git.iko.soy/typeable/oauth2-proxy
on master help sign in
Add silence ping logging flag using ExcludePath

- Add `ping-path` option to enable switching on and passing to `logger.go` Default remains unchanged at: `"/ping"` - Add note in configuration.md about silence flag taking precedence Potential tests: - `options.go` sets `logger.SetExcludePath` based on silence flag? - Changing `PingPath` reflected in router?

commit4e10cc76e061558a170c42b1d7c0da81794ae2e6 authorKarl Skewes <karl.skewes@gmail.com> dateMon 3 Jun 2019, 13:51 (7 years ago) parent0802142
4 files changed+15−6
compare with master
unifiedsplit
docs/configuration/configuration.md+3−1 main.go+2 oauthproxy.go+1−1 options.go+9−4
docs/configuration/configuration.md+3−1
@@ -74,6 +74,7 @@ Usage of oauth2_proxy:
7474 -pass-user-headers: pass X-Forwarded-User and X-Forwarded-Email information to upstream (default true)
7575 -profile-url string: Profile access endpoint
7676 -provider string: OAuth provider (default "google")
77+ -ping-path string: the ping endpoint that can be used for basic health checks (default "/ping")
7778 -proxy-prefix string: the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in) (default "/oauth2")
7879 -proxy-websockets: enables WebSocket proxying (default true)
7980 -pubjwk-url string: JWK pubkey access endpoint: required by login.gov
@@ -91,6 +92,7 @@ Usage of oauth2_proxy:
9192 -set-xauthrequest: set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)
9293 -set-authorization-header: set Authorization Bearer response header (useful in Nginx auth_request mode)
9394 -signature-key string: GAP-Signature request signature key (algorithm:secretkey)
95+ -silence-ping-logging bool: disable logging of requests to ping endpoint (default false)
9496 -skip-auth-preflight: will skip authentication for OPTIONS requests
9597 -skip-auth-regex value: bypass authentication for requests path's that match (may be given multiple times)
9698 -skip-jwt-bearer-tokens: will skip requests that have verified JWT bearer tokens
@@ -140,7 +142,7 @@ There are three different types of logging: standard, authentication, and HTTP r
140142
141143Each type of logging has their own configurable format and variables. By default these formats are similar to the Apache Combined Log.
142144
143−A specific path can be excluded from request logs by setting `-exclude-logging-path`. This is useful for disabling logging of requests to the `/ping` endpoint to reduce log volume when health checking `oauth2_proxy`.
145+Logging of requests to the `/ping` endpoint can be disabled with `-silence-ping-logging` reducing log volume. This flag sets the `-exclude-logging-path` value to the `-ping-path` and takes precedence over any other value `-exclude-logging-path` may have been set to directly.
144146
145147### Auth Log Format
146148Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:
main.go+2
@@ -69,6 +69,7 @@ func main() {
6969 flagSet.String("banner", "", "custom banner string. Use \"-\" to disable default banner.")
7070 flagSet.String("footer", "", "custom footer string. Use \"-\" to disable default footer.")
