@@ -150,7 +150,7 @@ func (p *OauthProxy) getUserInfo(token string) (string, error) {
150150
151151func (p *OauthProxy) ClearCookie(rw http.ResponseWriter, req *http.Request) {
152152 domain := strings.Split(req.Host, ":")[0]
153− if *cookieDomain != "" {
153+ if *cookieDomain != "" && strings.HasSuffix(domain, *cookieDomain) {
154154 domain = *cookieDomain
155155 }
156156 cookie := &http.Cookie{
@@ -165,9 +165,9 @@ func (p *OauthProxy) ClearCookie(rw http.ResponseWriter, req *http.Request) {
165165}
166166
167167func (p *OauthProxy) SetCookie(rw http.ResponseWriter, req *http.Request, val string) {
168−
168+
169169 domain := strings.Split(req.Host, ":")[0] // strip the port (if any)
170− if *cookieDomain != "" {
170+ if *cookieDomain != "" && strings.HasSuffix(domain, *cookieDomain) {
171171 domain = *cookieDomain
172172 }
173173 cookie := &http.Cookie{
@@ -182,7 +182,6 @@ func (p *OauthProxy) SetCookie(rw http.ResponseWriter, req *http.Request, val st
182182 http.SetCookie(rw, cookie)
183183}
184184
185−
186185func (p *OauthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, message string) {
187186 log.Printf("ErrorPage %d %s %s", code, title, message)
188187 rw.WriteHeader(code)
@@ -202,14 +201,52 @@ func (p *OauthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code
202201 p.ClearCookie(rw, req)
203202 rw.WriteHeader(code)
204203 templates := getTemplates()
205− t := struct{ SignInMessage string }{SignInMessage: p.SignInMessage}
204+
205+ t := struct{
206+ SignInMessage string
207+ Htpasswd bool
208+ }{
209+ SignInMessage: p.SignInMessage,
210+ Htpasswd: p.HtpasswdFile != nil,
211+ }
206212 templates.ExecuteTemplate(rw, "sign_in.html", t)
207213}
208214
215+func (p *OauthProxy) ManualSignIn(rw http.ResponseWriter, req *http.Request) (string, bool){
216+ if req.Method != "POST" || p.HtpasswdFile == nil{
217+ return "", false
218+ }
219+ user := req.FormValue("username")
220+ passwd := req.FormValue("password")
221+ if user == "" {
222+ return "", false
223+ }
224+ // check auth
225+ if p.HtpasswdFile.Validate(user, passwd) {
226+ log.Printf("authenticated %s via manual sign in", user)
227+ return user, true
228+ }
229+ return "", false
230+}
231+
209232func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
210233 // check if this is a redirect back at the end of oauth
234+ remoteIP := req.Header.Get("X-Real-IP")
235+ if remoteIP == "" {
236+ remoteIP = req.RemoteAddr
237+ }
238+ log.Printf("%s %s %s", remoteIP, req.Method, req.URL.Path)
239+
240+ var ok bool
241+ var user string
211242 if req.URL.Path == signInPath {
212− p.SignInPage(rw, req, 200)
243+ user, ok = p.ManualSignIn(rw, req)
244+ if ok {
245+ p.SetCookie(rw, req, user)
246+ http.Redirect(rw, req, "/", 302)
247+ } else {
248+ p.SignInPage(rw, req, 200)
249+ }
213250 return
214251 }
215252 if req.URL.Path == oauthStartPath {
@@ -260,20 +297,22 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
260297 }
261298 }
262299
263− cookie, err := req.Cookie(p.CookieKey)
264− var ok bool
265− var email string
266− var user string
267− if err == nil {
268− email, ok = validateCookie(cookie, p.CookieSeed)
269− user = strings.Split(email, "@")[0]
300+ if !ok {
301+ cookie, err := req.Cookie(p.CookieKey)
302+ if err == nil {
303+ var email string
304+ email, ok = validateCookie(cookie, p.CookieSeed)
305+ user = strings.Split(email, "@")[0]
306+ }
270307 }
271308
272309 if !ok {
273310 user, ok = p.CheckBasicAuth(req)
274− if ok {
275− p.SetCookie(rw, req, user)
276− }
311+ // if we want to promote basic auth requests to cookie'd requests, we could do that here
312+ // not sure that would be ideal in all circumstances though
313+ // if ok {
314+ // p.SetCookie(rw, req, user)
315+ // }
277316 }
278317
279318 if !ok {
@@ -308,6 +347,7 @@ func (p *OauthProxy) CheckBasicAuth(req *http.Request) (string, bool) {
308347 return "", false
309348 }
310349 if p.HtpasswdFile.Validate(pair[0], pair[1]) {
350+ log.Printf("authenticated %s via basic auth", pair[0])
311351 return pair[0], true
312352 }
313353 return "", false