44d83e5 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Use StatusForbidden to prevent infinite redirects

commit44d83e5f95f7964c49ae81e93c2c71ad404b0312 authorNick Meves <nick.meves@greenhouse.io> dateTue 17 Nov 2020, 19:03 (6 years ago) parent23b2355

2 files changed+18−22

compare with master

unifiedsplit

oauthproxy.go+2−2 oauthproxy_test.go+16−20

oauthproxy.go+2−2

@@ -930,14 +930,14 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {

930930func (p *OAuthProxy) AuthOnly(rw http.ResponseWriter, req *http.Request) {

931931 session, err := p.getAuthenticatedSession(rw, req)

932932 if err != nil {

933− http.Error(rw, "unauthorized request", http.StatusUnauthorized)

933+ http.Error(rw, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)

934934 return

935935 }

936936

937937 // Allow secondary group restrictions based on the `allowed_group` or

938938 // `allowed_groups` querystring parameter

939939 if !checkAllowedGroups(req, session) {

940− http.Error(rw, "unauthorized request", http.StatusUnauthorized)

940+ http.Error(rw, http.StatusText(http.StatusForbidden), http.StatusForbidden)

941941 return

942942 }

943943

oauthproxy_test.go+16−20

@@ -1236,7 +1236,7 @@ func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {

12361236 test.proxy.ServeHTTP(test.rw, test.req)

12371237 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

12381238 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1239− assert.Equal(t, "unauthorized request\n", string(bodyBytes))

1239+ assert.Equal(t, "Unauthorized\n", string(bodyBytes))

12401240}

12411241

12421242func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {

@@ -1256,7 +1256,7 @@ func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {

12561256 test.proxy.ServeHTTP(test.rw, test.req)

12571257 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

12581258 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1259− assert.Equal(t, "unauthorized request\n", string(bodyBytes))

1259+ assert.Equal(t, "Unauthorized\n", string(bodyBytes))

12601260}

12611261

12621262func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {

@@ -1275,7 +1275,7 @@ func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {

12751275 test.proxy.ServeHTTP(test.rw, test.req)

12761276 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

12771277 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)

1278− assert.Equal(t, "unauthorized request\n", string(bodyBytes))

1278+ assert.Equal(t, "Unauthorized\n", string(bodyBytes))

12791279}

12801280

12811281func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {

@@ -2698,84 +2698,84 @@ func TestAuthOnlyAllowedGroups(t *testing.T) {

26982698 allowedGroups []string

26992699 groups []string

27002700 querystring string

2701− expectUnauthorized bool

2701+ expectedStatusCode int

27022702 }{

27032703 {

27042704 name: "NoAllowedGroups",

27052705 allowedGroups: []string{},

27062706 groups: []string{},

27072707 querystring: "",

2708− expectUnauthorized: false,

2708+ expectedStatusCode: http.StatusAccepted,

27092709 },

27102710 {

27112711 name: "NoAllowedGroupsUserHasGroups",

27122712 allowedGroups: []string{},

27132713 groups: []string{"a", "b"},

27142714 querystring: "",

2715− expectUnauthorized: false,

2715+ expectedStatusCode: http.StatusAccepted,

27162716 },

27172717 {

27182718 name: "UserInAllowedGroup",

27192719 allowedGroups: []string{"a"},

27202720 groups: []string{"a", "b"},

27212721 querystring: "",

2722− expectUnauthorized: false,

2722+ expectedStatusCode: http.StatusAccepted,

27232723 },

27242724 {

27252725 name: "UserNotInAllowedGroup",

27262726 allowedGroups: []string{"a"},

27272727 groups: []string{"c"},

27282728 querystring: "",

2729− expectUnauthorized: true,

2729+ expectedStatusCode: http.StatusUnauthorized,

27302730 },

27312731 {

27322732 name: "UserInQuerystringGroup",

27332733 allowedGroups: []string{"a", "b"},

27342734 groups: []string{"a", "c"},

27352735 querystring: "?allowed_group=a",

2736− expectUnauthorized: false,

2736+ expectedStatusCode: http.StatusAccepted,

27372737 },

27382738 {

27392739 name: "UserInOnlyQuerystringGroup",

27402740 allowedGroups: []string{},

27412741 groups: []string{"a", "c"},

27422742 querystring: "?allowed_groups=a,b",

2743− expectUnauthorized: false,

2743+ expectedStatusCode: http.StatusAccepted,

27442744 },

27452745 {

27462746 name: "UserInMultiParamQuerystringGroup",

27472747 allowedGroups: []string{"a", "b"},

27482748 groups: []string{"b"},

27492749 querystring: "?allowed_group=a&allowed_group=b",

2750− expectUnauthorized: false,

2750+ expectedStatusCode: http.StatusAccepted,

27512751 },

27522752 {

27532753 name: "UserInDelimitedQuerystringGroup",

27542754 allowedGroups: []string{"a", "b", "c"},

27552755 groups: []string{"c"},

27562756 querystring: "?allowed_groups=a,c",

2757− expectUnauthorized: false,

2757+ expectedStatusCode: http.StatusAccepted,

27582758 },

27592759 {

27602760 name: "UserNotInQuerystringGroup",

27612761 allowedGroups: []string{},

27622762 groups: []string{"c"},

27632763 querystring: "?allowed_group=a&allowed_group=b",

2764− expectUnauthorized: true,

2764+ expectedStatusCode: http.StatusForbidden,

27652765 },

27662766 {

27672767 name: "UserInConfigGroupNotInQuerystringGroup",

27682768 allowedGroups: []string{"a", "b", "c"},

27692769 groups: []string{"c"},

27702770 querystring: "?allowed_group=a&allowed_group=b",

2771− expectUnauthorized: true,

2771+ expectedStatusCode: http.StatusForbidden,

27722772 },

27732773 {

27742774 name: "UserInQuerystringGroupNotInConfigGroup",

27752775 allowedGroups: []string{"a", "b"},

27762776 groups: []string{"c"},

27772777 querystring: "?allowed_groups=b,c",

2778− expectUnauthorized: true,

2778+ expectedStatusCode: http.StatusUnauthorized,

27792779 },

27802780 }

27812781

@@ -2803,11 +2803,7 @@ func TestAuthOnlyAllowedGroups(t *testing.T) {

28032803

28042804 test.proxy.ServeHTTP(test.rw, test.req)

28052805

2806− if tc.expectUnauthorized {

2807− assert.Equal(t, http.StatusUnauthorized, test.rw.Code)

2808− } else {

2809− assert.Equal(t, http.StatusAccepted, test.rw.Code)

2810− }

2806+ assert.Equal(t, tc.expectedStatusCode, test.rw.Code)

28112807 })

28122808 }

28132809}