git.iko.soy/typeable/oauth2-proxy
on master help sign in
typeable/oauth2-proxy/providers/internal_util.go
91 lines 2.5 kB history raw
1package providers
3import (
4 "context"
5 "net/http"
6 "net/url"
8 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
9 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
12// stripToken is a helper function to obfuscate "access_token"
13// query parameters
14func stripToken(endpoint string) string {
15 return stripParam("access_token", endpoint)
18// stripParam generalizes the obfuscation of a particular
19// query parameter - typically 'access_token' or 'client_secret'
20// The parameter's second half is replaced by '...' and returned
21// as part of the encoded query parameters.
22// If the target parameter isn't found, the endpoint is returned
23// unmodified.
24func stripParam(param, endpoint string) string {
25 u, err := url.Parse(endpoint)
26 if err != nil {
27 logger.Errorf("error attempting to strip %s: %s", param, err)
28 return endpoint
29 }
31 if u.RawQuery != "" {
32 values, err := url.ParseQuery(u.RawQuery)
33 if err != nil {
34 logger.Errorf("error attempting to strip %s: %s", param, err)
35 return u.String()
36 }
38 if val := values.Get(param); val != "" {
39 // Truncate by at least half and allow for a maximum of 5 characters
40 values.Set(param, val[:min(len(val)/2, 5)]+"...")
41 u.RawQuery = values.Encode()
42 return u.String()
43 }
44 }
46 return endpoint
49// validateToken returns true if token is valid
50func validateToken(ctx context.Context, p Provider, accessToken string, header http.Header) bool {
51 if accessToken == "" || p.Data().ValidateURL == nil || p.Data().ValidateURL.String() == "" {
52 return false
53 }
54 endpoint := p.Data().ValidateURL.String()
55 if len(header) == 0 {
56 params := url.Values{"access_token": {accessToken}}
57 if hasQueryParams(endpoint) {
58 endpoint = endpoint + "&" + params.Encode()
59 } else {
60 endpoint = endpoint + "?" + params.Encode()
61 }
62 }
64 result := requests.New(endpoint).
65 WithContext(ctx).
66 WithHeaders(header).
67 Do()
68 if result.Error() != nil {
69 logger.Errorf("GET %s", stripToken(endpoint))
70 logger.Errorf("token validation request failed: %s", result.Error())
71 return false
72 }
74 logger.Printf("%d GET %s %s", result.StatusCode(), stripToken(endpoint), result.Body())
76 if result.StatusCode() == 200 {
77 return true
78 }
79 logger.Errorf("token validation request failed: status %d - %s", result.StatusCode(), result.Body())
80 return false
83// hasQueryParams check if URL has query parameters
84func hasQueryParams(endpoint string) bool {
85 endpointURL, err := url.Parse(endpoint)
86 if err != nil {
87 return false
88 }
90 return len(endpointURL.RawQuery) != 0