4587101 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Rename Cookie Options to remove extra 'Cookie'

commit458710149ca8a843b5be13d6d439a6fd29cc80f2 authorJoel Speed <joel.speed@hotmail.co.uk> dateSun 12 Apr 2020, 14:00 (7 years ago) parent842d764

12 files changed+175−154

compare with master

unifiedsplit

CHANGELOG.md+6−2 env_options.go+1−1 env_options_test.go+18 oauthproxy.go+13−13 oauthproxy_test.go+24−24 options.go+24−25 options_test.go+19−19 pkg/apis/options/cookie.go+9−9 pkg/cookies/cookies.go+7−7 pkg/sessions/cookie/session_store.go+7−7 pkg/sessions/redis/redis_store.go+17−17 pkg/sessions/session_store_test.go+30−30

CHANGELOG.md+6−2

@@ -11,14 +11,18 @@

1111- Migration from Pusher to independent org may have introduced breaking changes for your environment.

1212 - See the changes listed below for PR [#464](https://github.com/oauth2-proxy/oauth2-proxy/pull/464) for full details

1313 - Binaries renamed from `oauth2_proxy` to `oauth2-proxy`

14−

1514- [#440](https://github.com/oauth2-proxy/oauth2-proxy/pull/440) Switch Azure AD Graph API to Microsoft Graph API (@johejo)

16− - The Azure AD Graph API has been [deprecated](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-graph-api) and is being replaced by the Microsoft Graph API.

15+ - The Azure AD Graph API has been [deprecated](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-graph-api) and is being replaced by the Microsoft Graph API.

1716 If your application relies on the access token being passed to it to access the Azure AD Graph API, you should migrate your application to use the Microsoft Graph API.

1817 Existing behaviour can be retained by setting `-resource=https://graph.windows.net`.

18+- [#484](https://github.com/oauth2-proxy/oauth2-proxy/pull/484) Configuration loading has been replaced with Viper and PFlag

19+ - Flags now require a `--` prefix before the option

20+ - Previously flags allowed either `-` or `--` to prefix the option name

21+ - Eg `-provider` must now be `--provider`

1922

2023## Changes since v5.1.0

2124

25+- [#484](https://github.com/oauth2-proxy/oauth2-proxy/pull/484) Replace configuration loading with Viper (@JoelSpeed)

2226- [#499](https://github.com/oauth2-proxy/oauth2-proxy/pull/469) Add `-user-id-claim` to support generic claims in addition to email

2327- [#486](https://github.com/oauth2-proxy/oauth2-proxy/pull/486) Add new linters (@johejo)

2428- [#440](https://github.com/oauth2-proxy/oauth2-proxy/pull/440) Switch Azure AD Graph API to Microsoft Graph API (@johejo)

env_options.go+1−1

@@ -31,7 +31,7 @@ func (cfg EnvOptions) LoadEnvForStruct(options interface{}) {

3131 field := typ.Field(i)

3232 fieldV := reflect.Indirect(val).Field(i)

3333

34− if field.Type.Kind() == reflect.Struct && field.Anonymous {

34+ if field.Type.Kind() == reflect.Struct {

3535 cfg.LoadEnvForStruct(fieldV.Interface())

3636 continue

3737 }

env_options_test.go+18

@@ -11,12 +11,17 @@ import (

1111type EnvTest struct {

1212 TestField string `cfg:"target_field" env:"TEST_ENV_FIELD"`

1313 EnvTestEmbed

14+ Named EnvTestNamed

1415}

1516

1617type EnvTestEmbed struct {

1718 TestFieldEmbed string `cfg:"target_field_embed" env:"TEST_ENV_FIELD_EMBED"`

1819}

1920

21+type EnvTestNamed struct {

22+ TestFieldNamed string `cfg:"target_field_named" env:"TEST_ENV_FIELD_NAMED"`

23+}

24+

2025func TestLoadEnvForStruct(t *testing.T) {

2126

2227 cfg := make(proxy.EnvOptions)

@@ -44,3 +49,16 @@ func TestLoadEnvForStructWithEmbeddedFields(t *testing.T) {

4449 v := cfg["target_field_embed"]

4550 assert.Equal(t, v, "1234abcd")

4651}

52+

53+func TestLoadEnvForStructWithNamedStructFields(t *testing.T) {

54+ cfg := make(proxy.EnvOptions)

55+ cfg.LoadEnvForStruct(&EnvTest{})

56+

57+ _, ok := cfg["target_field_named"]

58+ assert.Equal(t, ok, false)

59+

60+ os.Setenv("TEST_ENV_FIELD_NAMED", "1234abcd")

61+ cfg.LoadEnvForStruct(&EnvTest{})

62+ v := cfg["target_field_named"]

63+ assert.Equal(t, v, "1234abcd")

64+}

oauthproxy.go+13−13

@@ -264,23 +264,23 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

264264

265265 logger.Printf("OAuthProxy configured for %s Client ID: %s", opts.provider.Data().ProviderName, opts.ClientID)

266266 refresh := "disabled"

267− if opts.CookieRefresh != time.Duration(0) {

268− refresh = fmt.Sprintf("after %s", opts.CookieRefresh)

267+ if opts.Cookie.Refresh != time.Duration(0) {

268+ refresh = fmt.Sprintf("after %s", opts.Cookie.Refresh)

269269 }

270270

271− logger.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domains:%s path:%s samesite:%s refresh:%s", opts.CookieName, opts.CookieSecure, opts.CookieHTTPOnly, opts.CookieExpire, strings.Join(opts.CookieDomains, ","), opts.CookiePath, opts.CookieSameSite, refresh)

271+ logger.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domains:%s path:%s samesite:%s refresh:%s", opts.Cookie.Name, opts.Cookie.Secure, opts.Cookie.HTTPOnly, opts.Cookie.Expire, strings.Join(opts.Cookie.Domains, ","), opts.Cookie.Path, opts.Cookie.SameSite, refresh)

