git.iko.soy/typeable/oauth2-proxy
on master help sign in
typeable/oauth2-proxy/pkg/validation/cookie.go
88 lines 2.5 kB history raw
1package validation
3import (
4 "fmt"
5 "net/http"
6 "os"
7 "sort"
8 "time"
10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/encryption"
14func validateCookie(o options.Cookie) []string {
15 msgs := validateCookieSecret(o.Secret, o.SecretFile)
17 if o.Expire != time.Duration(0) && o.Refresh >= o.Expire {
18 msgs = append(msgs, fmt.Sprintf(
19 "cookie_refresh (%q) must be less than cookie_expire (%q)",
20 o.Refresh.String(),
21 o.Expire.String()))
22 }
24 switch o.SameSite {
25 case "", "none", "lax", "strict":
26 default:
27 msgs = append(msgs, fmt.Sprintf("cookie_samesite (%q) must be one of ['', 'lax', 'strict', 'none']", o.SameSite))
28 }
30 // Sort cookie domains by length, so that we try longer (and more specific) domains first
31 sort.Slice(o.Domains, func(i, j int) bool {
32 return len(o.Domains[i]) > len(o.Domains[j])
33 })
35 msgs = append(msgs, validateCookieName(o.Name)...)
36 return msgs
39func validateCookieName(name string) []string {
40 msgs := []string{}
42 cookie := &http.Cookie{Name: name}
43 if cookie.String() == "" {
44 msgs = append(msgs, fmt.Sprintf("invalid cookie name: %q", name))
45 }
47 if len(name) > 256 {
48 msgs = append(msgs, fmt.Sprintf("cookie name should be under 256 characters: cookie name is %d characters", len(name)))
49 }
50 return msgs
53func validateCookieSecret(secret string, secretFile string) []string {
54 if secret == "" && secretFile == "" {
55 return []string{"missing setting: cookie-secret or cookie-secret-file"}
56 }
57 if secret == "" && secretFile != "" {
58 fileData, err := os.ReadFile(secretFile)
59 if err != nil {
60 return []string{"could not read cookie secret file: " + secretFile}
61 }
62 // Validate the file content as a secret
63 secretBytes := encryption.SecretBytes(string(fileData))
64 switch len(secretBytes) {
65 case 16, 24, 32:
66 // Valid secret size found
67 return []string{}
68 }
69 // Invalid secret size found, return a message
70 return []string{fmt.Sprintf(
71 "cookie_secret from file must be 16, 24, or 32 bytes to create an AES cipher, but is %d bytes",
72 len(secretBytes)),
73 }
74 }
76 secretBytes := encryption.SecretBytes(secret)
77 // Check if the secret is a valid length
78 switch len(secretBytes) {
79 case 16, 24, 32:
80 // Valid secret size found
81 return []string{}
82 }
83 // Invalid secret size found, return a message
84 return []string{fmt.Sprintf(
85 "cookie_secret must be 16, 24, or 32 bytes to create an AES cipher, but is %d bytes",
86 len(secretBytes)),
87 }