@@ -67,22 +67,68 @@ func newTicket(cookieOpts *options.Cookie) (*ticket, error) {
6767
6868// encodeTicket encodes the Ticket to a string for usage in cookies
6969func (t *ticket) encodeTicket() string {
70− return fmt.Sprintf("%s.%s", t.id, base64.RawURLEncoding.EncodeToString(t.secret))
70+ return fmt.Sprintf("v2.%s.%s", base64.RawURLEncoding.EncodeToString([]byte(t.id)),
71+ base64.RawURLEncoding.EncodeToString(t.secret))
72+}
73+
74+// decodeTicketID Tickets are encoded with format: {encoding version}.{ticketID base64}.{ticketSecret base 64}.
75+// Tickets from old oauth2-proxy versions do not have the same format, and this method tries
76+// to decode the ticket ID part based on the encoding version, or lack of it.
77+func decodeTicketID(ticketParts []string) (string, error) {
78+ switch {
79+ case len(ticketParts) == 2:
80+ // old ticket encoding
81+ return ticketParts[0], nil
82+ case len(ticketParts) == 3 && ticketParts[0] == "v2":
83+ // v2 ticket encoding
84+ ticketID, err := base64.RawURLEncoding.DecodeString(ticketParts[1])
85+ if err != nil {
86+ return "", fmt.Errorf("failed to decode ticket Id: %v", err)
87+ }
88+ return string(ticketID), nil
89+ default:
90+ return "", errors.New("failed to decode ticket Id")
91+ }
92+}
93+
94+// decodeTicketSecret Tickets are encoded with format: {encoding version}.{ticketID base64}.{ticketSecret base 64}.
95+// Tickets from old oauth2-proxy versions do not have the same format, and this method tries
96+// to decode the ticket secret part based on the encoding version, or lack of it.
97+func decodeTicketSecret(ticketParts []string) ([]byte, error) {
98+ switch {
99+ case len(ticketParts) == 2:
100+ // old ticket encoding
101+ secret, err := base64.RawURLEncoding.DecodeString(ticketParts[1])
102+ if err != nil {
103+ return nil, fmt.Errorf("failed to decode encryption secret: %v", err)
104+ }
105+ return secret, nil
106+ case len(ticketParts) == 3 && ticketParts[0] == "v2":
107+ // new ticket encode
108+ secret, err := base64.RawURLEncoding.DecodeString(ticketParts[2])
109+ if err != nil {
110+ return nil, fmt.Errorf("failed to decode encryption secret: %v", err)
111+ }
112+ return secret, nil
113+ default:
114+ return nil, errors.New("failed to decode encryption secret")
115+ }
71116}
72117
73118// decodeTicket decodes an encoded ticket string
74119func decodeTicket(encTicket string, cookieOpts *options.Cookie) (*ticket, error) {
75120 ticketParts := strings.Split(encTicket, ".")
76− if len(ticketParts) != 2 {
121+ if len(ticketParts) != 2 && len(ticketParts) != 3 {
77122 return nil, errors.New("failed to decode ticket")
78123 }
79− ticketID, secretBase64 := ticketParts[0], ticketParts[1]
80−
81− secret, err := base64.RawURLEncoding.DecodeString(secretBase64)
82− if err != nil {
83− return nil, fmt.Errorf("failed to decode encryption secret: %v", err)
124+ ticketID, errTicketID := decodeTicketID(ticketParts)
125+ if errTicketID != nil {
126+ return nil, fmt.Errorf("failed to decode ticket: %v", errTicketID)
127+ }
128+ secret, errSecret := decodeTicketSecret(ticketParts)
129+ if errSecret != nil {
130+ return nil, fmt.Errorf("failed to decode ticket: %v", errSecret)
84131 }
85−
86132 return &ticket{
87133 id: ticketID,
88134 secret: secret,