272272

273273 return &OAuthProxy{

274− CookieName: opts.CookieName,

275− CSRFCookieName: fmt.Sprintf("%v_%v", opts.CookieName, "csrf"),

276− CookieSeed: opts.CookieSecret,

277− CookieDomains: opts.CookieDomains,

278− CookiePath: opts.CookiePath,

279− CookieSecure: opts.CookieSecure,

280− CookieHTTPOnly: opts.CookieHTTPOnly,

281− CookieExpire: opts.CookieExpire,

282− CookieRefresh: opts.CookieRefresh,

283− CookieSameSite: opts.CookieSameSite,

274+ CookieName: opts.Cookie.Name,

275+ CSRFCookieName: fmt.Sprintf("%v_%v", opts.Cookie.Name, "csrf"),

276+ CookieSeed: opts.Cookie.Secret,

277+ CookieDomains: opts.Cookie.Domains,

278+ CookiePath: opts.Cookie.Path,

279+ CookieSecure: opts.Cookie.Secure,

280+ CookieHTTPOnly: opts.Cookie.HTTPOnly,

281+ CookieExpire: opts.Cookie.Expire,

282+ CookieRefresh: opts.Cookie.Refresh,

283+ CookieSameSite: opts.Cookie.SameSite,

284284 Validator: validator,

285285

286286 RobotsPath: "/robots.txt",

oauthproxy_test.go+24−24

@@ -164,7 +164,7 @@ func TestRobotsTxt(t *testing.T) {

164164 opts := NewOptions()

165165 opts.ClientID = "asdlkjx"

166166 opts.ClientSecret = "alkgks"

167− opts.CookieSecret = "asdkugkj"

167+ opts.Cookie.Secret = "asdkugkj"

168168 opts.Validate()

169169

170170 proxy := NewOAuthProxy(opts, func(string) bool { return true })

@@ -179,7 +179,7 @@ func TestIsValidRedirect(t *testing.T) {

179179 opts := NewOptions()

180180 opts.ClientID = "skdlfj"

181181 opts.ClientSecret = "fgkdsgj"

182− opts.CookieSecret = "ljgiogbj"

182+ opts.Cookie.Secret = "ljgiogbj"

183183 // Should match domains that are exactly foo.bar and any subdomain of bar.foo

184184 opts.WhitelistDomains = []string{

185185 "foo.bar",

@@ -398,10 +398,10 @@ func TestBasicAuthPassword(t *testing.T) {

398398 opts.Upstreams = append(opts.Upstreams, providerServer.URL)

399399 // The CookieSecret must be 32 bytes in order to create the AES

400400 // cipher.

401− opts.CookieSecret = "xyzzyplughxyzzyplughxyzzyplughxp"

401+ opts.Cookie.Secret = "xyzzyplughxyzzyplughxyzzyplughxp"

402402 opts.ClientID = "dlgkj"

403403 opts.ClientSecret = "alkgret"

404− opts.CookieSecure = false

404+ opts.Cookie.Secure = false

405405 opts.PassBasicAuth = true

406406 opts.SetBasicAuth = true

407407 opts.PassUserHeaders = true

@@ -582,10 +582,10 @@ func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTes

582582 }

583583 // The CookieSecret must be 32 bytes in order to create the AES

584584 // cipher.

585− t.opts.CookieSecret = "xyzzyplughxyzzyplughxyzzyplughxp"

585+ t.opts.Cookie.Secret = "xyzzyplughxyzzyplughxyzzyplughxp"

586586 t.opts.ClientID = "slgkj"

587587 t.opts.ClientSecret = "gfjgojl"

588− t.opts.CookieSecure = false

588+ t.opts.Cookie.Secure = false

589589 t.opts.PassAccessToken = opts.PassAccessToken

590590 t.opts.Validate()

591591

@@ -735,7 +735,7 @@ func NewSignInPageTest(skipProvider bool) *SignInPageTest {

735735 var sipTest SignInPageTest

736736

737737 sipTest.opts = NewOptions()

738− sipTest.opts.CookieSecret = "adklsj2"

738+ sipTest.opts.Cookie.Secret = "adklsj2"

739739 sipTest.opts.ClientID = "lkdgj"

740740 sipTest.opts.ClientSecret = "sgiufgoi"

741741 sipTest.opts.SkipProviderButton = skipProvider

@@ -841,10 +841,10 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifi

841841 }

842842 pcTest.opts.ClientID = "asdfljk"

843843 pcTest.opts.ClientSecret = "lkjfdsig"

844− pcTest.opts.CookieSecret = "0123456789abcdefabcd"

844+ pcTest.opts.Cookie.Secret = "0123456789abcdefabcd"

845845 // First, set the CookieRefresh option so proxy.AesCipher is created,

846846 // needed to encrypt the access_token.

847− pcTest.opts.CookieRefresh = time.Hour

847+ pcTest.opts.Cookie.Refresh = time.Hour

848848 pcTest.opts.Validate()

849849

850850 pcTest.proxy = NewOAuthProxy(pcTest.opts, func(email string) bool {

@@ -915,7 +915,7 @@ func TestProcessCookieNoCookieError(t *testing.T) {

915915

916916func TestProcessCookieRefreshNotSet(t *testing.T) {

917917 pcTest := NewProcessCookieTestWithOptionsModifiers(func(opts *Options) {

918− opts.CookieExpire = time.Duration(23) * time.Hour

918+ opts.Cookie.Expire = time.Duration(23) * time.Hour

919919 })

920920 reference := time.Now().Add(time.Duration(-2) * time.Hour)

921921

@@ -932,7 +932,7 @@ func TestProcessCookieRefreshNotSet(t *testing.T) {

932932

933933func TestProcessCookieFailIfCookieExpired(t *testing.T) {

934934 pcTest := NewProcessCookieTestWithOptionsModifiers(func(opts *Options) {

935− opts.CookieExpire = time.Duration(24) * time.Hour

935+ opts.Cookie.Expire = time.Duration(24) * time.Hour

936936 })

937937 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)

938938 startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: reference}

@@ -947,7 +947,7 @@ func TestProcessCookieFailIfCookieExpired(t *testing.T) {

947947

948948func TestProcessCookieFailIfRefreshSetAndCookieExpired(t *testing.T) {

949949 pcTest := NewProcessCookieTestWithOptionsModifiers(func(opts *Options) {

950− opts.CookieExpire = time.Duration(24) * time.Hour

950+ opts.Cookie.Expire = time.Duration(24) * time.Hour

951951 })

952952 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)

