Make sure websockets respect ssl-upstream-insecure-skip-verify setting. (#494)
* Make sure websockets respect ssl-upstream-insecure-skip-verify setting.
Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
* Updated changelog for websockets taking into account ssl-upstream-insecure-skip-verify
Signed-off-by: Yaroslav Rosomakho <yaroslavros@gmail.com>
Co-authored-by: Henry Jenkins <henry@henryjenkins.name>
commit4d21b8a04f083d3101f4cb987f7cccbd402c29f1
authoryaroslavros <yaroslavros@gmail.com>
dateSun 19 Apr 2020, 17:41 (6 years ago)
parentc6294c4
CHANGELOG.md+1
@@ -39,6 +39,7 @@
3939- [#413](https://github.com/oauth2-proxy/oauth2-proxy/pull/413) Add -set-basic-auth param to set the Basic Authorization header for upstreams (@morarucostel).
4040- [#483](https://github.com/oauth2-proxy/oauth2-proxy/pull/483) Warn users when session cookies are split (@JoelSpeed)
4141- [#488](https://github.com/oauth2-proxy/oauth2-proxy/pull/488) Set-Basic-Auth should default to false (@JoelSpeed)
42+- [#494](https://github.com/oauth2-proxy/oauth2-proxy/pull/494) Upstream websockets TLS certificate validation now depends on ssl-upstream-insecure-skip-verify
4243
4344# v5.1.0
4445
oauthproxy.go+3
@@ -191,6 +191,9 @@ func NewWebSocketOrRestReverseProxy(u *url.URL, opts *Options, auth hmacauth.Hma
191191 wsScheme := "ws" + strings.TrimPrefix(u.Scheme, "http")
192192 wsURL := &url.URL{Scheme: wsScheme, Host: u.Host}
193193 wsProxy = wsutil.NewSingleHostReverseProxy(wsURL)
194+ if opts.SSLUpstreamInsecureSkipVerify {
195+ wsProxy.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
196+ }
194197 }
195198 return &UpstreamProxy{
196199 upstream: u.Host,