git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #1045 from oauth2-proxy/fix-missing-redirect-scheme
20cf033Joel Speed
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -8,6 +8,7 @@
8
8
9## Changes since v7.0.1
9## Changes since v7.0.1
10
10
11+- [#1045](https://github.com/oauth2-proxy/oauth2-proxy/pull/1045) Ensure redirect URI always has a scheme (@JoelSpeed)
11- [#914](https://github.com/oauth2-proxy/oauth2-proxy/pull/914) Extract email from id_token for azure provider when oidc is configured
12- [#914](https://github.com/oauth2-proxy/oauth2-proxy/pull/914) Extract email from id_token for azure provider when oidc is configured
12- [#1047](https://github.com/oauth2-proxy/oauth2-proxy/pull/1047) Refactor HTTP Server and add ServerGroup to handle graceful shutdown of multiple servers (@JoelSpeed)
13- [#1047](https://github.com/oauth2-proxy/oauth2-proxy/pull/1047) Refactor HTTP Server and add ServerGroup to handle graceful shutdown of multiple servers (@JoelSpeed)
13- [#1070](https://github.com/oauth2-proxy/oauth2-proxy/pull/1070) Refactor logging middleware to middleware package (@NickMeves)
14- [#1070](https://github.com/oauth2-proxy/oauth2-proxy/pull/1070) Refactor logging middleware to middleware package (@NickMeves)
oauthproxy.go+6
@@ -35,6 +35,7 @@ import (
35)
35)
36
36
37const (
37const (
38+ schemeHTTP = "http"
38 schemeHTTPS = "https"
39 schemeHTTPS = "https"
39 applicationJSON = "application/json"
40 applicationJSON = "application/json"
40)
41)
@@ -971,6 +972,11 @@ func (p *OAuthProxy) getOAuthRedirectURI(req *http.Request) string {
971 rd.Host = requestutil.GetRequestHost(req)
972 rd.Host = requestutil.GetRequestHost(req)
972 rd.Scheme = requestutil.GetRequestProto(req)
973 rd.Scheme = requestutil.GetRequestProto(req)
973
974
975+ // If there's no scheme in the request, we should still include one
976+ if rd.Scheme == "" {
977+ rd.Scheme = schemeHTTP
978+ }
979+
974 // If CookieSecure is true, return `https` no matter what
980 // If CookieSecure is true, return `https` no matter what
975 // Not all reverse proxies set X-Forwarded-Proto
981 // Not all reverse proxies set X-Forwarded-Proto
976 if p.CookieSecure {
982 if p.CookieSecure {
pkg/validation/options.go+5−3
@@ -30,6 +30,8 @@ func Validate(o *options.Options) error {
30 msgs = append(msgs, validateRedisSessionStore(o)...)
30 msgs = append(msgs, validateRedisSessionStore(o)...)
31 msgs = append(msgs, prefixValues("injectRequestHeaders: ", validateHeaders(o.InjectRequestHeaders)...)...)
31 msgs = append(msgs, prefixValues("injectRequestHeaders: ", validateHeaders(o.InjectRequestHeaders)...)...)
32 msgs = append(msgs, prefixValues("injectResponseHeaders: ", validateHeaders(o.InjectResponseHeaders)...)...)
32 msgs = append(msgs, prefixValues("injectResponseHeaders: ", validateHeaders(o.InjectResponseHeaders)...)...)
33+ msgs = parseSignatureKey(o, msgs)
34+ msgs = configureLogger(o.Logging, msgs)
33
35
34 if o.SSLInsecureSkipVerify {
36 if o.SSLInsecureSkipVerify {
35 // InsecureSkipVerify is a configurable option we allow
37 // InsecureSkipVerify is a configurable option we allow
@@ -175,6 +177,9 @@ func Validate(o *options.Options) error {
175 var redirectURL *url.URL
177 var redirectURL *url.URL
176 redirectURL, msgs = parseURL(o.RawRedirectURL, "redirect", msgs)
178 redirectURL, msgs = parseURL(o.RawRedirectURL, "redirect", msgs)
177 o.SetRedirectURL(redirectURL)
179 o.SetRedirectURL(redirectURL)
180+ if o.RawRedirectURL == "" && !o.Cookie.Secure && !o.ReverseProxy {
181+ logger.Print("WARNING: no explicit redirect URL: redirects will default to insecure HTTP")
182+ }
178
183
179 msgs = append(msgs, validateUpstreams(o.UpstreamServers)...)
184 msgs = append(msgs, validateUpstreams(o.UpstreamServers)...)
180 msgs = parseProviderInfo(o, msgs)
185 msgs = parseProviderInfo(o, msgs)
@@ -191,9 +196,6 @@ func Validate(o *options.Options) error {
191 }
196 }
192 }
197 }
193
198
194− msgs = parseSignatureKey(o, msgs)
195− msgs = configureLogger(o.Logging, msgs)
196−
197 if o.ReverseProxy {
199 if o.ReverseProxy {
198 parser, err := ip.GetRealClientIPParser(o.RealClientIPHeader)
200 parser, err := ip.GetRealClientIPParser(o.RealClientIPHeader)
199 if err != nil {
201 if err != nil {