git.iko.soy/typeable/oauth2-proxy
on master help sign in
typeable/oauth2-proxy/pkg/validation/header.go
64 lines 1.8 kB history raw
1package validation
3import (
4 "fmt"
6 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
7)
9func validateHeaders(headers []options.Header) []string {
10 //nolint:prealloc
11 msgs := []string{}
12 names := make(map[string]struct{})
14 for _, header := range headers {
15 msgs = append(msgs, validateHeader(header, names)...)
16 }
17 return msgs
20func validateHeader(header options.Header, names map[string]struct{}) []string {
21 msgs := []string{}
23 if header.Name == "" {
24 msgs = append(msgs, "header has empty name: names are required for all headers")
25 }
27 if _, ok := names[header.Name]; ok {
28 msgs = append(msgs, fmt.Sprintf("multiple headers found with name %q: header names must be unique", header.Name))
29 }
30 names[header.Name] = struct{}{}
32 for _, value := range header.Values {
33 msgs = append(msgs,
34 prefixValues(fmt.Sprintf("invalid header %q: invalid values: ", header.Name),
35 validateHeaderValue(header.Name, value)...,
36 )...,
37 )
38 }
39 return msgs
42func validateHeaderValue(_ string, value options.HeaderValue) []string {
43 switch {
44 case value.SecretSource != nil && value.ClaimSource == nil:
45 return []string{validateSecretSource(*value.SecretSource)}
46 case value.SecretSource == nil && value.ClaimSource != nil:
47 return validateHeaderValueClaimSource(*value.ClaimSource)
48 default:
49 return []string{"header value has multiple entries: only one entry per value is allowed"}
50 }
53func validateHeaderValueClaimSource(claim options.ClaimSource) []string {
54 msgs := []string{}
56 if claim.Claim == "" {
57 msgs = append(msgs, "claim should not be empty")
58 }
60 if claim.BasicAuthPassword != nil {
61 msgs = append(msgs, prefixValues("invalid basicAuthPassword: ", validateSecretSource(*claim.BasicAuthPassword))...)
62 }
63 return msgs