git.iko.soy/typeable/oauth2-proxy
on master help sign in
Make sure websockets respect ssl-upstream-insecure-skip-verify setting. (#494)
4d21b8ayaroslavros
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -39,6 +39,7 @@
39- [#413](https://github.com/oauth2-proxy/oauth2-proxy/pull/413) Add -set-basic-auth param to set the Basic Authorization header for upstreams (@morarucostel).
39- [#413](https://github.com/oauth2-proxy/oauth2-proxy/pull/413) Add -set-basic-auth param to set the Basic Authorization header for upstreams (@morarucostel).
40- [#483](https://github.com/oauth2-proxy/oauth2-proxy/pull/483) Warn users when session cookies are split (@JoelSpeed)
40- [#483](https://github.com/oauth2-proxy/oauth2-proxy/pull/483) Warn users when session cookies are split (@JoelSpeed)
41- [#488](https://github.com/oauth2-proxy/oauth2-proxy/pull/488) Set-Basic-Auth should default to false (@JoelSpeed)
41- [#488](https://github.com/oauth2-proxy/oauth2-proxy/pull/488) Set-Basic-Auth should default to false (@JoelSpeed)
42+- [#494](https://github.com/oauth2-proxy/oauth2-proxy/pull/494) Upstream websockets TLS certificate validation now depends on ssl-upstream-insecure-skip-verify
42
43
43# v5.1.0
44# v5.1.0
44
45
oauthproxy.go+3
@@ -191,6 +191,9 @@ func NewWebSocketOrRestReverseProxy(u *url.URL, opts *Options, auth hmacauth.Hma
191 wsScheme := "ws" + strings.TrimPrefix(u.Scheme, "http")
191 wsScheme := "ws" + strings.TrimPrefix(u.Scheme, "http")
192 wsURL := &url.URL{Scheme: wsScheme, Host: u.Host}
192 wsURL := &url.URL{Scheme: wsScheme, Host: u.Host}
193 wsProxy = wsutil.NewSingleHostReverseProxy(wsURL)
193 wsProxy = wsutil.NewSingleHostReverseProxy(wsURL)
194+ if opts.SSLUpstreamInsecureSkipVerify {
195+ wsProxy.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
196+ }
194 }
197 }
195 return &UpstreamProxy{
198 return &UpstreamProxy{
196 upstream: u.Host,
199 upstream: u.Host,