git.iko.soy/typeable/oauth2-proxy
on master help sign in
Implement ValidateSessionState for GitHubProvider (#385)
2033ce8Iain Buclaw
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -9,6 +9,7 @@
9
9
10## Changes since v5.0.0
10## Changes since v5.0.0
11
11
12+- [#385](https://github.com/pusher/oauth2_proxy/pull/385) Use the `Authorization` header instead of `access_token` for refreshing GitHub Provider sessions (@ibuclaw)
12- [#372](https://github.com/pusher/oauth2_proxy/pull/372) Allow fallback to secondary verified email address in GitHub provider (@dmnemec)
13- [#372](https://github.com/pusher/oauth2_proxy/pull/372) Allow fallback to secondary verified email address in GitHub provider (@dmnemec)
13- [#335](https://github.com/pusher/oauth2_proxy/pull/335) OIDC Provider support for empty id_tokens in the access token refresh response (@howzat)
14- [#335](https://github.com/pusher/oauth2_proxy/pull/335) OIDC Provider support for empty id_tokens in the access token refresh response (@howzat)
14- [#363](https://github.com/pusher/oauth2_proxy/pull/363) Extension of Redis Session Store to Support Redis Cluster (@yan-dblinf)
15- [#363](https://github.com/pusher/oauth2_proxy/pull/363) Extension of Redis Session Store to Support Redis Cluster (@yan-dblinf)
providers/github.go+16−6
@@ -53,6 +53,13 @@ func NewGitHubProvider(p *ProviderData) *GitHubProvider {
53 return &GitHubProvider{ProviderData: p}
53 return &GitHubProvider{ProviderData: p}
54}
54}
55
55
56+func getGitHubHeader(accessToken string) http.Header {
57+ header := make(http.Header)
58+ header.Set("Accept", "application/vnd.github.v3+json")
59+ header.Set("Authorization", fmt.Sprintf("token %s", accessToken))
60+ return header
61+}
62+
56// SetOrgTeam adds GitHub org reading parameters to the OAuth2 scope
63// SetOrgTeam adds GitHub org reading parameters to the OAuth2 scope
57func (p *GitHubProvider) SetOrgTeam(org, team string) {
64func (p *GitHubProvider) SetOrgTeam(org, team string) {
58 p.Org = org
65 p.Org = org
@@ -87,8 +94,7 @@ func (p *GitHubProvider) hasOrg(accessToken string) (bool, error) {
87 RawQuery: params.Encode(),
94 RawQuery: params.Encode(),
88 }
95 }
89 req, _ := http.NewRequest("GET", endpoint.String(), nil)
96 req, _ := http.NewRequest("GET", endpoint.String(), nil)
90− req.Header.Set("Accept", "application/vnd.github.v3+json")
97+ req.Header = getGitHubHeader(accessToken)
91− req.Header.Set("Authorization", fmt.Sprintf("token %s", accessToken))
92 resp, err := http.DefaultClient.Do(req)
98 resp, err := http.DefaultClient.Do(req)
93 if err != nil {
99 if err != nil {
94 return false, err
100 return false, err
@@ -164,8 +170,7 @@ func (p *GitHubProvider) hasOrgAndTeam(accessToken string) (bool, error) {
164 }
170 }
165
171
166 req, _ := http.NewRequest("GET", endpoint.String(), nil)
172 req, _ := http.NewRequest("GET", endpoint.String(), nil)
167− req.Header.Set("Accept", "application/vnd.github.v3+json")
173+ req.Header = getGitHubHeader(accessToken)
168− req.Header.Set("Authorization", fmt.Sprintf("token %s", accessToken))
169 resp, err := http.DefaultClient.Do(req)
174 resp, err := http.DefaultClient.Do(req)
170 if err != nil {
175 if err != nil {
171 return false, err
176 return false, err
@@ -283,7 +288,7 @@ func (p *GitHubProvider) GetEmailAddress(s *sessions.SessionState) (string, erro
283 Path: path.Join(p.ValidateURL.Path, "/user/emails"),
288 Path: path.Join(p.ValidateURL.Path, "/user/emails"),
284 }
289 }
285 req, _ := http.NewRequest("GET", endpoint.String(), nil)
290 req, _ := http.NewRequest("GET", endpoint.String(), nil)
286− req.Header.Set("Authorization", fmt.Sprintf("token %s", s.AccessToken))
291+ req.Header = getGitHubHeader(s.AccessToken)
287 resp, err := http.DefaultClient.Do(req)
292 resp, err := http.DefaultClient.Do(req)
288 if err != nil {
293 if err != nil {
289 return "", err
294 return "", err
@@ -336,7 +341,7 @@ func (p *GitHubProvider) GetUserName(s *sessions.SessionState) (string, error) {
336 return "", fmt.Errorf("could not create new GET request: %v", err)
341 return "", fmt.Errorf("could not create new GET request: %v", err)
337 }
342 }
338
343
339− req.Header.Set("Authorization", fmt.Sprintf("token %s", s.AccessToken))
344+ req.Header = getGitHubHeader(s.AccessToken)
340 resp, err := http.DefaultClient.Do(req)
345 resp, err := http.DefaultClient.Do(req)
341 if err != nil {
346 if err != nil {
342 return "", err
347 return "", err
@@ -361,3 +366,8 @@ func (p *GitHubProvider) GetUserName(s *sessions.SessionState) (string, error) {
361
366
362 return user.Login, nil
367 return user.Login, nil
363}
368}
369+
370+// ValidateSessionState validates the AccessToken
371+func (p *GitHubProvider) ValidateSessionState(s *sessions.SessionState) bool {
372+ return validateToken(p, s.AccessToken, getGitHubHeader(s.AccessToken))
373+}