git.iko.soy/typeable/oauth2-proxy
on ea261ca help sign in
typeable/oauth2-proxy/pkg/validation/sessions.go
88 lines 2.7 kB history raw
1package validation
3import (
4 "context"
5 "encoding/base64"
6 "fmt"
7 "time"
9 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/encryption"
11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/sessions/redis"
14func validateSessionCookieMinimal(o *options.Options) []string {
15 if !o.Session.Cookie.Minimal {
16 return []string{}
17 }
19 msgs := []string{}
20 for _, header := range append(o.InjectRequestHeaders, o.InjectResponseHeaders...) {
21 for _, value := range header.Values {
22 if value.ClaimSource != nil {
23 if value.ClaimSource.Claim == "access_token" {
24 msgs = append(msgs,
25 fmt.Sprintf("access_token claim for header %q requires oauth tokens in sessions. session_cookie_minimal cannot be set", header.Name))
26 }
27 if value.ClaimSource.Claim == "id_token" {
28 msgs = append(msgs,
29 fmt.Sprintf("id_token claim for header %q requires oauth tokens in sessions. session_cookie_minimal cannot be set", header.Name))
30 }
31 }
32 }
33 }
35 if o.Cookie.Refresh != time.Duration(0) {
36 msgs = append(msgs,
37 "cookie_refresh > 0 requires oauth tokens in sessions. session_cookie_minimal cannot be set")
38 }
39 return msgs
42// validateRedisSessionStore builds a Redis Client from the options and
43// attempts to connect, Set, Get and Del a random health check key
44func validateRedisSessionStore(o *options.Options) []string {
45 if o.Session.Type != options.RedisSessionStoreType {
46 return []string{}
47 }
49 client, err := redis.NewRedisClient(o.Session.Redis)
50 if err != nil {
51 return []string{fmt.Sprintf("unable to initialize a redis client: %v", err)}
52 }
54 n, err := encryption.Nonce()
55 if err != nil {
56 return []string{fmt.Sprintf("unable to generate a redis initialization test key: %v", err)}
57 }
58 nonce := base64.RawURLEncoding.EncodeToString(n)
60 key := fmt.Sprintf("%s-healthcheck-%s", o.Cookie.Name, nonce)
61 return sendRedisConnectionTest(client, key, nonce)
64func sendRedisConnectionTest(client redis.Client, key string, val string) []string {
65 msgs := []string{}
66 ctx := context.Background()
68 err := client.Set(ctx, key, []byte(val), time.Duration(60)*time.Second)
69 if err != nil {
70 msgs = append(msgs, fmt.Sprintf("unable to set a redis initialization key: %v", err))
71 } else {
72 gval, err := client.Get(ctx, key)
73 if err != nil {
74 msgs = append(msgs,
75 fmt.Sprintf("unable to retrieve redis initialization key: %v", err))
76 }
77 if string(gval) != val {
78 msgs = append(msgs,
79 "the retrieved redis initialization key did not match the value we set")
80 }
81 }
83 err = client.Del(ctx, key)
84 if err != nil {
85 msgs = append(msgs, fmt.Sprintf("unable to delete the redis initialization key: %v", err))
86 }
87 return msgs