37c415b · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Self code review changes

commit37c415b8892292692a003f5f7618ee3223600048 authorMisterWil <wilrader@gmail.com> dateSun 10 Feb 2019, 09:01 (8 years ago) parent8ec025f

2 files changed+15−15

compare with master

unifiedsplit

main.go+2−2 oauthproxy.go+13−13

main.go+2−2

@@ -20,7 +20,7 @@ func main() {

2020 flagSet := flag.NewFlagSet("oauth2_proxy", flag.ExitOnError)

2121

2222 emailDomains := StringArray{}

23− whitelistandardomains := StringArray{}

23+ whitelistDomains := StringArray{}

2424 upstreams := StringArray{}

2525 skipAuthRegex := StringArray{}

2626 googleGroups := StringArray{}

@@ -49,7 +49,7 @@ func main() {

4949 flagSet.Duration("flush-interval", time.Duration(1)*time.Second, "period between response flushing when streaming responses")

5050

5151 flagSet.Var(&emailDomains, "email-domain", "authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email")

52− flagSet.Var(&whitelistandardomains, "whitelist-domain", "allowed domains for redirection after authentication. Prefix domain with a . to allow subdomains (eg .example.com)")

52+ flagSet.Var(&whitelistDomains, "whitelist-domain", "allowed domains for redirection after authentication. Prefix domain with a . to allow subdomains (eg .example.com)")

5353 flagSet.String("azure-tenant", "common", "go to a tenant-specific or common (tenant-independent) endpoint.")

5454 flagSet.String("github-org", "", "restrict logins to members of this organisation")

5555 flagSet.String("github-team", "", "restrict logins to members of this team")

oauthproxy.go+13−13

@@ -604,10 +604,10 @@ func (p *OAuthProxy) ManualSignIn(rw http.ResponseWriter, req *http.Request) (st

604604 }

605605 // check auth

606606 if p.HtpasswdFile.Validate(user, passwd) {

607− logger.PrintAuthf(user, req, logger.AuthSuccess, "Successful authentication via HtpasswdFile")

607+ logger.PrintAuthf(user, req, logger.AuthSuccess, "Authenticated via HtpasswdFile")

608608 return user, true

609609 }

610− logger.PrintAuthf(user, req, logger.AuthFailure, "Failed authentication via HtpasswdFile; unauthorized")

610+ logger.PrintAuthf(user, req, logger.AuthFailure, "Invalid authentication via HtpasswdFile")

611611 return "", false

612612}

613613

@@ -755,27 +755,27 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {

755755 // finish the oauth cycle

756756 err := req.ParseForm()

757757 if err != nil {

758− logger.Printf("Error while parsing OAuth callback: %s" + err.Error())

758+ logger.Printf("Error while parsing OAuth2 callback: %s" + err.Error())

759759 p.ErrorPage(rw, 500, "Internal Error", err.Error())

760760 return

761761 }

762762 errorString := req.Form.Get("error")

763763 if errorString != "" {

764− logger.Printf("Error while parsing OAuth callback: %s ", errorString)

764+ logger.Printf("Error while parsing OAuth2 callback: %s ", errorString)

765765 p.ErrorPage(rw, 403, "Permission Denied", errorString)

766766 return

767767 }

768768

769769 session, err := p.redeemCode(req.Host, req.Form.Get("code"))

770770 if err != nil {

771− logger.Printf("Error while parsing OAuth callback: %s ", errorString)

771+ logger.Printf("Error redeeming code during OAuth2 callback: %s ", errorString)

772772 p.ErrorPage(rw, 500, "Internal Error", "Internal Error")

773773 return

774774 }

775775

776776 s := strings.SplitN(req.Form.Get("state"), ":", 2)

777777 if len(s) != 2 {

778− logger.Printf("Error while parsing OAuth state; invalid length")

778+ logger.Printf("Error while parsing OAuth2 state; invalid length")

779779 p.ErrorPage(rw, 500, "Internal Error", "Invalid State")

780780 return

781781 }

@@ -783,13 +783,13 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {

783783 redirect := s[1]

784784 c, err := req.Cookie(p.CSRFCookieName)

785785 if err != nil {

786− logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Failed authentication via oauth2; unable too obtain CSRF cookie")

786+ logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2; unable too obtain CSRF cookie")

787787 p.ErrorPage(rw, 403, "Permission Denied", err.Error())

788788 return

789789 }

790790 p.ClearCSRFCookie(rw, req)

791791 if c.Value != nonce {

792− logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Failed authentication via oauth2; csrf token mismatch, potential attack")

792+ logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2; csrf token mismatch, potential attack")

793793 p.ErrorPage(rw, 403, "Permission Denied", "csrf failed")

794794 return

795795 }

@@ -800,7 +800,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {

800800

801801 // set cookie, or deny

802802 if p.Validator(session.Email) && p.provider.ValidateGroup(session.Email) {

803− logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Successful authentication via oauth2; %s", session)

803+ logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Authenticated via OAuth2; %s", session)

804804 err := p.SaveSession(rw, req, session)

805805 if err != nil {

806806 logger.Printf("%s %s", remoteAddr, err)

@@ -809,7 +809,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {

809809 }

810810 http.Redirect(rw, req, redirect, 302)

811811 } else {

812− logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Failed authentication via oauth2; unauthorized")

812+ logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Invalid authentication via OAuth2; unauthorized")

813813 p.ErrorPage(rw, 403, "Permission Denied", "Invalid Account")

814814 }

815815}

@@ -885,7 +885,7 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int

885885 }

886886

887887 if session != nil && session.Email != "" && !p.Validator(session.Email) {

888− logger.Printf(session.Email, req, logger.AuthFailure, "Failed authentication via session; removing session %s", session)

888+ logger.Printf(session.Email, req, logger.AuthFailure, "Invalid authentication via session; removing session %s", session)

889889 session = nil

890890 saveSession = false

891891 clearSession = true

@@ -979,10 +979,10 @@ func (p *OAuthProxy) CheckBasicAuth(req *http.Request) (*providers.SessionState,

979979 return nil, fmt.Errorf("invalid format %s", b)

980980 }

981981 if p.HtpasswdFile.Validate(pair[0], pair[1]) {

982− logger.PrintAuthf(pair[0], req, logger.AuthSuccess, "Successful authentication via basic auth")

982+ logger.PrintAuthf(pair[0], req, logger.AuthSuccess, "Authenticated via basic auth and HTpasswd File")

983983 return &providers.SessionState{User: pair[0]}, nil

984984 }

985− logger.PrintAuthf(pair[0], req, logger.AuthFailure, "Failed authentication via basic auth; not in Htpasswd file")

985+ logger.PrintAuthf(pair[0], req, logger.AuthFailure, "Invalid authentication via basic auth; not in Htpasswd File")

986986 return nil, fmt.Errorf("%s not in HtpasswdFile", pair[0])

987987}

988988