953953 startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: reference}

@@ -1017,7 +1017,7 @@ func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {

10171017

10181018func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {

10191019 test := NewAuthOnlyEndpointTest(func(opts *Options) {

1020− opts.CookieExpire = time.Duration(24) * time.Hour

1020+ opts.Cookie.Expire = time.Duration(24) * time.Hour

10211021 })

10221022 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)

10231023 startSession := &sessions.SessionState{

@@ -1149,7 +1149,7 @@ func TestAuthSkippedForPreflightRequests(t *testing.T) {

11491149 opts.Upstreams = append(opts.Upstreams, upstream.URL)

11501150 opts.ClientID = "aljsal"

11511151 opts.ClientSecret = "jglkfsdgj"

1152− opts.CookieSecret = "dkfjgdls"

1152+ opts.Cookie.Secret = "dkfjgdls"

11531153 opts.SkipAuthPreflight = true

11541154 opts.Validate()

11551155

@@ -1196,7 +1196,7 @@ type SignatureTest struct {

11961196

11971197func NewSignatureTest() *SignatureTest {

11981198 opts := NewOptions()

1199− opts.CookieSecret = "cookie secret"

1199+ opts.Cookie.Secret = "cookie secret"

12001200 opts.ClientID = "client ID"

12011201 opts.ClientSecret = "client secret"

12021202 opts.EmailDomains = []string{"acm.org"}

@@ -1343,7 +1343,7 @@ type ajaxRequestTest struct {

13431343func newAjaxRequestTest() *ajaxRequestTest {

13441344 test := &ajaxRequestTest{}

13451345 test.opts = NewOptions()

1346− test.opts.CookieSecret = "sdflsw"

1346+ test.opts.Cookie.Secret = "sdflsw"

13471347 test.opts.ClientID = "gkljfdl"

13481348 test.opts.ClientSecret = "sdflkjs"

13491349 test.opts.Validate()

@@ -1401,11 +1401,11 @@ func TestAjaxForbiddendRequest(t *testing.T) {

14011401

14021402func TestClearSplitCookie(t *testing.T) {

14031403 opts := NewOptions()

1404− opts.CookieName = "oauth2"

1405− opts.CookieDomains = []string{"abc"}

1406− store, err := cookie.NewCookieSessionStore(&opts.SessionOptions, &opts.CookieOptions)

1404+ opts.Cookie.Name = "oauth2"

1405+ opts.Cookie.Domains = []string{"abc"}

1406+ store, err := cookie.NewCookieSessionStore(&opts.SessionOptions, &opts.Cookie)

14071407 assert.Equal(t, err, nil)

1408− p := OAuthProxy{CookieName: opts.CookieName, CookieDomains: opts.CookieDomains, sessionStore: store}

1408+ p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}

14091409 var rw = httptest.NewRecorder()

14101410 req := httptest.NewRequest("get", "/", nil)

14111411

@@ -1430,11 +1430,11 @@ func TestClearSplitCookie(t *testing.T) {

14301430

14311431func TestClearSingleCookie(t *testing.T) {

14321432 opts := NewOptions()

1433− opts.CookieName = "oauth2"

1434− opts.CookieDomains = []string{"abc"}

1435− store, err := cookie.NewCookieSessionStore(&opts.SessionOptions, &opts.CookieOptions)

1433+ opts.Cookie.Name = "oauth2"

1434+ opts.Cookie.Domains = []string{"abc"}

1435+ store, err := cookie.NewCookieSessionStore(&opts.SessionOptions, &opts.Cookie)

14361436 assert.Equal(t, err, nil)

1437− p := OAuthProxy{CookieName: opts.CookieName, CookieDomains: opts.CookieDomains, sessionStore: store}

1437+ p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}

14381438 var rw = httptest.NewRecorder()

14391439 req := httptest.NewRequest("get", "/", nil)

14401440

options.go+24−25

@@ -64,8 +64,7 @@ type Options struct {

6464 Banner string `flag:"banner" cfg:"banner" env:"OAUTH2_PROXY_BANNER"`

6565 Footer string `flag:"footer" cfg:"footer" env:"OAUTH2_PROXY_FOOTER"`

6666

67− // Embed CookieOptions

68− options.CookieOptions

67+ Cookie options.CookieOptions

6968

7069 // Embed SessionOptions

7170 options.SessionOptions

@@ -158,12 +157,12 @@ func NewOptions() *Options {

158157 HTTPSAddress: ":443",

159158 ForceHTTPS: false,

160159 DisplayHtpasswdForm: true,

161− CookieOptions: options.CookieOptions{

162− CookieName: "_oauth2_proxy",

163− CookieSecure: true,

164− CookieHTTPOnly: true,

165− CookieExpire: time.Duration(168) * time.Hour,

166− CookieRefresh: time.Duration(0),

160+ Cookie: options.CookieOptions{

161+ Name: "_oauth2_proxy",

162+ Secure: true,

163+ HTTPOnly: true,

164+ Expire: time.Duration(168) * time.Hour,

165+ Refresh: time.Duration(0),

167166 },

168167 SessionOptions: options.SessionOptions{

169168 Type: "cookie",

@@ -227,7 +226,7 @@ func (o *Options) Validate() error {

227226 }

228227

229228 msgs := make([]string, 0)

230− if o.CookieSecret == "" {

229+ if o.Cookie.Secret == "" {

231230 msgs = append(msgs, "missing setting: cookie-secret")

232231 }

233232 if o.ClientID == "" {

@@ -382,31 +381,31 @@ func (o *Options) Validate() error {

382381 msgs = parseProviderInfo(o, msgs)

383382

384383 var cipher *encryption.Cipher

385− if o.PassAccessToken || o.SetAuthorization || o.PassAuthorization || (o.CookieRefresh != time.Duration(0)) {

384+ if o.PassAccessToken || o.SetAuthorization || o.PassAuthorization || (o.Cookie.Refresh != time.Duration(0)) {

386385 validCookieSecretSize := false

387386 for _, i := range []int{16, 24, 32} {

388− if len(secretBytes(o.CookieSecret)) == i {

387+ if len(secretBytes(o.Cookie.Secret)) == i {

389388 validCookieSecretSize = true

390389 }

391390 }

392391 var decoded bool

393− if string(secretBytes(o.CookieSecret)) != o.CookieSecret {

392+ if string(secretBytes(o.Cookie.Secret)) != o.Cookie.Secret {

394393 decoded = true

395394 }

396395 if !validCookieSecretSize {

397396 var suffix string

398397 if decoded {

399− suffix = fmt.Sprintf(" note: cookie secret was base64 decoded from %q", o.CookieSecret)

