786 Groups: tt.groups,

2787 Email: emailAddress,

2788 AccessToken: "oauth_token",

2789 CreatedAt: &created,

2790 }

2791

2792 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

2793 w.WriteHeader(200)

2794 }))

2795 t.Cleanup(upstreamServer.Close)

2796

2797 test, err := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {

2798 opts.AllowedGroups = tt.allowedGroups

2799 opts.UpstreamServers = options.Upstreams{

2800 {

2801 ID: upstreamServer.URL,

2802 Path: "/",

2803 URI: upstreamServer.URL,

2804 },

2805 }

2806 })

2807 if err != nil {

2808 t.Fatal(err)

2809 }

2810

2811 test.req, _ = http.NewRequest("GET", "/", nil)

2812

2813 test.req.Header.Add("accept", applicationJSON)

2814 err = test.SaveSession(session)

2815 assert.NoError(t, err)

2816 test.proxy.ServeHTTP(test.rw, test.req)

2817

2818 if tt.expectUnauthorized {

2819 assert.Equal(t, http.StatusForbidden, test.rw.Code)

2820 } else {

2821 assert.Equal(t, http.StatusOK, test.rw.Code)

2822 }

2823 })

2824 }

2825}

2826

2827func TestAuthOnlyAllowedGroups(t *testing.T) {

2828 testCases := []struct {

2829 name string

2830 allowedGroups []string

2831 groups []string

2832 querystring string

2833 expectedStatusCode int

2834 }{

2835 {

2836 name: "NoAllowedGroups",

2837 allowedGroups: []string{},

2838 groups: []string{},

2839 querystring: "",

2840 expectedStatusCode: http.StatusAccepted,

2841 },

2842 {

2843 name: "NoAllowedGroupsUserHasGroups",

2844 allowedGroups: []string{},

2845 groups: []string{"a", "b"},

2846 querystring: "",

2847 expectedStatusCode: http.StatusAccepted,

2848 },

2849 {

2850 name: "UserInAllowedGroup",

2851 allowedGroups: []string{"a"},

2852 groups: []string{"a", "b"},

2853 querystring: "",

2854 expectedStatusCode: http.StatusAccepted,

2855 },

2856 {

2857 name: "UserNotInAllowedGroup",

2858 allowedGroups: []string{"a"},

2859 groups: []string{"c"},

2860 querystring: "",

2861 expectedStatusCode: http.StatusUnauthorized,

2862 },

2863 {

2864 name: "UserInQuerystringGroup",

2865 allowedGroups: []string{"a", "b"},

2866 groups: []string{"a", "c"},

2867 querystring: "?allowed_groups=a",

2868 expectedStatusCode: http.StatusAccepted,

2869 },

2870 {

2871 name: "UserInMultiParamQuerystringGroup",

2872 allowedGroups: []string{"a", "b"},

2873 groups: []string{"b"},

2874 querystring: "?allowed_groups=a&allowed_groups=b,d",

2875 expectedStatusCode: http.StatusAccepted,

2876 },

2877 {

2878 name: "UserInOnlyQuerystringGroup",

2879 allowedGroups: []string{},

2880 groups: []string{"a", "c"},

2881 querystring: "?allowed_groups=a,b",

2882 expectedStatusCode: http.StatusAccepted,

2883 },

2884 {

2885 name: "UserInDelimitedQuerystringGroup",

2886 allowedGroups: []string{"a", "b", "c"},

2887 groups: []string{"c"},

2888 querystring: "?allowed_groups=a,c",

2889 expectedStatusCode: http.StatusAccepted,

2890 },

2891 {

2892 name: "UserNotInQuerystringGroup",

2893 allowedGroups: []string{},

2894 groups: []string{"c"},

2895 querystring: "?allowed_groups=a,b",

2896 expectedStatusCode: http.StatusForbidden,

2897 },

2898 {

2899 name: "UserInConfigGroupNotInQuerystringGroup",

2900 allowedGroups: []string{"a", "b", "c"},

2901 groups: []string{"c"},

2902 querystring: "?allowed_groups=a,b",

2903 expectedStatusCode: http.StatusForbidden,

2904 },

2905 {

2906 name: "UserInQuerystringGroupNotInConfigGroup",

2907 allowedGroups: []string{"a", "b"},

2908 groups: []string{"c"},

2909 querystring: "?allowed_groups=b,c",

2910 expectedStatusCode: http.StatusUnauthorized,

2911 },

2912 }

2913

2914 for _, tc := range testCases {

2915 t.Run(tc.name, func(t *testing.T) {

2916 emailAddress := "test"

2917 created := time.Now()

2918

2919 session := &sessions.SessionState{

2920 Groups: tc.groups,

2921 Email: emailAddress,

2922 AccessToken: "oauth_token",

2923 CreatedAt: &created,

2924 }

2925

2926 test, err := NewAuthOnlyEndpointTest(tc.querystring, func(opts *options.Options) {

2927 opts.AllowedGroups = tc.allowedGroups

2928 })

2929 if err != nil {

2930 t.Fatal(err)

2931 }

2932

2933 err = test.SaveSession(session)

2934 assert.NoError(t, err)

2935

2936 test.proxy.ServeHTTP(test.rw, test.req)

2937

2938 assert.Equal(t, tc.expectedStatusCode, test.rw.Code)

2939 })

2940 }

2941}