git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge commit from fork

Signed-off-by: Jan Larwig <jan@larwig.com>

commit43596a7bab2053e091ddc513c865e20b4e4b08ea authorJan Larwig <jan@larwig.com> dateMon 13 Apr 2026, 18:20 (6 months ago) parent0337a95
3 files changed+39−13
compare with master
unifiedsplit
CHANGELOG.md+1 pkg/middleware/healthcheck.go+7−4 pkg/middleware/healthcheck_test.go+31−9
CHANGELOG.md+1
@@ -11,6 +11,7 @@
1111- [#3411](https://github.com/oauth2-proxy/oauth2-proxy/pull/3411) chore(deps): update gomod dependencies (@tuunit)
1212- [#3333](https://github.com/oauth2-proxy/oauth2-proxy/pull/3333) fix: invalidate session on fatal OAuth2 refresh errors (@frhack)
1313- [GHSA-f24x-5g9q-753f](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-f24x-5g9q-753f) fix: clear session cookie at beginning of signinpage handler (@fnoehWM / @bella-WI / @tuunit)
14+- [GHSA-5hvv-m4w4-gf6v](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v) fix: health check user-agent authentication bypass (@tuunit)
1415
1516# V7.15.1
1617
pkg/middleware/healthcheck.go+7−4
@@ -43,10 +43,13 @@ func healthCheck(paths, userAgents []string, next http.Handler) http.Handler {
4343
4444func isHealthCheckRequest(paths, userAgents map[string]struct{}, req *http.Request) bool {
4545 if _, ok := paths[req.URL.EscapedPath()]; ok {
46− return true
47− }
48− if _, ok := userAgents[req.Header.Get("User-Agent")]; ok {
49− return true
46+ if len(userAgents) == 0 {
47+ return true
48+ }
49+
50+ if _, ok := userAgents[req.Header.Get("User-Agent")]; ok {
51+ return true
52+ }
5053 }
5154 return false
5255}
pkg/middleware/healthcheck_test.go+31−9
@@ -45,6 +45,16 @@ var _ = Describe("HealthCheck suite", func() {
4545 healthCheckPaths: []string{"/ping"},
4646 healthCheckUserAgents: []string{"hc/1.0"},
4747 requestString: "http://example.com/ping",
48+ headers: map[string]string{
49+ "User-Agent": "hc/1.0",
50+ },
51+ expectedStatus: 200,
52+ expectedBody: "OK",
53+ }),
54+ Entry("when requesting the healthcheck path with no health check user agents configured", &requestTableInput{
55+ healthCheckPaths: []string{"/ping"},
56+ healthCheckUserAgents: []string{},
57+ requestString: "http://example.com/ping",
4858 headers: map[string]string{},
4959 expectedStatus: 200,
5060 expectedBody: "OK",
@@ -85,15 +95,25 @@ var _ = Describe("HealthCheck suite", func() {
8595 expectedStatus: 404,
8696 expectedBody: "404 page not found\n",
8797 }),
88− Entry("with a request from the health check user agent", &requestTableInput{
98+ Entry("with a request from the health check user agent on a non-healthcheck path", &requestTableInput{
8999 healthCheckPaths: []string{"/ping"},
90100 healthCheckUserAgents: []string{"hc/1.0"},
91101 requestString: "http://example.com/abc",
92102 headers: map[string]string{
93103 "User-Agent": "hc/1.0",
94104 },
95− expectedStatus: 200,
96− expectedBody: "OK",
105+ expectedStatus: 404,
106+ expectedBody: "404 page not found\n",
107+ }),
108+ Entry("when an auth_request endpoint receives the configured health check user agent", &requestTableInput{
109+ healthCheckPaths: []string{"/ping"},
110+ healthCheckUserAgents: []string{"GoogleHC/1.0"},
111+ requestString: "http://example.com/oauth2/auth",
112+ headers: map[string]string{
113+ "User-Agent": "GoogleHC/1.0",
114+ },
115+ expectedStatus: 404,
116+ expectedBody: "404 page not found\n",
97117 }),
98118 Entry("when a blank string is configured as a health check agent and a request has no user agent", &requestTableInput{
99119 healthCheckPaths: []string{"/ping"},
@@ -107,9 +127,11 @@ var _ = Describe("HealthCheck suite", func() {
107127 healthCheckPaths: []string{"/ping", "/liveness_check", "/readiness_check"},
108128 healthCheckUserAgents: []string{"hc/1.0"},
109129 requestString: "http://example.com/readiness_check",
110− headers: map[string]string{},
111− expectedStatus: 200,
112− expectedBody: "OK",
130+ headers: map[string]string{
131+ "User-Agent": "hc/1.0",
132+ },
133+ expectedStatus: 200,
134+ expectedBody: "OK",
113135 }),
114136 Entry("with multiple paths, request none of the healthcheck paths", &requestTableInput{
115137 healthCheckPaths: []string{"/ping", "/liveness_check", "/readiness_check"},
@@ -121,15 +143,15 @@ var _ = Describe("HealthCheck suite", func() {
121143 expectedStatus: 404,
122144 expectedBody: "404 page not found\n",
123145 }),
124− Entry("with multiple user agents, request from a health check user agent", &requestTableInput{
146+ Entry("with multiple user agents, request from a health check user agent on a non-healthcheck path", &requestTableInput{
125147 healthCheckPaths: []string{"/ping"},
126148 healthCheckUserAgents: []string{"hc/1.0", "GoogleHC/1.0"},
127149 requestString: "http://example.com/abc",
128150 headers: map[string]string{
129151 "User-Agent": "GoogleHC/1.0",
130152 },
131− expectedStatus: 200,
132− expectedBody: "OK",
153+ expectedStatus: 404,
154+ expectedBody: "404 page not found\n",
133155 }),
134156 Entry("with multiple user agents, request from none of the health check user agents", &requestTableInput{
135157 healthCheckPaths: []string{"/ping"},