398+ suffix = fmt.Sprintf(" note: cookie secret was base64 decoded from %q", o.Cookie.Secret)

400399 }

401400 msgs = append(msgs, fmt.Sprintf(

402401 "cookie_secret must be 16, 24, or 32 bytes "+

403402 "to create an AES cipher when "+

404403 "pass_access_token == true or "+

405404 "cookie_refresh != 0, but is %d bytes.%s",

406− len(secretBytes(o.CookieSecret)), suffix))

405+ len(secretBytes(o.Cookie.Secret)), suffix))

407406 } else {

408407 var err error

409− cipher, err = encryption.NewCipher(secretBytes(o.CookieSecret))

408+ cipher, err = encryption.NewCipher(secretBytes(o.Cookie.Secret))

410409 if err != nil {

411410 msgs = append(msgs, fmt.Sprintf("cookie-secret error: %v", err))

412411 }

@@ -414,19 +413,19 @@ func (o *Options) Validate() error {

414413 }

415414

416415 o.SessionOptions.Cipher = cipher

417− sessionStore, err := sessions.NewSessionStore(&o.SessionOptions, &o.CookieOptions)

416+ sessionStore, err := sessions.NewSessionStore(&o.SessionOptions, &o.Cookie)

418417 if err != nil {

419418 msgs = append(msgs, fmt.Sprintf("error initialising session storage: %v", err))

420419 } else {

421420 o.sessionStore = sessionStore

422421 }

423422

424− if o.CookieRefresh >= o.CookieExpire {

423+ if o.Cookie.Refresh >= o.Cookie.Expire {

425424 msgs = append(msgs, fmt.Sprintf(

426425 "cookie_refresh (%s) must be less than "+

427426 "cookie_expire (%s)",

428− o.CookieRefresh.String(),

429− o.CookieExpire.String()))

427+ o.Cookie.Refresh.String(),

428+ o.Cookie.Expire.String()))

430429 }

431430

432431 if len(o.GoogleGroups) > 0 || o.GoogleAdminEmail != "" || o.GoogleServiceAccountJSON != "" {

@@ -441,16 +440,16 @@ func (o *Options) Validate() error {

441440 }

442441 }

443442

444− switch o.CookieSameSite {

443+ switch o.Cookie.SameSite {

445444 case "", "none", "lax", "strict":

446445 default:

447− msgs = append(msgs, fmt.Sprintf("cookie_samesite (%s) must be one of ['', 'lax', 'strict', 'none']", o.CookieSameSite))

446+ msgs = append(msgs, fmt.Sprintf("cookie_samesite (%s) must be one of ['', 'lax', 'strict', 'none']", o.Cookie.SameSite))

448447 }

449448

450449 // Sort cookie domains by length, so that we try longer (and more specific)

451450 // domains first

452− sort.Slice(o.CookieDomains, func(i, j int) bool {

453− return len(o.CookieDomains[i]) > len(o.CookieDomains[j])

451+ sort.Slice(o.Cookie.Domains, func(i, j int) bool {

452+ return len(o.Cookie.Domains[i]) > len(o.Cookie.Domains[j])

454453 })

455454

456455 msgs = parseSignatureKey(o, msgs)

@@ -627,9 +626,9 @@ func newVerifierFromJwtIssuer(jwtIssuer jwtIssuer) (*oidc.IDTokenVerifier, error

627626}

628627

629628func validateCookieName(o *Options, msgs []string) []string {

630− cookie := &http.Cookie{Name: o.CookieName}

629+ cookie := &http.Cookie{Name: o.Cookie.Name}

631630 if cookie.String() == "" {

632− return append(msgs, fmt.Sprintf("invalid cookie name: %q", o.CookieName))

631+ return append(msgs, fmt.Sprintf("invalid cookie name: %q", o.Cookie.Name))

633632 }

634633 return msgs

635634}

options_test.go+19−19

@@ -22,7 +22,7 @@ const (

2222func testOptions() *Options {

2323 o := NewOptions()

2424 o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8080/")

25− o.CookieSecret = cookieSecret

25+ o.Cookie.Secret = cookieSecret

2626 o.ClientID = clientID

2727 o.ClientSecret = clientSecret

2828 o.EmailDomains = []string{"*"}

@@ -51,7 +51,7 @@ func TestNewOptions(t *testing.T) {

5151

5252func TestClientSecretFileOptionFails(t *testing.T) {

5353 o := NewOptions()

54− o.CookieSecret = cookieSecret

54+ o.Cookie.Secret = cookieSecret

5555 o.ClientID = clientID

5656 o.ClientSecretFile = clientSecret

5757 o.EmailDomains = []string{"*"}

@@ -81,7 +81,7 @@ func TestClientSecretFileOption(t *testing.T) {

8181 defer os.Remove(clientSecretFileName)

8282

8383 o := NewOptions()

84− o.CookieSecret = cookieSecret

84+ o.Cookie.Secret = cookieSecret

8585 o.ClientID = clientID

8686 o.ClientSecretFile = clientSecretFileName

8787 o.EmailDomains = []string{"*"}

@@ -212,20 +212,20 @@ func TestPassAccessTokenRequiresSpecificCookieSecretLengths(t *testing.T) {

212212

213213 assert.Equal(t, false, o.PassAccessToken)

214214 o.PassAccessToken = true

215− o.CookieSecret = "cookie of invalid length-"

215+ o.Cookie.Secret = "cookie of invalid length-"

216216 assert.NotEqual(t, nil, o.Validate())

217217

218218 o.PassAccessToken = false

219− o.CookieRefresh = time.Duration(24) * time.Hour

219+ o.Cookie.Refresh = time.Duration(24) * time.Hour

220220 assert.NotEqual(t, nil, o.Validate())

221221

222− o.CookieSecret = "16 bytes AES-128"

222+ o.Cookie.Secret = "16 bytes AES-128"

223223 assert.Equal(t, nil, o.Validate())

