git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #58 from tomtaylor/httponly-cookie

Add flag to enable/disable cookie's HttpOnly flag.

commit1f8797e468faf056e00f22d63a99fef2ef40a31d authorJehiah Czebotar <jehiah@gmail.com> dateMon 19 Jan 2015, 12:48 (12 years ago) parent9d264f3132e3d9
4 files changed+9−3
compare with master
unifiedsplit
contrib/google_auth_proxy.cfg.example+1 main.go+1 oauthproxy.go+5−3 options.go+2
contrib/google_auth_proxy.cfg.example+1
@@ -42,3 +42,4 @@
4242# cookie_domain = ""
4343# cookie_expire = "168h"
4444# cookie_https_only = true
45+# cookie_httponly = true
main.go+1
@@ -41,6 +41,7 @@ func main() {
4141 flagSet.String("cookie-domain", "", "an optional cookie domain to force cookies to (ie: .yourcompany.com)*")
4242 flagSet.Duration("cookie-expire", time.Duration(168)*time.Hour, "expire timeframe for cookie")
4343 flagSet.Bool("cookie-https-only", true, "set HTTPS only cookie")
44+ flagSet.Bool("cookie-httponly", true, "set HttpOnly cookie")
4445
4546 flagSet.Parse(os.Args[1:])
4647
oauthproxy.go+5−3
@@ -27,6 +27,7 @@ type OauthProxy struct {
2727 CookieKey string
2828 CookieDomain string
2929 CookieHttpsOnly bool
30+ CookieHttpOnly bool
3031 CookieExpire time.Duration
3132 Validator func(string) bool
3233
@@ -67,12 +68,13 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
6768 if domain == "" {
6869 domain = "<default>"
6970 }
70− log.Printf("Cookie settings: https_only: %v expiry: %s domain:%s", opts.CookieHttpsOnly, opts.CookieExpire, domain)
71+ log.Printf("Cookie settings: https_only: %v httponly: %v expiry: %s domain:%s", opts.CookieHttpsOnly, opts.CookieHttpOnly, opts.CookieExpire, domain)
7172 return &OauthProxy{
7273 CookieKey: "_oauthproxy",
7374 CookieSeed: opts.CookieSecret,
7475 CookieDomain: opts.CookieDomain,
7576 CookieHttpsOnly: opts.CookieHttpsOnly,
77+ CookieHttpOnly: opts.CookieHttpOnly,
7678 CookieExpire: opts.CookieExpire,
7779 Validator: validator,
7880
@@ -197,7 +199,7 @@ func (p *OauthProxy) ClearCookie(rw http.ResponseWriter, req *http.Request) {
197199 Path: "/",
198200 Domain: domain,
199201 Expires: time.Now().Add(time.Duration(1) * time.Hour * -1),
200− HttpOnly: true,
202+ HttpOnly: p.CookieHttpOnly,
201203 }
202204 http.SetCookie(rw, cookie)
203205}
@@ -213,7 +215,7 @@ func (p *OauthProxy) SetCookie(rw http.ResponseWriter, req *http.Request, val st
213215 Value: signedCookieValue(p.CookieSeed, p.CookieKey, val),
214216 Path: "/",
215217 Domain: domain,
216− HttpOnly: true,
218+ HttpOnly: p.CookieHttpOnly,
217219 Secure: p.CookieHttpsOnly,
218220 Expires: time.Now().Add(p.CookieExpire),
219221 }
options.go+2
@@ -21,6 +21,7 @@ type Options struct {
2121 CookieDomain string `flag:"cookie-domain" cfg:"cookie_domain" env:"GOOGLE_AUTH_PROXY_COOKIE_DOMAIN"`
2222 CookieExpire time.Duration `flag:"cookie-expire" cfg:"cookie_expire" env:"GOOGLE_AUTH_PROXY_COOKIE_EXPIRE"`
2323 CookieHttpsOnly bool `flag:"cookie-https-only" cfg:"cookie_https_only"`
24+ CookieHttpOnly bool `flag:"cookie-httponly" cfg:"cookie_httponly"`
2425 AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file"`
2526 GoogleAppsDomains []string `flag:"google-apps-domain" cfg:"google_apps_domains"`
2627 Upstreams []string `flag:"upstream" cfg:"upstreams"`
@@ -37,6 +38,7 @@ func NewOptions() *Options {
3738 HttpAddress: "127.0.0.1:4180",
3839 DisplayHtpasswdForm: true,
3940 CookieHttpsOnly: true,
41+ CookieHttpOnly: true,
4042 PassBasicAuth: true,
4143 CookieExpire: time.Duration(168) * time.Hour,
4244 }