2280b42 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

Access token forwarding through nginx auth request (#68)

2280b42David Holsgrove8 years ago

CHANGELOG.md+2

@@ -2,6 +2,8 @@

3## Changes since v3.1.0

5+- [#68](https://github.com/pusher/oauth2_proxy/pull/68) forward X-Auth-Access-Token header (@davidholsgrove)

5# v3.1.0

7# v3.1.0

7## Release highlights

9## Release highlights

README.md+4

@@ -425,6 +425,10 @@ server {

425 proxy_set_header X-User $user;

426 proxy_set_header X-Email $email;

427

428+ # if you enabled --pass-access-token, this will pass the token to the backend

429+ auth_request_set $token $upstream_http_x_auth_request_access_token;

430+ proxy_set_header X-Access-Token $token;

431+

428 # if you enabled --cookie-refresh, this is needed for it to work with auth_request

432 # if you enabled --cookie-refresh, this is needed for it to work with auth_request

429 auth_request_set $auth_cookie $upstream_http_set_cookie;

433 auth_request_set $auth_cookie $upstream_http_set_cookie;

430 add_header Set-Cookie $auth_cookie;

434 add_header Set-Cookie $auth_cookie;

oauthproxy.go+3

@@ -880,6 +880,9 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int

880 if session.Email != "" {

881 rw.Header().Set("X-Auth-Request-Email", session.Email)

882 }

883+ if p.PassAccessToken && session.AccessToken != "" {

884+ rw.Header().Set("X-Auth-Request-Access-Token", session.AccessToken)

885+ }

883 }

886 }

884 if p.PassAccessToken && session.AccessToken != "" {

887 if p.PassAccessToken && session.AccessToken != "" {

885 req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}

888 req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}