git.iko.soy/typeable/oauth2-proxy
on remove-gap-headers help sign in
typeable/oauth2-proxy/pkg/validation/cookie.go
68 lines 1.8 kB history raw
1package validation
3import (
4 "fmt"
5 "net/http"
6 "sort"
8 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
9 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/encryption"
12func validateCookie(o options.Cookie) []string {
13 msgs := validateCookieSecret(o.Secret)
15 if o.Refresh >= o.Expire {
16 msgs = append(msgs, fmt.Sprintf(
17 "cookie_refresh (%q) must be less than cookie_expire (%q)",
18 o.Refresh.String(),
19 o.Expire.String()))
20 }
22 switch o.SameSite {
23 case "", "none", "lax", "strict":
24 default:
25 msgs = append(msgs, fmt.Sprintf("cookie_samesite (%q) must be one of ['', 'lax', 'strict', 'none']", o.SameSite))
26 }
28 // Sort cookie domains by length, so that we try longer (and more specific) domains first
29 sort.Slice(o.Domains, func(i, j int) bool {
30 return len(o.Domains[i]) > len(o.Domains[j])
31 })
33 msgs = append(msgs, validateCookieName(o.Name)...)
34 return msgs
37func validateCookieName(name string) []string {
38 msgs := []string{}
40 cookie := &http.Cookie{Name: name}
41 if cookie.String() == "" {
42 msgs = append(msgs, fmt.Sprintf("invalid cookie name: %q", name))
43 }
45 if len(name) > 256 {
46 msgs = append(msgs, fmt.Sprintf("cookie name should be under 256 characters: cookie name is %d characters", len(name)))
47 }
48 return msgs
51func validateCookieSecret(secret string) []string {
52 if secret == "" {
53 return []string{"missing setting: cookie-secret"}
54 }
56 secretBytes := encryption.SecretBytes(secret)
57 // Check if the secret is a valid length
58 switch len(secretBytes) {
59 case 16, 24, 32:
60 // Valid secret size found
61 return []string{}
62 }
63 // Invalid secret size found, return a message
64 return []string{fmt.Sprintf(
65 "cookie_secret must be 16, 24, or 32 bytes to create an AES cipher, but is %d bytes",
66 len(secretBytes)),
67 }