7171 flagSet.String("proxy-prefix", "/oauth2", "the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)")
72+ flagSet.String("ping-path", "/ping", "the ping endpoint that can be used for basic health checks")
7273 flagSet.Bool("proxy-websockets", true, "enables WebSocket proxying")
7374
7475 flagSet.String("cookie-name", "_oauth2_proxy", "the name of the cookie that the oauth_proxy creates")
@@ -99,6 +100,7 @@ func main() {
99100 flagSet.Bool("request-logging", true, "Log HTTP requests")
100101 flagSet.String("request-logging-format", logger.DefaultRequestLoggingFormat, "Template for HTTP request log lines")
101102 flagSet.String("exclude-logging-path", "", "Exclude logging requests to path (eg: /ping)")
103+ flagSet.Bool("silence-ping-logging", false, "Disable logging of requests to ping endpoint")
102104
103105 flagSet.Bool("auth-logging", true, "Log authentication attempts")
104106 flagSet.String("auth-logging-format", logger.DefaultAuthLoggingFormat, "Template for authentication log lines")
oauthproxy.go+1−1
@@ -254,7 +254,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {
254254 Validator: validator,
255255
256256 RobotsPath: "/robots.txt",
257− PingPath: "/ping",
257+ PingPath: opts.PingPath,
258258 SignInPath: fmt.Sprintf("%s/sign_in", opts.ProxyPrefix),
259259 SignOutPath: fmt.Sprintf("%s/sign_out", opts.ProxyPrefix),
260260 OAuthStartPath: fmt.Sprintf("%s/start", opts.ProxyPrefix),
options.go+9−4
@@ -30,6 +30,7 @@ import (
3030// or Config File
3131type Options struct {
3232 ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix" env:"OAUTH2_PROXY_PROXY_PREFIX"`
33+ PingPath string `flag:"ping-path" cfg:"ping-path" env:"OAUTH2_PROXY_PING_PATH"`
3334 ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets" env:"OAUTH2_PROXY_PROXY_WEBSOCKETS"`
3435 HTTPAddress string `flag:"http-address" cfg:"http_address" env:"OAUTH2_PROXY_HTTP_ADDRESS"`
3536 HTTPSAddress string `flag:"https-address" cfg:"https_address" env:"OAUTH2_PROXY_HTTPS_ADDRESS"`
@@ -103,9 +104,8 @@ type Options struct {
103104 StandardLoggingFormat string `flag:"standard-logging-format" cfg:"standard_logging_format" env:"OAUTH2_PROXY_STANDARD_LOGGING_FORMAT"`
104105 RequestLogging bool `flag:"request-logging" cfg:"request_logging" env:"OAUTH2_PROXY_REQUEST_LOGGING"`
105106 RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format" env:"OAUTH2_PROXY_REQUEST_LOGGING_FORMAT"`
106− PingPath string `flag:"ping-path" cfg:"ping_path" env:"OAUTH2_PROXY_PING_PATH"`
107− SilencePingLogging bool `flag:"silence-ping-logging" cfg:"silence_ping_logging" env:"OAUTH2_PROXY_SILENCE_PING_LOGGING"`
108107 ExcludeLoggingPath string `flag:"exclude-logging-path" cfg:"exclude_logging_path" env:"OAUTH2_PROXY_EXCLUDE_LOGGING_PATH"`
108+ SilencePingLogging bool `flag:"silence-ping-logging" cfg:"silence_ping_logging" env:"OAUTH2_PROXY_SILENCE_PING_LOGGING"`
109109 AuthLogging bool `flag:"auth-logging" cfg:"auth_logging" env:"OAUTH2_PROXY_LOGGING_AUTH_LOGGING"`
110110 AuthLoggingFormat string `flag:"auth-logging-format" cfg:"auth_logging_format" env:"OAUTH2_PROXY_AUTH_LOGGING_FORMAT"`
111111 SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`
@@ -136,6 +136,7 @@ type SignatureData struct {
136136func NewOptions() *Options {
137137 return &Options{
138138 ProxyPrefix: "/oauth2",
139+ PingPath: "/ping",
139140 ProxyWebSockets: true,
140141 HTTPAddress: "127.0.0.1:4180",
141142 HTTPSAddress: ":443",
@@ -168,7 +169,6 @@ func NewOptions() *Options {
168169 LoggingLocalTime: true,
169170 LoggingCompress: false,
170171 ExcludeLoggingPath: "",
171− PingPath: "/ping",
172172 SilencePingLogging: false,
173173 StandardLogging: true,
174174 StandardLoggingFormat: logger.DefaultStandardLoggingFormat,
@@ -572,11 +572,16 @@ func setupLogger(o *Options, msgs []string) []string {
572572 logger.SetStandardEnabled(o.StandardLogging)
573573 logger.SetAuthEnabled(o.AuthLogging)
574574 logger.SetReqEnabled(o.RequestLogging)
575− logger.SetExcludePath(o.ExcludeLoggingPath)
576575 logger.SetStandardTemplate(o.StandardLoggingFormat)
577576 logger.SetAuthTemplate(o.AuthLoggingFormat)
578577 logger.SetReqTemplate(o.RequestLoggingFormat)
579578
579+ if o.SilencePingLogging {
580+ logger.SetExcludePath(o.PingPath)
581+ } else {
582+ logger.SetExcludePath(o.ExcludeLoggingPath)
583+ }
584+
580585 if !o.LoggingLocalTime {
581586 logger.SetFlags(logger.Flags() | logger.LUTC)
582587 }