@@ -1170,17 +1170,67 @@ func TestGetJwtSession(t *testing.T) {
11701170 &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})
11711171 p := OAuthProxy{}
11721172 p.jwtBearerVerifiers = append(p.jwtBearerVerifiers, verifier)
1173− getReq := &http.Request{URL: &url.URL{Scheme: "http", Host: "example.com"}}
11741173
1175− // Bearer
1176− getReq.Header = map[string][]string{
1177− "Authorization": {fmt.Sprintf("Bearer %s", goodJwt)},
1174+ req, _ := http.NewRequest("GET", "/", strings.NewReader(""))
1175+ authHeader := fmt.Sprintf("Bearer %s", goodJwt)
1176+ req.Header = map[string][]string{
1177+ "Authorization": {authHeader},
11781178 }
1179− session, _ := p.GetJwtSession(getReq)
1179+
1180+ // Bearer
1181+ session, _ := p.GetJwtSession(req)
11801182 assert.Equal(t, session.User, "john")
11811183 assert.Equal(t, session.Email, "john@example.com")
11821184 assert.Equal(t, session.ExpiresOn, time.Unix(1912151821, 0))
11831185 assert.Equal(t, session.IDToken, goodJwt)
1186+
1187+ jwtProviderServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
1188+ log.Printf("%#v", r)
1189+ var payload string
1190+ payload = r.Header.Get("Authorization")
1191+ if payload == "" {
1192+ payload = "No Authorization header found."
1193+ }
1194+ w.WriteHeader(200)
1195+ w.Write([]byte(payload))
1196+ }))
1197+
1198+ opts := NewOptions()
1199+ opts.Upstreams = append(opts.Upstreams, jwtProviderServer.URL)
1200+ opts.PassAuthorization = true
1201+ opts.SetAuthorization = true
1202+ opts.SetXAuthRequest = true
1203+ opts.CookieSecret = "0123456789abcdef0123"
1204+ opts.SkipJwtBearerTokens = true
1205+ opts.Validate()
1206+
1207+ // We can't actually use opts.Validate() because it will attempt to find a jwks URI
1208+ opts.jwtBearerVerifiers = append(opts.jwtBearerVerifiers, verifier)
1209+
1210+ providerURL, _ := url.Parse(jwtProviderServer.URL)
1211+ const emailAddress = "john@example.com"
1212+
1213+ opts.provider = NewTestProvider(providerURL, emailAddress)
1214+ jwtTestProxy := NewOAuthProxy(opts, func(email string) bool {
1215+ return email == emailAddress
1216+ })
1217+
1218+ rw := httptest.NewRecorder()
1219+ jwtTestProxy.ServeHTTP(rw, req)
1220+ if rw.Code >= 400 {
1221+ t.Fatalf("expected 3xx got %d", rw.Code)
1222+ }
1223+
1224+ // Check PassAuthorization, should overwrite Basic header
1225+ assert.Equal(t, req.Header.Get("Authorization"), authHeader)
1226+ assert.Equal(t, req.Header.Get("X-Forwarded-User"), "john")
1227+ assert.Equal(t, req.Header.Get("X-Forwarded-Email"), "john@example.com")
1228+
1229+ // SetAuthorization and SetXAuthRequest
1230+ assert.Equal(t, rw.Header().Get("Authorization"), authHeader)
1231+ assert.Equal(t, rw.Header().Get("X-Auth-Request-User"), "john")
1232+ assert.Equal(t, rw.Header().Get("X-Auth-Request-Email"), "john@example.com")
1233+
11841234}
11851235
11861236func TestFindJwtBearerToken(t *testing.T) {