289dfce · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

logger.go ExcludedPaths changed to slice of paths.

289dfceKarl Skewes7 years ago

docs/configuration/configuration.md+3−2

compare with master

unifiedsplit

@@ -41,8 +41,9 @@ Usage of oauth2_proxy:

41 -custom-templates-dir string: path to custom html templates

42 -display-htpasswd-form: display username / password login form if an htpasswd file is provided (default true)

43 -email-domain value: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email

44+<<<<<<< HEAD

44 -extra-jwt-issuers: if -skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)

45 -extra-jwt-issuers: if -skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)

45− -exclude-logging-path: don't log requests to this path, eg: /ping (default "" = no paths excluded)

46+ -exclude-logging-paths: comma separated list of paths to exclude from logging, eg: "/ping,/path2" (default "" = no paths excluded)

46 -flush-interval: period between flushing response buffers when streaming responses (default "1s")

47 -flush-interval: period between flushing response buffers when streaming responses (default "1s")

47 -banner string: custom banner string. Use "-" to disable default banner.

48 -banner string: custom banner string. Use "-" to disable default banner.

48 -footer string: custom footer string. Use "-" to disable default footer.

49 -footer string: custom footer string. Use "-" to disable default footer.

@@ -142,7 +143,7 @@ There are three different types of logging: standard, authentication, and HTTP r

142

143

143Each type of logging has their own configurable format and variables. By default these formats are similar to the Apache Combined Log.

144Each type of logging has their own configurable format and variables. By default these formats are similar to the Apache Combined Log.

144

145

145−Logging of requests to the `/ping` endpoint can be disabled with `-silence-ping-logging` reducing log volume. This flag sets the `-exclude-logging-path` value to the `-ping-path` and takes precedence over any other value `-exclude-logging-path` may have been set to directly.

146+Logging of requests to the `/ping` endpoint can be disabled with `-silence-ping-logging` reducing log volume. This flag appends the `-ping-path` to `-exclude-logging-paths`.

146

147

147### Auth Log Format

148### Auth Log Format

148Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:

149Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:

logging_handler_test.go+18−10

@@ -19,16 +19,21 @@ func TestLoggingHandler_ServeHTTP(t *testing.T) {

19 Format,

20 ExpectedLogMessage,

21 Path string

22− ExcludePath string

22+ ExcludePaths []string

23+ SilencePingLogging bool

23 }{

24 }{

24− {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", ""},

25+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{}, false},

25− {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", "/ping"},

26+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{}, true},

26− {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/ping\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/ping", ""},

27+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", []string{"/ping"}, false},

28+ {logger.DefaultRequestLoggingFormat, "", "/foo/bar", []string{"/foo/bar"}, false},

29+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{}, true},

30+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/ping"}, false},

27− {logger.DefaultRequestLoggingFormat, "", "/ping", "/ping"},

31+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/ping"}, true},

32+ {logger.DefaultRequestLoggingFormat, "", "/ping", []string{"/foo/bar", "/ping"}, false},

28− {"{{.RequestMethod}}", "GET\n", "/foo/bar", ""},

33+ {"{{.RequestMethod}}", "GET\n", "/foo/bar", []string{}, true},

29− {"{{.RequestMethod}}", "GET\n", "/foo/bar", "/ping"},

34+ {"{{.RequestMethod}}", "GET\n", "/foo/bar", []string{"/ping"}, false},

30− {"{{.RequestMethod}}", "GET\n", "/ping", ""},

35+ {"{{.RequestMethod}}", "GET\n", "/ping", []string{}, false},

31− {"{{.RequestMethod}}", "", "/ping", "/ping"},

36+ {"{{.RequestMethod}}", "", "/ping", []string{"/ping"}, true},

32 }

37 }

34 for _, test := range tests {

39 for _, test := range tests {

@@ -44,7 +49,10 @@ func TestLoggingHandler_ServeHTTP(t *testing.T) {

45 logger.SetOutput(buf)

50 logger.SetOutput(buf)

46 logger.SetReqTemplate(test.Format)

51 logger.SetReqTemplate(test.Format)

47− logger.SetExcludePath(test.ExcludePath)

52+ if test.SilencePingLogging {

53+ test.ExcludePaths = append(test.ExcludePaths, "/ping")

54+ }

55+ logger.SetExcludePaths(test.ExcludePaths)

48 h := LoggingHandler(http.HandlerFunc(handler))

56 h := LoggingHandler(http.HandlerFunc(handler))

50 r, _ := http.NewRequest("GET", test.Path, nil)

58 r, _ := http.NewRequest("GET", test.Path, nil)

main.go+1−1

@@ -99,7 +99,7 @@ func main() {

100 flagSet.Bool("request-logging", true, "Log HTTP requests")

101 flagSet.String("request-logging-format", logger.DefaultRequestLoggingFormat, "Template for HTTP request log lines")

102− flagSet.String("exclude-logging-path", "", "Exclude logging requests to path (eg: /ping)")

102+ flagSet.String("exclude-logging-paths", "", "Exclude logging requests to paths (eg: '/path1,/path2,/path3')")

103 flagSet.Bool("silence-ping-logging", false, "Disable logging of requests to ping endpoint")