224224

225− o.CookieSecret = "24 byte secret AES-192--"

225+ o.Cookie.Secret = "24 byte secret AES-192--"

226226 assert.Equal(t, nil, o.Validate())

227227

228− o.CookieSecret = "32 byte secret for AES-256------"

228+ o.Cookie.Secret = "32 byte secret for AES-256------"

229229 assert.Equal(t, nil, o.Validate())

230230}

231231

@@ -233,11 +233,11 @@ func TestCookieRefreshMustBeLessThanCookieExpire(t *testing.T) {

233233 o := testOptions()

234234 assert.Equal(t, nil, o.Validate())

235235

236− o.CookieSecret = "0123456789abcdefabcd"

237− o.CookieRefresh = o.CookieExpire

236+ o.Cookie.Secret = "0123456789abcdefabcd"

237+ o.Cookie.Refresh = o.Cookie.Expire

238238 assert.NotEqual(t, nil, o.Validate())

239239

240− o.CookieRefresh -= time.Duration(1)

240+ o.Cookie.Refresh -= time.Duration(1)

241241 assert.Equal(t, nil, o.Validate())

242242}

243243

@@ -246,23 +246,23 @@ func TestBase64CookieSecret(t *testing.T) {

246246 assert.Equal(t, nil, o.Validate())

247247

248248 // 32 byte, base64 (urlsafe) encoded key

249− o.CookieSecret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ="

249+ o.Cookie.Secret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ="

250250 assert.Equal(t, nil, o.Validate())

251251

252252 // 32 byte, base64 (urlsafe) encoded key, w/o padding

253− o.CookieSecret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ"

253+ o.Cookie.Secret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ"

254254 assert.Equal(t, nil, o.Validate())

255255

256256 // 24 byte, base64 (urlsafe) encoded key

257− o.CookieSecret = "Kp33Gj-GQmYtz4zZUyUDdqQKx5_Hgkv3"

257+ o.Cookie.Secret = "Kp33Gj-GQmYtz4zZUyUDdqQKx5_Hgkv3"

258258 assert.Equal(t, nil, o.Validate())

259259

260260 // 16 byte, base64 (urlsafe) encoded key

261− o.CookieSecret = "LFEqZYvYUwKwzn0tEuTpLA=="

261+ o.Cookie.Secret = "LFEqZYvYUwKwzn0tEuTpLA=="

262262 assert.Equal(t, nil, o.Validate())

263263

264264 // 16 byte, base64 (urlsafe) encoded key, w/o padding

265− o.CookieSecret = "LFEqZYvYUwKwzn0tEuTpLA"

265+ o.Cookie.Secret = "LFEqZYvYUwKwzn0tEuTpLA"

266266 assert.Equal(t, nil, o.Validate())

267267}

268268

@@ -292,16 +292,16 @@ func TestValidateSignatureKeyUnsupportedAlgorithm(t *testing.T) {

292292

293293func TestValidateCookie(t *testing.T) {

294294 o := testOptions()

295− o.CookieName = "_valid_cookie_name"

295+ o.Cookie.Name = "_valid_cookie_name"

296296 assert.Equal(t, nil, o.Validate())

297297}

298298

299299func TestValidateCookieBadName(t *testing.T) {

300300 o := testOptions()

301− o.CookieName = "_bad_cookie_name{}"

301+ o.Cookie.Name = "_bad_cookie_name{}"

302302 err := o.Validate()

303303 assert.Equal(t, err.Error(), "invalid configuration:\n"+

304− fmt.Sprintf(" invalid cookie name: %q", o.CookieName))

304+ fmt.Sprintf(" invalid cookie name: %q", o.Cookie.Name))

305305}

306306

307307func TestSkipOIDCDiscovery(t *testing.T) {

pkg/apis/options/cookie.go+9−9

@@ -4,13 +4,13 @@ import "time"

55// CookieOptions contains configuration options relating to Cookie configuration

66type CookieOptions struct {

7− CookieName string `flag:"cookie-name" cfg:"cookie_name" env:"OAUTH2_PROXY_COOKIE_NAME"`

8− CookieSecret string `flag:"cookie-secret" cfg:"cookie_secret" env:"OAUTH2_PROXY_COOKIE_SECRET"`

9− CookieDomains []string `flag:"cookie-domain" cfg:"cookie_domain" env:"OAUTH2_PROXY_COOKIE_DOMAIN"`

10− CookiePath string `flag:"cookie-path" cfg:"cookie_path" env:"OAUTH2_PROXY_COOKIE_PATH"`

11− CookieExpire time.Duration `flag:"cookie-expire" cfg:"cookie_expire" env:"OAUTH2_PROXY_COOKIE_EXPIRE"`

12− CookieRefresh time.Duration `flag:"cookie-refresh" cfg:"cookie_refresh" env:"OAUTH2_PROXY_COOKIE_REFRESH"`

13− CookieSecure bool `flag:"cookie-secure" cfg:"cookie_secure" env:"OAUTH2_PROXY_COOKIE_SECURE"`

14− CookieHTTPOnly bool `flag:"cookie-httponly" cfg:"cookie_httponly" env:"OAUTH2_PROXY_COOKIE_HTTPONLY"`

15− CookieSameSite string `flag:"cookie-samesite" cfg:"cookie_samesite" env:"OAUTH2_PROXY_COOKIE_SAMESITE"`

7+ Name string `flag:"cookie-name" cfg:"cookie_name" env:"OAUTH2_PROXY_COOKIE_NAME"`

8+ Secret string `flag:"cookie-secret" cfg:"cookie_secret" env:"OAUTH2_PROXY_COOKIE_SECRET"`

9+ Domains []string `flag:"cookie-domain" cfg:"cookie_domain" env:"OAUTH2_PROXY_COOKIE_DOMAIN"`

10+ Path string `flag:"cookie-path" cfg:"cookie_path" env:"OAUTH2_PROXY_COOKIE_PATH"`

11+ Expire time.Duration `flag:"cookie-expire" cfg:"cookie_expire" env:"OAUTH2_PROXY_COOKIE_EXPIRE"`

12+ Refresh time.Duration `flag:"cookie-refresh" cfg:"cookie_refresh" env:"OAUTH2_PROXY_COOKIE_REFRESH"`

