@@ -926,7 +926,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
926926}
927927
928928// AuthOnly checks whether the user is currently logged in (both authentication
929−// and optional authorization via `allowed_groups` querystring).
929+// and optional authorization).
930930func (p *OAuthProxy) AuthOnly(rw http.ResponseWriter, req *http.Request) {
931931 session, err := p.getAuthenticatedSession(rw, req)
932932 if err != nil {
@@ -934,9 +934,9 @@ func (p *OAuthProxy) AuthOnly(rw http.ResponseWriter, req *http.Request) {
934934 return
935935 }
936936
937− // Allow secondary group restrictions based on the `allowed_group` or
938− // `allowed_groups` querystring parameter
939− if !checkAllowedGroups(req, session) {
937+ // Unauthorized cases need to return 403 to prevent infinite redirects with
938+ // subrequest architectures
939+ if !authOnlyAuthorize(req, session) {
940940 http.Error(rw, http.StatusText(http.StatusForbidden), http.StatusForbidden)
941941 return
942942 }
@@ -1024,13 +1024,25 @@ func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.R
10241024 return session, nil
10251025}
10261026
1027−func checkAllowedGroups(req *http.Request, session *sessionsapi.SessionState) bool {
1027+// authOnlyAuthorize handles special authorization logic that is only done
1028+// on the AuthOnly endpoint for use with Nginx subrequest architectures.
1029+func authOnlyAuthorize(req *http.Request, s *sessionsapi.SessionState) bool {
1030+ // Allow secondary group restrictions based on the `allowed_group` or
1031+ // `allowed_groups` querystring parameter
1032+ if !checkAllowedGroups(req, s) {
1033+ return false
1034+ }
1035+
1036+ return true
1037+}
1038+
1039+func checkAllowedGroups(req *http.Request, s *sessionsapi.SessionState) bool {
10281040 allowedGroups := extractAllowedGroups(req)
10291041 if len(allowedGroups) == 0 {
10301042 return true
10311043 }
10321044
1033− for _, group := range session.Groups {
1045+ for _, group := range s.Groups {
10341046 if _, ok := allowedGroups[group]; ok {
10351047 return true
10361048 }