git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #1045 from oauth2-proxy/fix-missing-redirect-scheme

Ensure redirect URI always has a scheme

commit20cf0330655bf7457c586e9cd2573ca432c6e4dd authorJoel Speed <Joel.speed@hotmail.co.uk> dateSun 14 Mar 2021, 16:06 (6 years ago) parentf3209a49dbd5f5
3 files changed+12−3
compare with master
unifiedsplit
CHANGELOG.md+1 oauthproxy.go+6 pkg/validation/options.go+5−3
CHANGELOG.md+1
@@ -8,6 +8,7 @@
88
99## Changes since v7.0.1
1010
11+- [#1045](https://github.com/oauth2-proxy/oauth2-proxy/pull/1045) Ensure redirect URI always has a scheme (@JoelSpeed)
1112- [#914](https://github.com/oauth2-proxy/oauth2-proxy/pull/914) Extract email from id_token for azure provider when oidc is configured
1213- [#1047](https://github.com/oauth2-proxy/oauth2-proxy/pull/1047) Refactor HTTP Server and add ServerGroup to handle graceful shutdown of multiple servers (@JoelSpeed)
1314- [#1070](https://github.com/oauth2-proxy/oauth2-proxy/pull/1070) Refactor logging middleware to middleware package (@NickMeves)
oauthproxy.go+6
@@ -35,6 +35,7 @@ import (
3535)
3636
3737const (
38+ schemeHTTP = "http"
3839 schemeHTTPS = "https"
3940 applicationJSON = "application/json"
4041)
@@ -971,6 +972,11 @@ func (p *OAuthProxy) getOAuthRedirectURI(req *http.Request) string {
971972 rd.Host = requestutil.GetRequestHost(req)
972973 rd.Scheme = requestutil.GetRequestProto(req)
973974
975+ // If there's no scheme in the request, we should still include one
976+ if rd.Scheme == "" {
977+ rd.Scheme = schemeHTTP
978+ }
979+
974980 // If CookieSecure is true, return `https` no matter what
975981 // Not all reverse proxies set X-Forwarded-Proto
976982 if p.CookieSecure {
pkg/validation/options.go+5−3
@@ -30,6 +30,8 @@ func Validate(o *options.Options) error {
3030 msgs = append(msgs, validateRedisSessionStore(o)...)
3131 msgs = append(msgs, prefixValues("injectRequestHeaders: ", validateHeaders(o.InjectRequestHeaders)...)...)
3232 msgs = append(msgs, prefixValues("injectResponseHeaders: ", validateHeaders(o.InjectResponseHeaders)...)...)
33+ msgs = parseSignatureKey(o, msgs)
34+ msgs = configureLogger(o.Logging, msgs)
3335
3436 if o.SSLInsecureSkipVerify {
3537 // InsecureSkipVerify is a configurable option we allow
@@ -175,6 +177,9 @@ func Validate(o *options.Options) error {
175177 var redirectURL *url.URL
176178 redirectURL, msgs = parseURL(o.RawRedirectURL, "redirect", msgs)
177179 o.SetRedirectURL(redirectURL)
180+ if o.RawRedirectURL == "" && !o.Cookie.Secure && !o.ReverseProxy {
181+ logger.Print("WARNING: no explicit redirect URL: redirects will default to insecure HTTP")
182+ }
178183
179184 msgs = append(msgs, validateUpstreams(o.UpstreamServers)...)
180185 msgs = parseProviderInfo(o, msgs)
@@ -191,9 +196,6 @@ func Validate(o *options.Options) error {
191196 }
192197 }
193198
194− msgs = parseSignatureKey(o, msgs)
195− msgs = configureLogger(o.Logging, msgs)
196−
197199 if o.ReverseProxy {
198200 parser, err := ip.GetRealClientIPParser(o.RealClientIPHeader)
199201 if err != nil {