13+ Secure bool `flag:"cookie-secure" cfg:"cookie_secure" env:"OAUTH2_PROXY_COOKIE_SECURE"`

14+ HTTPOnly bool `flag:"cookie-httponly" cfg:"cookie_httponly" env:"OAUTH2_PROXY_COOKIE_HTTPONLY"`

15+ SameSite string `flag:"cookie-samesite" cfg:"cookie_samesite" env:"OAUTH2_PROXY_COOKIE_SAMESITE"`

1616}

pkg/cookies/cookies.go+7−7

@@ -38,19 +38,19 @@ func MakeCookie(req *http.Request, name string, value string, path string, domai

3838

3939// MakeCookieFromOptions constructs a cookie based on the given *options.CookieOptions,

4040// value and creation time

41−func MakeCookieFromOptions(req *http.Request, name string, value string, opts *options.CookieOptions, expiration time.Duration, now time.Time) *http.Cookie {

42− domain := GetCookieDomain(req, opts.CookieDomains)

41+func MakeCookieFromOptions(req *http.Request, name string, value string, cookieOpts *options.CookieOptions, expiration time.Duration, now time.Time) *http.Cookie {

42+ domain := GetCookieDomain(req, cookieOpts.Domains)

4343

4444 if domain != "" {

45− return MakeCookie(req, name, value, opts.CookiePath, domain, opts.CookieHTTPOnly, opts.CookieSecure, expiration, now, ParseSameSite(opts.CookieSameSite))

45+ return MakeCookie(req, name, value, cookieOpts.Path, domain, cookieOpts.HTTPOnly, cookieOpts.Secure, expiration, now, ParseSameSite(cookieOpts.SameSite))

4646 }

4747 // If nothing matches, create the cookie with the shortest domain

48− logger.Printf("Warning: request host %q did not match any of the specific cookie domains of %q", GetRequestHost(req), strings.Join(opts.CookieDomains, ","))

48+ logger.Printf("Warning: request host %q did not match any of the specific cookie domains of %q", GetRequestHost(req), strings.Join(cookieOpts.Domains, ","))

4949 defaultDomain := ""

50− if len(opts.CookieDomains) > 0 {

51− defaultDomain = opts.CookieDomains[len(opts.CookieDomains)-1]

50+ if len(cookieOpts.Domains) > 0 {

51+ defaultDomain = cookieOpts.Domains[len(cookieOpts.Domains)-1]

5252 }

53− return MakeCookie(req, name, value, opts.CookiePath, defaultDomain, opts.CookieHTTPOnly, opts.CookieSecure, expiration, now, ParseSameSite(opts.CookieSameSite))

53+ return MakeCookie(req, name, value, cookieOpts.Path, defaultDomain, cookieOpts.HTTPOnly, cookieOpts.Secure, expiration, now, ParseSameSite(cookieOpts.SameSite))

5454}

5555

5656// GetCookieDomain returns the correct cookie domain given a list of domains

pkg/sessions/cookie/session_store.go+7−7

@@ -49,12 +49,12 @@ func (s *SessionStore) Save(rw http.ResponseWriter, req *http.Request, ss *sessi

4949// Load reads sessions.SessionState information from Cookies within the

5050// HTTP request object

5151func (s *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {

52− c, err := loadCookie(req, s.CookieOptions.CookieName)

52+ c, err := loadCookie(req, s.CookieOptions.Name)

5353 if err != nil {

5454 // always http.ErrNoCookie

55− return nil, fmt.Errorf("cookie %q not present", s.CookieOptions.CookieName)

55+ return nil, fmt.Errorf("cookie %q not present", s.CookieOptions.Name)

5656 }

57− val, _, ok := encryption.Validate(c, s.CookieOptions.CookieSecret, s.CookieOptions.CookieExpire)

57+ val, _, ok := encryption.Validate(c, s.CookieOptions.Secret, s.CookieOptions.Expire)

5858 if !ok {

5959 return nil, errors.New("cookie signature not valid")

6060 }

@@ -70,7 +70,7 @@ func (s *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {

7070// clear the session

7171func (s *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) error {

7272 // matches CookieName, CookieName_<number>

73− var cookieNameRegex = regexp.MustCompile(fmt.Sprintf("^%s(_\\d+)?$", s.CookieOptions.CookieName))

73+ var cookieNameRegex = regexp.MustCompile(fmt.Sprintf("^%s(_\\d+)?$", s.CookieOptions.Name))

7474

7575 for _, c := range req.Cookies() {

7676 if cookieNameRegex.MatchString(c.Name) {

@@ -94,10 +94,10 @@ func (s *SessionStore) setSessionCookie(rw http.ResponseWriter, req *http.Reques

9494// authentication details

9595func (s *SessionStore) makeSessionCookie(req *http.Request, value string, now time.Time) []*http.Cookie {

9696 if value != "" {

97− value = encryption.SignedValue(s.CookieOptions.CookieSecret, s.CookieOptions.CookieName, value, now)

97+ value = encryption.SignedValue(s.CookieOptions.Secret, s.CookieOptions.Name, value, now)

9898 }

99− c := s.makeCookie(req, s.CookieOptions.CookieName, value, s.CookieOptions.CookieExpire, now)

100− if len(c.Value) > 4096-len(s.CookieOptions.CookieName) {

99+ c := s.makeCookie(req, s.CookieOptions.Name, value, s.CookieOptions.Expire, now)

100+ if len(c.Value) > 4096-len(s.CookieOptions.Name) {

101101 return splitCookie(c)

102102 }

103103 return []*http.Cookie{c}

pkg/sessions/redis/redis_store.go+17−17

@@ -117,13 +117,13 @@ func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *se

117117

118118 // Old sessions that we are refreshing would have a request cookie

119119 // New sessions don't, so we ignore the error. storeValue will check requestCookie

120− requestCookie, _ := req.Cookie(store.CookieOptions.CookieName)

120+ requestCookie, _ := req.Cookie(store.CookieOptions.Name)

121121 value, err := s.EncodeSessionState(store.CookieCipher)

122122 if err != nil {

123123 return err

124124 }

125125 ctx := req.Context()

126− ticketString, err := store.storeValue(ctx, value, store.CookieOptions.CookieExpire, requestCookie)

