@@ -470,21 +470,27 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
470470}
471471
472472func (p *OAuthProxy) AuthenticateOnly(rw http.ResponseWriter, req *http.Request) {
473− remoteAddr := getRemoteAddr(req)
474− if session, _, err := p.LoadCookiedSession(req); err != nil {
475− log.Printf("%s %s", remoteAddr, err)
476− } else if session.IsExpired() {
477− log.Printf("%s Expired", remoteAddr, session)
478− } else if !p.Validator(session.Email) {
479− log.Printf("%s Permission Denied", remoteAddr, session)
480− } else {
473+ status := p.Authenticate(rw, req)
474+ if status == http.StatusAccepted {
481475 rw.WriteHeader(http.StatusAccepted)
482− return
476+ } else {
477+ http.Error(rw, "unauthorized request", http.StatusUnauthorized)
483478 }
484− http.Error(rw, "unauthorized request", http.StatusUnauthorized)
485479}
486480
487481func (p *OAuthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
482+ status := p.Authenticate(rw, req)
483+ if status == http.StatusInternalServerError {
484+ p.ErrorPage(rw, http.StatusInternalServerError,
485+ "Internal Error", "Internal Error")
486+ } else if status == http.StatusForbidden {
487+ p.SignInPage(rw, req, http.StatusForbidden)
488+ } else {
489+ p.serveMux.ServeHTTP(rw, req)
490+ }
491+}
492+
493+func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int {
488494 var saveSession, clearSession, revalidated bool
489495 remoteAddr := getRemoteAddr(req)
490496
@@ -533,8 +539,7 @@ func (p *OAuthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
533539 err := p.SaveSession(rw, req, session)
534540 if err != nil {
535541 log.Printf("%s %s", remoteAddr, err)
536− p.ErrorPage(rw, 500, "Internal Error", "Internal Error")
537− return
542+ return http.StatusInternalServerError
538543 }
539544 }
540545
@@ -550,8 +555,7 @@ func (p *OAuthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
550555 }
551556
552557 if session == nil {
553− p.SignInPage(rw, req, 403)
554− return
558+ return http.StatusForbidden
555559 }
556560
557561 // At this point, the user is authenticated. proxy normally
@@ -570,8 +574,7 @@ func (p *OAuthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
570574 } else {
571575 rw.Header().Set("GAP-Auth", session.Email)
572576 }
573−
574− p.serveMux.ServeHTTP(rw, req)
577+ return http.StatusAccepted
575578}
576579
577580func (p *OAuthProxy) CheckBasicAuth(req *http.Request) (*providers.SessionState, error) {