git.iko.soy/typeable/oauth2-proxy
on master help sign in
Issue 978: Fix Custom cookie name breaks redis for session (#1949)
1e61b65Nuno Miguel Micaelo Borges
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -17,6 +17,7 @@
17- [#2282](https://github.com/oauth2-proxy/oauth2-proxy/pull/2282) Fixed checking Google Groups membership using Google Application Credentials (@kvanzuijlen)
17- [#2282](https://github.com/oauth2-proxy/oauth2-proxy/pull/2282) Fixed checking Google Groups membership using Google Application Credentials (@kvanzuijlen)
18- [#2183](https://github.com/oauth2-proxy/oauth2-proxy/pull/2183) Allowing relative redirect url though an option (@axel7083)
18- [#2183](https://github.com/oauth2-proxy/oauth2-proxy/pull/2183) Allowing relative redirect url though an option (@axel7083)
19- [#1866](https://github.com/oauth2-proxy/oauth2-proxy/pull/1866) Add support for unix socker as upstream (@babs)
19- [#1866](https://github.com/oauth2-proxy/oauth2-proxy/pull/1866) Add support for unix socker as upstream (@babs)
20+- [#1949](https://github.com/oauth2-proxy/oauth2-proxy/pull/1949) Allow cookie names with dots in redis sessions (@miguelborges99)
20- [#2297](https://github.com/oauth2-proxy/oauth2-proxy/pull/2297) Add nightly build and push (@tuunit)
21- [#2297](https://github.com/oauth2-proxy/oauth2-proxy/pull/2297) Add nightly build and push (@tuunit)
21
22
22# V7.5.1
23# V7.5.1
pkg/sessions/persistence/ticket.go+54−8
@@ -67,22 +67,68 @@ func newTicket(cookieOpts *options.Cookie) (*ticket, error) {
67
67
68// encodeTicket encodes the Ticket to a string for usage in cookies
68// encodeTicket encodes the Ticket to a string for usage in cookies
69func (t *ticket) encodeTicket() string {
69func (t *ticket) encodeTicket() string {
70+ return fmt.Sprintf("v2.%s.%s", base64.RawURLEncoding.EncodeToString([]byte(t.id)),
70− return fmt.Sprintf("%s.%s", t.id, base64.RawURLEncoding.EncodeToString(t.secret))
71+ base64.RawURLEncoding.EncodeToString(t.secret))
72+}
73+
74+// decodeTicketID Tickets are encoded with format: {encoding version}.{ticketID base64}.{ticketSecret base 64}.
75+// Tickets from old oauth2-proxy versions do not have the same format, and this method tries
76+// to decode the ticket ID part based on the encoding version, or lack of it.
77+func decodeTicketID(ticketParts []string) (string, error) {
78+ switch {
79+ case len(ticketParts) == 2:
80+ // old ticket encoding
81+ return ticketParts[0], nil
82+ case len(ticketParts) == 3 && ticketParts[0] == "v2":
83+ // v2 ticket encoding
84+ ticketID, err := base64.RawURLEncoding.DecodeString(ticketParts[1])
85+ if err != nil {
86+ return "", fmt.Errorf("failed to decode ticket Id: %v", err)
87+ }
88+ return string(ticketID), nil
89+ default:
90+ return "", errors.New("failed to decode ticket Id")
91+ }
92+}
93+
94+// decodeTicketSecret Tickets are encoded with format: {encoding version}.{ticketID base64}.{ticketSecret base 64}.
95+// Tickets from old oauth2-proxy versions do not have the same format, and this method tries
96+// to decode the ticket secret part based on the encoding version, or lack of it.
97+func decodeTicketSecret(ticketParts []string) ([]byte, error) {
98+ switch {
99+ case len(ticketParts) == 2:
100+ // old ticket encoding
101+ secret, err := base64.RawURLEncoding.DecodeString(ticketParts[1])
102+ if err != nil {
103+ return nil, fmt.Errorf("failed to decode encryption secret: %v", err)
104+ }
105+ return secret, nil
106+ case len(ticketParts) == 3 && ticketParts[0] == "v2":
107+ // new ticket encode
108+ secret, err := base64.RawURLEncoding.DecodeString(ticketParts[2])
109+ if err != nil {
110+ return nil, fmt.Errorf("failed to decode encryption secret: %v", err)
111+ }
112+ return secret, nil
113+ default:
114+ return nil, errors.New("failed to decode encryption secret")
115+ }
71}
116}
72
117
73// decodeTicket decodes an encoded ticket string
118// decodeTicket decodes an encoded ticket string
74func decodeTicket(encTicket string, cookieOpts *options.Cookie) (*ticket, error) {
119func decodeTicket(encTicket string, cookieOpts *options.Cookie) (*ticket, error) {
75 ticketParts := strings.Split(encTicket, ".")
120 ticketParts := strings.Split(encTicket, ".")
76− if len(ticketParts) != 2 {
121+ if len(ticketParts) != 2 && len(ticketParts) != 3 {
77 return nil, errors.New("failed to decode ticket")
122 return nil, errors.New("failed to decode ticket")
78 }
123 }
79− ticketID, secretBase64 := ticketParts[0], ticketParts[1]
124+ ticketID, errTicketID := decodeTicketID(ticketParts)
80−
125+ if errTicketID != nil {
81− secret, err := base64.RawURLEncoding.DecodeString(secretBase64)
126+ return nil, fmt.Errorf("failed to decode ticket: %v", errTicketID)
127+ }
128+ secret, errSecret := decodeTicketSecret(ticketParts)
82− if err != nil {
129+ if errSecret != nil {
83− return nil, fmt.Errorf("failed to decode encryption secret: %v", err)
130+ return nil, fmt.Errorf("failed to decode ticket: %v", errSecret)
84 }
131 }
85−
86 return &ticket{
132 return &ticket{
87 id: ticketID,
133 id: ticketID,
88 secret: secret,
134 secret: secret,
pkg/sessions/persistence/ticket_test.go+3−3
@@ -43,8 +43,8 @@ var _ = Describe("Session Ticket Tests", func() {
43 Name: "dummy",
43 Name: "dummy",
44 },
44 },
45 },
45 },
46− encodedTicket: fmt.Sprintf("%s.%s",
46+ encodedTicket: fmt.Sprintf("v2.%s.%s",
47− "dummy-0123456789abcdef",
47+ base64.RawURLEncoding.EncodeToString([]byte("dummy-0123456789abcdef")),
48 base64.RawURLEncoding.EncodeToString([]byte("0123456789abcdef"))),
48 base64.RawURLEncoding.EncodeToString([]byte("0123456789abcdef"))),
49 expectedError: nil,
49 expectedError: nil,
50 }),
50 }),
@@ -56,7 +56,7 @@ var _ = Describe("Session Ticket Tests", func() {
56 Entry("with an invalid base64 encoded secret", ticketTableInput{
56 Entry("with an invalid base64 encoded secret", ticketTableInput{
57 ticket: nil,
57 ticket: nil,
58 encodedTicket: "dummy-0123456789abcdef.@)#($*@)#(*$@)#(*$",
58 encodedTicket: "dummy-0123456789abcdef.@)#($*@)#(*$@)#(*$",
59− expectedError: fmt.Errorf("failed to decode encryption secret: illegal base64 data at input byte 0"),
59+ expectedError: fmt.Errorf("failed to decode ticket: failed to decode encryption secret: illegal base64 data at input byte 0"),
60 }),
60 }),
61 )
61 )
62 })
62 })