git.iko.soy/typeable/oauth2-proxy
on master help sign in
Deprecate GAP-Signature and add a warning on usage (#1103)
commit4d9de06b1dbad8d27965afa2586df29667eeb50c authorNick Meves <nick.meves@greenhouse.io> dateSun 14 Mar 2021, 09:47 (6 years ago) parent20cf033
4 files changed+12−28
compare with master
unifiedsplit
CHANGELOG.md+5 docs/docs/features/request_signatures.md−20 docs/sidebars.js+1−1 pkg/validation/options.go+6−7
CHANGELOG.md+5
@@ -4,11 +4,16 @@
44
55## Important Notes
66
7+
8+- [#1103](https://github.com/oauth2-proxy/oauth2-proxy/pull/1103) Upstream request signatures via `--signature-key` is
9+ deprecated. Support will be removed completely in v8.0.0.
10+
711## Breaking Changes
812
913## Changes since v7.0.1
1014
1115- [#1045](https://github.com/oauth2-proxy/oauth2-proxy/pull/1045) Ensure redirect URI always has a scheme (@JoelSpeed)
16+- [#1103](https://github.com/oauth2-proxy/oauth2-proxy/pull/1103) Deprecate upstream request signatures (@NickMeves)
1217- [#914](https://github.com/oauth2-proxy/oauth2-proxy/pull/914) Extract email from id_token for azure provider when oidc is configured
1318- [#1047](https://github.com/oauth2-proxy/oauth2-proxy/pull/1047) Refactor HTTP Server and add ServerGroup to handle graceful shutdown of multiple servers (@JoelSpeed)
1419- [#1070](https://github.com/oauth2-proxy/oauth2-proxy/pull/1070) Refactor logging middleware to middleware package (@NickMeves)
docs/docs/features/request_signatures.mddeleted−20
@@ -1,20 +0,0 @@
1−---
2−id: request_signatures
3−title: Request Signatures
4−---
5−
6−If `signature_key` is defined, proxied requests will be signed with the
7−`GAP-Signature` header, which is a [Hash-based Message Authentication Code
8−(HMAC)](https://en.wikipedia.org/wiki/Hash-based_message_authentication_code)
9−of selected request information and the request body [see `SIGNATURE_HEADERS`
10−in `oauthproxy.go`](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/oauthproxy.go).
11−
12−`signature_key` must be of the form `algorithm:secretkey`, (ie: `signature_key = "sha1:secret0"`)
13−
14−For more information about HMAC request signature validation, read the
15−following:
16−
17−- [Amazon Web Services: Signing and Authenticating REST
18− Requests](https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html)
19−- [rc3.org: Using HMAC to authenticate Web service
20− requests](http://rc3.org/2011/12/02/using-hmac-to-authenticate-web-service-requests/)
docs/sidebars.js+1−1
@@ -18,7 +18,7 @@ module.exports = {
1818 type: 'category',
1919 label: 'Features',
2020 collapsed: false,
21− items: ['features/endpoints', 'features/request_signatures'],
21+ items: ['features/endpoints'],
2222 },
2323 {
2424 type: 'category',
pkg/validation/options.go+6−7
@@ -2,7 +2,6 @@ package validation
22
33import (
44 "context"
5− "crypto"
65 "crypto/tls"
76 "fmt"
87 "io/ioutil"
@@ -30,8 +29,8 @@ func Validate(o *options.Options) error {
3029 msgs = append(msgs, validateRedisSessionStore(o)...)
3130 msgs = append(msgs, prefixValues("injectRequestHeaders: ", validateHeaders(o.InjectRequestHeaders)...)...)
3231 msgs = append(msgs, prefixValues("injectResponseHeaders: ", validateHeaders(o.InjectResponseHeaders)...)...)
33− msgs = parseSignatureKey(o, msgs)
3432 msgs = configureLogger(o.Logging, msgs)
33+ msgs = parseSignatureKey(o, msgs)
3534
3635 if o.SSLInsecureSkipVerify {
3736 // InsecureSkipVerify is a configurable option we allow
@@ -355,6 +354,8 @@ func parseSignatureKey(o *options.Options, msgs []string) []string {
355354 return msgs
356355 }
357356
357+ logger.Print("WARNING: `--signature-key` is deprecated. It will be removed in a future release")
358+
358359 components := strings.Split(o.SignatureKey, ":")
359360 if len(components) != 2 {
360361 return append(msgs, "invalid signature hash:key spec: "+
@@ -362,11 +363,9 @@ func parseSignatureKey(o *options.Options, msgs []string) []string {
362363 }
363364
364365 algorithm, secretKey := components[0], components[1]
365− var hash crypto.Hash
366− var err error
367− if hash, err = hmacauth.DigestNameToCryptoHash(algorithm); err != nil {
368− return append(msgs, "unsupported signature hash algorithm: "+
369− o.SignatureKey)
366+ hash, err := hmacauth.DigestNameToCryptoHash(algorithm)
367+ if err != nil {
368+ return append(msgs, "unsupported signature hash algorithm: "+o.SignatureKey)
370369 }
371370 o.SetSignatureData(&options.SignatureData{Hash: hash, Key: secretKey})
372371 return msgs