104

105 flagSet.Bool("auth-logging", true, "Log authentication attempts")

options.go+7−5

@@ -104,7 +104,7 @@ type Options struct {

104 StandardLoggingFormat string `flag:"standard-logging-format" cfg:"standard_logging_format" env:"OAUTH2_PROXY_STANDARD_LOGGING_FORMAT"`

105 RequestLogging bool `flag:"request-logging" cfg:"request_logging" env:"OAUTH2_PROXY_REQUEST_LOGGING"`

106 RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format" env:"OAUTH2_PROXY_REQUEST_LOGGING_FORMAT"`

107− ExcludeLoggingPath string `flag:"exclude-logging-path" cfg:"exclude_logging_path" env:"OAUTH2_PROXY_EXCLUDE_LOGGING_PATH"`

107+ ExcludeLoggingPaths string `flag:"exclude-logging-paths" cfg:"exclude_logging_paths" env:"OAUTH2_EXCLUDE_LOGGING_PATHS"`

108 SilencePingLogging bool `flag:"silence-ping-logging" cfg:"silence_ping_logging" env:"OAUTH2_PROXY_SILENCE_PING_LOGGING"`

109 AuthLogging bool `flag:"auth-logging" cfg:"auth_logging" env:"OAUTH2_PROXY_LOGGING_AUTH_LOGGING"`

110 AuthLoggingFormat string `flag:"auth-logging-format" cfg:"auth_logging_format" env:"OAUTH2_PROXY_AUTH_LOGGING_FORMAT"`

@@ -168,7 +168,7 @@ func NewOptions() *Options {

168 LoggingMaxBackups: 0,

169 LoggingLocalTime: true,

170 LoggingCompress: false,

171− ExcludeLoggingPath: "",

171+ ExcludeLoggingPaths: "",

172 SilencePingLogging: false,

173 StandardLogging: true,

174 StandardLoggingFormat: logger.DefaultStandardLoggingFormat,

@@ -576,12 +576,14 @@ func setupLogger(o *Options, msgs []string) []string {

576 logger.SetAuthTemplate(o.AuthLoggingFormat)

577 logger.SetReqTemplate(o.RequestLoggingFormat)

578

579+ excludePaths := make([]string, 0)

580+ excludePaths = append(excludePaths, strings.Split(o.ExcludeLoggingPaths, ",")...)

579 if o.SilencePingLogging {

581 if o.SilencePingLogging {

580− logger.SetExcludePath(o.PingPath)

582+ excludePaths = append(excludePaths, o.PingPath)

581− } else {

582− logger.SetExcludePath(o.ExcludeLoggingPath)

583 }

584

585+ logger.SetExcludePaths(excludePaths)

586+

585 if !o.LoggingLocalTime {

587 if !o.LoggingLocalTime {

586 logger.SetFlags(logger.Flags() | logger.LUTC)

588 logger.SetFlags(logger.Flags() | logger.LUTC)

587 }

589 }

pkg/logger/logger.go+12−9

@@ -88,7 +88,7 @@ type Logger struct {

88 stdEnabled bool

89 authEnabled bool

90 reqEnabled bool

91− excludePath string

91+ excludePaths map[string]struct{}

92 stdLogTemplate *template.Template

93 authTemplate *template.Template

94 reqTemplate *template.Template

@@ -102,7 +102,7 @@ func New(flag int) *Logger {

102 stdEnabled: true,

103 authEnabled: true,

104 reqEnabled: true,

105− excludePath: "",

105+ excludePaths: nil,

106 stdLogTemplate: template.Must(template.New("std-log").Parse(DefaultStandardLoggingFormat)),

107 authTemplate: template.Must(template.New("auth-log").Parse(DefaultAuthLoggingFormat)),

108 reqTemplate: template.Must(template.New("req-log").Parse(DefaultRequestLoggingFormat)),

@@ -179,7 +179,7 @@ func (l *Logger) PrintReq(username, upstream string, req *http.Request, url url.

179 return

180 }

181

182− if url.Path == l.excludePath {

182+ if _, excludedPath := l.excludePaths[url.Path]; excludedPath {

183 return

184 }

185

@@ -308,11 +308,14 @@ func (l *Logger) SetReqEnabled(e bool) {

308 l.reqEnabled = e

309}

310

311−// SetExcludePath sets the path to exclude from logging.

311+// SetExcludePaths sets the paths to exclude from logging.

312−func (l *Logger) SetExcludePath(s string) {

312+func (l *Logger) SetExcludePaths(s []string) {

313 l.mu.Lock()

314 defer l.mu.Unlock()

315− l.excludePath = s

315+ l.excludePaths = make(map[string]struct{})

316+ for _, p := range s {

317+ l.excludePaths[p] = struct{}{}

318+ }

316}

319}

317

320

318// SetStandardTemplate sets the template for standard logging.

321// SetStandardTemplate sets the template for standard logging.

@@ -378,9 +381,9 @@ func SetReqEnabled(e bool) {

378 std.SetReqEnabled(e)

381 std.SetReqEnabled(e)

379}

382}

380

383

381−// SetExcludePath sets the path to exclude from logging, eg: health checks

384+// SetExcludePaths sets the path to exclude from logging, eg: health checks

382−func SetExcludePath(s string) {

385+func SetExcludePaths(s []string) {

383− std.SetExcludePath(s)

386+ std.SetExcludePaths(s)

384}

387}

385

388

386// SetStandardTemplate sets the template for standard logging for

389// SetStandardTemplate sets the template for standard logging for