4e2013e · typeable/oauth2-proxy

CHANGELOG.md+2−1

@@ -12,7 +12,8 @@

12- [#2755](https://github.com/oauth2-proxy/oauth2-proxy/pull/2755) feat: add X-Envoy-External-Address as supported header (@bjencks)

13- [#1985](https://github.com/oauth2-proxy/oauth2-proxy/pull/1985) Add support for systemd socket (@isodude)

14- [#2300](https://github.com/oauth2-proxy/oauth2-proxy/pull/2300) Add fix for websocket path rewrite (@rekup)

15−- [#2821](https://github.com/oauth2-proxy/oauth2-proxy/pull/2821) feat: add CF-Connecting-IP as supported real ip header

15+- [#2821](https://github.com/oauth2-proxy/oauth2-proxy/pull/2821) feat: add CF-Connecting-IP as supported real ip header (@ondrejsika)

16+- [#2620](https://github.com/oauth2-proxy/oauth2-proxy/pull/2620) fix: update code_verifier to use recommended method (@vishvananda)

16

17

17# V7.7.1

18# V7.7.1

18

19

oauthproxy.go+1−1

@@ -802,7 +802,7 @@ func (p *OAuthProxy) doOAuthStart(rw http.ResponseWriter, req *http.Request, ove

802 )

803 if p.provider.Data().CodeChallengeMethod != "" {

804 codeChallengeMethod = p.provider.Data().CodeChallengeMethod

805− codeVerifier, err = encryption.GenerateRandomASCIIString(96)

805+ codeVerifier, err = encryption.GenerateCodeVerifierString(96)

806 if err != nil {

807 logger.Errorf("Unable to build random ASCII string for code verifier: %v", err)

808 p.ErrorPage(rw, req, http.StatusInternalServerError, err.Error())

pkg/encryption/utils.go+7−11

@@ -7,7 +7,7 @@ import (

7 "encoding/base64"

8 "fmt"

9 "hash"

10− "math/big"

10+ "io"

11 "net/http"

12 "strconv"

13 "strings"

@@ -83,17 +83,13 @@ func SignedValue(seed string, key string, value []byte, now time.Time) (string,

83 return cookieVal, nil

84}

85

86−func GenerateRandomASCIIString(length int) (string, error) {

86+// GenerateCodeVerifierString returns a base64 encoded string of n random bytes

87+func GenerateCodeVerifierString(n int) (string, error) {

87− b := make([]byte, length)

88+ data := make([]byte, n)

88− charsetLen := new(big.Int).SetInt64(int64(len(asciiCharset)))

89+ if _, err := io.ReadFull(rand.Reader, data); err != nil {

89− for i := range b {

90− character, err := rand.Int(rand.Reader, charsetLen)

91− if err != nil {

92− return "", err

90+ return "", err

93− }

94− b[i] = asciiCharset[character.Int64()]

95 }

91 }

96− return string(b), nil

92+ return base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(data), nil

97}

93}

98

94

99func GenerateCodeChallenge(method, codeVerifier string) (string, error) {

95func GenerateCodeChallenge(method, codeVerifier string) (string, error) {

pkg/encryption/utils_test.go+4−4

@@ -130,12 +130,12 @@ func TestValidate(t *testing.T) {

130 assert.Equal(t, validValue, expectedValue)

131}

132

133−func TestGenerateRandomASCIIString(t *testing.T) {

133+func TestGenerateCodeVerifierString(t *testing.T) {

134− randomString, err := GenerateRandomASCIIString(96)

134+ randomString, err := GenerateCodeVerifierString(96)

135 assert.NoError(t, err)

136

137− // Only 8-bit characters

137+ // Should be 128 characters long

138− assert.Equal(t, 96, len([]byte(randomString)))

138+ assert.Equal(t, 128, len([]byte(randomString)))

139

140 // All non-ascii characters removed should still be the original string

141 removedChars := strings.Map(func(r rune) rune {