126+ ticketString, err := store.storeValue(ctx, value, store.CookieOptions.Expire, requestCookie)

127127 if err != nil {

128128 return err

129129 }

@@ -131,7 +131,7 @@ func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *se

131131 ticketCookie := store.makeCookie(

132132 req,

133133 ticketString,

134− store.CookieOptions.CookieExpire,

134+ store.CookieOptions.Expire,

135135 s.CreatedAt,

136136 )

137137

@@ -142,12 +142,12 @@ func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *se

142142// Load reads sessions.SessionState information from a ticket

143143// cookie within the HTTP request object

144144func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {

145− requestCookie, err := req.Cookie(store.CookieOptions.CookieName)

145+ requestCookie, err := req.Cookie(store.CookieOptions.Name)

146146 if err != nil {

147147 return nil, fmt.Errorf("error loading session: %s", err)

148148 }

149149

150− val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

150+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.Secret, store.CookieOptions.Expire)

151151 if !ok {

152152 return nil, fmt.Errorf("cookie signature not valid")

153153 }

@@ -161,12 +161,12 @@ func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, erro

161161

162162// loadSessionFromString loads the session based on the ticket value

163163func (store *SessionStore) loadSessionFromString(ctx context.Context, value string) (*sessions.SessionState, error) {

164− ticket, err := decodeTicket(store.CookieOptions.CookieName, value)

164+ ticket, err := decodeTicket(store.CookieOptions.Name, value)

165165 if err != nil {

166166 return nil, err

167167 }

168168

169− resultBytes, err := store.Client.Get(ctx, ticket.asHandle(store.CookieOptions.CookieName))

169+ resultBytes, err := store.Client.Get(ctx, ticket.asHandle(store.CookieOptions.Name))

170170 if err != nil {

171171 return nil, err

172172 }

@@ -199,7 +199,7 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro

199199 http.SetCookie(rw, clearCookie)

200200

201201 // If there was an existing cookie we should clear the session in redis

202− requestCookie, err := req.Cookie(store.CookieOptions.CookieName)

202+ requestCookie, err := req.Cookie(store.CookieOptions.Name)

203203 if err != nil && err == http.ErrNoCookie {

204204 // No existing cookie so can't clear redis

205205 return nil

@@ -207,17 +207,17 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro

207207 return fmt.Errorf("error retrieving cookie: %v", err)

208208 }

209209

210− val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

210+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.Secret, store.CookieOptions.Expire)

211211 if !ok {

212212 return fmt.Errorf("cookie signature not valid")

213213 }

214214

215215 // We only return an error if we had an issue with redis

216216 // If there's an issue decoding the ticket, ignore it

217− ticket, _ := decodeTicket(store.CookieOptions.CookieName, val)

217+ ticket, _ := decodeTicket(store.CookieOptions.Name, val)

218218 if ticket != nil {

219219 ctx := req.Context()

220− err := store.Client.Del(ctx, ticket.asHandle(store.CookieOptions.CookieName))

220+ err := store.Client.Del(ctx, ticket.asHandle(store.CookieOptions.Name))

221221 if err != nil {

222222 return fmt.Errorf("error clearing cookie from redis: %s", err)

223223 }

@@ -228,11 +228,11 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro

228228// makeCookie makes a cookie, signing the value if present

229229func (store *SessionStore) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) *http.Cookie {

230230 if value != "" {

231− value = encryption.SignedValue(store.CookieOptions.CookieSecret, store.CookieOptions.CookieName, value, now)

231+ value = encryption.SignedValue(store.CookieOptions.Secret, store.CookieOptions.Name, value, now)

232232 }

233233 return cookies.MakeCookieFromOptions(

234234 req,

235− store.CookieOptions.CookieName,

235+ store.CookieOptions.Name,

236236 value,

237237 store.CookieOptions,

238238 expires,

@@ -256,12 +256,12 @@ func (store *SessionStore) storeValue(ctx context.Context, value string, expirat

256256 stream := cipher.NewCFBEncrypter(block, ticket.Secret)

257257 stream.XORKeyStream(ciphertext, []byte(value))

258258

259− handle := ticket.asHandle(store.CookieOptions.CookieName)

259+ handle := ticket.asHandle(store.CookieOptions.Name)

260260 err = store.Client.Set(ctx, handle, ciphertext, expiration)

261261 if err != nil {

262262 return "", err

263263 }

264− return ticket.encodeTicket(store.CookieOptions.CookieName), nil

264+ return ticket.encodeTicket(store.CookieOptions.Name), nil

265265}

266266

267267// getTicket retrieves an existing ticket from the cookie if present,

@@ -272,14 +272,14 @@ func (store *SessionStore) getTicket(requestCookie *http.Cookie) (*TicketData, e

272272 }

273273

274274 // An existing cookie exists, try to retrieve the ticket

275− val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)

275+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.Secret, store.CookieOptions.Expire)

276276 if !ok {

277277 // Cookie is invalid, create a new ticket

278278 return newTicket()

279279 }

280280

281281 // Valid cookie, decode the ticket

282− ticket, err := decodeTicket(store.CookieOptions.CookieName, val)

282+ ticket, err := decodeTicket(store.CookieOptions.Name, val)

283283 if err != nil {

284284 // If we can't decode the ticket we have to create a new one

285285 return newTicket()

pkg/sessions/session_store_test.go+30−30

@@ -47,25 +47,25 @@ var _ = Describe("NewSessionStore", func() {

4747

4848 It("have the correct name set", func() {

4949 if len(cookies) == 1 {

50− Expect(cookies[0].Name).To(Equal(cookieOpts.CookieName))

50+ Expect(cookies[0].Name).To(Equal(cookieOpts.Name))

5151 } else {

5252 for _, cookie := range cookies {

53− Expect(cookie.Name).To(ContainSubstring(cookieOpts.CookieName))

53+ Expect(cookie.Name).To(ContainSubstring(cookieOpts.Name))

5454 }

5555 }

5656 })

5757

5858 It("have the correct path set", func() {

5959 for _, cookie := range cookies {

60− Expect(cookie.Path).To(Equal(cookieOpts.CookiePath))

60+ Expect(cookie.Path).To(Equal(cookieOpts.Path))

6161 }

6262 })

6363

6464 It("have the correct domain set", func() {

6565 for _, cookie := range cookies {

6666 specifiedDomain := ""

67− if len(cookieOpts.CookieDomains) > 0 {

68− specifiedDomain = cookieOpts.CookieDomains[0]

67+ if len(cookieOpts.Domains) > 0 {

68+ specifiedDomain = cookieOpts.Domains[0]

6969 }

7070 Expect(cookie.Domain).To(Equal(specifiedDomain))

7171 }

@@ -73,19 +73,19 @@ var _ = Describe("NewSessionStore", func() {

7373

7474 It("have the correct HTTPOnly set", func() {

7575 for _, cookie := range cookies {

76− Expect(cookie.HttpOnly).To(Equal(cookieOpts.CookieHTTPOnly))

76+ Expect(cookie.HttpOnly).To(Equal(cookieOpts.HTTPOnly))

7777 }

7878 })

7979

8080 It("have the correct secure set", func() {

8181 for _, cookie := range cookies {

82− Expect(cookie.Secure).To(Equal(cookieOpts.CookieSecure))

82+ Expect(cookie.Secure).To(Equal(cookieOpts.Secure))

8383 }

8484 })

8585

8686 It("have the correct SameSite set", func() {

8787 for _, cookie := range cookies {

88− Expect(cookie.SameSite).To(Equal(cookiesapi.ParseSameSite(cookieOpts.CookieSameSite)))

88+ Expect(cookie.SameSite).To(Equal(cookiesapi.ParseSameSite(cookieOpts.SameSite)))

8989 }

9090 })

9191

@@ -168,8 +168,8 @@ var _ = Describe("NewSessionStore", func() {

168168 BeforeEach(func() {

169169 By("Using a valid cookie with a different providers session encoding")

170170 broken := "BrokenSessionFromADifferentSessionImplementation"

171− value := encryption.SignedValue(cookieOpts.CookieSecret, cookieOpts.CookieName, broken, time.Now())

172− cookie := cookiesapi.MakeCookieFromOptions(request, cookieOpts.CookieName, value, cookieOpts, cookieOpts.CookieExpire, time.Now())

171+ value := encryption.SignedValue(cookieOpts.Secret, cookieOpts.Name, broken, time.Now())

172+ cookie := cookiesapi.MakeCookieFromOptions(request, cookieOpts.Name, value, cookieOpts, cookieOpts.Expire, time.Now())

173173 request.AddCookie(cookie)

174174

175175 err := ss.Save(response, request, session)

@@ -245,7 +245,7 @@ var _ = Describe("NewSessionStore", func() {

245245 })

246246

247247 It("loads a session equal to the original session", func() {

248− if cookieOpts.CookieSecret == "" {

248+ if cookieOpts.Secret == "" {

249249 // Only Email and User stored in session when encrypted

250250 Expect(loadedSession.Email).To(Equal(session.Email))

251251 Expect(loadedSession.User).To(Equal(session.User))

@@ -290,7 +290,7 @@ var _ = Describe("NewSessionStore", func() {

290290 BeforeEach(func() {

291291 switch ss.(type) {

292292 case *redis.SessionStore:

293− mr.FastForward(cookieOpts.CookieRefresh + time.Minute)

293+ mr.FastForward(cookieOpts.Refresh + time.Minute)

294294 }

295295 })

296296

@@ -304,7 +304,7 @@ var _ = Describe("NewSessionStore", func() {

304304 BeforeEach(func() {

305305 switch ss.(type) {

306306 case *redis.SessionStore:

307− mr.FastForward(cookieOpts.CookieExpire + time.Minute)

307+ mr.FastForward(cookieOpts.Expire + time.Minute)

308308 }

309309

310310 loadedSession, err = ss.Load(request)

@@ -341,14 +341,14 @@ var _ = Describe("NewSessionStore", func() {

341341 Context("with non-default options", func() {

342342 BeforeEach(func() {

343343 cookieOpts = &options.CookieOptions{

344− CookieName: "_cookie_name",

345− CookiePath: "/path",

346− CookieExpire: time.Duration(72) * time.Hour,

347− CookieRefresh: time.Duration(2) * time.Hour,

348− CookieSecure: false,

349− CookieHTTPOnly: false,

350− CookieDomains: []string{"example.com"},

351− CookieSameSite: "strict",

344+ Name: "_cookie_name",

345+ Path: "/path",

346+ Expire: time.Duration(72) * time.Hour,

347+ Refresh: time.Duration(2) * time.Hour,

348+ Secure: false,

349+ HTTPOnly: false,

350+ Domains: []string{"example.com"},

351+ SameSite: "strict",

352352 }

353353

354354 var err error

@@ -364,8 +364,8 @@ var _ = Describe("NewSessionStore", func() {

364364 secret := make([]byte, 32)

365365 _, err := rand.Read(secret)

366366 Expect(err).ToNot(HaveOccurred())

367− cookieOpts.CookieSecret = base64.URLEncoding.EncodeToString(secret)

368− cipher, err := encryption.NewCipher(utils.SecretBytes(cookieOpts.CookieSecret))

367+ cookieOpts.Secret = base64.URLEncoding.EncodeToString(secret)

368+ cipher, err := encryption.NewCipher(utils.SecretBytes(cookieOpts.Secret))

369369 Expect(err).ToNot(HaveOccurred())

370370 Expect(cipher).ToNot(BeNil())

371371 opts.Cipher = cipher

@@ -384,13 +384,13 @@ var _ = Describe("NewSessionStore", func() {

384384

385385 // Set default options in CookieOptions

386386 cookieOpts = &options.CookieOptions{

387− CookieName: "_oauth2_proxy",

388− CookiePath: "/",

389− CookieExpire: time.Duration(168) * time.Hour,

390− CookieRefresh: time.Duration(1) * time.Hour,

391− CookieSecure: true,

392− CookieHTTPOnly: true,

393− CookieSameSite: "",

387+ Name: "_oauth2_proxy",

388+ Path: "/",

389+ Expire: time.Duration(168) * time.Hour,

390+ Refresh: time.Duration(1) * time.Hour,

391+ Secure: true,

392+ HTTPOnly: true,

393+ SameSite: "",

394394 }

395395

396396 session = &sessionsapi.SessionState{