git.iko.soy/typeable/oauth2-proxy
on master help sign in
Drop fallback to email when user is empty (#537)
commit4e3dd09cf29fee601562ec3fc2c4d6d92841283d authorJoel Speed <Joel.speed@hotmail.co.uk> dateTue 12 May 2020, 16:04 (6 years ago) parent7cf6851
5 files changed+18−9
compare with master
unifiedsplit
CHANGELOG.md+8 oauthproxy.go+6−2 oauthproxy_test.go+1−1 pkg/apis/sessions/session_state.go−3 pkg/apis/sessions/session_state_test.go+3−3
CHANGELOG.md+8
@@ -25,9 +25,17 @@
2525- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies
2626 - The encoding for session cookies was changed starting in v3.1.0, support for the previous encoding is now dropped
2727 - If you are upgrading from a version earlier than this, please upgrade via a version between v3.1.0 and v5.1.1
28+- [#537](https://github.com/oauth2-proxy/oauth2-proxy/pull/537) Drop Fallback to Email if User not set
29+ - Previously, when a session was loaded, if the User was not set, it would be replaced by the Email.
30+ This behaviour was inconsistent as it required the session to be stored and then loaded to function properly.
31+ - This behaviour has now been removed and the User field will remain empty if it was not set when the session was saved.
32+ - In some scenarios `X-Forwarded-User` will now be empty. Use `X-Forwarded-Email` instead.
33+ - In some scenarios, this may break setting Basic Auth on upstream or responses.
34+ Use `--prefer-email-to-user` to restore falling back to the Email in these cases.
2835
2936## Changes since v5.1.1
3037
38+- [#537](https://github.com/oauth2-proxy/oauth2-proxy/pull/537) Drop Fallback to Email if User not set (@JoelSpeed)
3139- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies (@JoelSpeed)
3240- [#533](https://github.com/oauth2-proxy/oauth2-proxy/pull/487) Set up code coverage within Travis for Code Climate (@JoelSpeed)
3341- [#514](https://github.com/oauth2-proxy/oauth2-proxy/pull/514) Add basic string functions to templates
oauthproxy.go+6−2
@@ -1048,10 +1048,14 @@ func (p *OAuthProxy) addHeadersForProxying(rw http.ResponseWriter, req *http.Req
10481048 }
10491049 }
10501050 if p.SetBasicAuth {
1051− if session.User != "" {
1051+ switch {
1052+ case p.PreferEmailToUser && session.Email != "":
1053+ authVal := b64.StdEncoding.EncodeToString([]byte(session.Email + ":" + p.BasicAuthPassword))
1054+ rw.Header().Set("Authorization", "Basic "+authVal)
1055+ case session.User != "":
10521056 authVal := b64.StdEncoding.EncodeToString([]byte(session.User + ":" + p.BasicAuthPassword))
10531057 rw.Header().Set("Authorization", "Basic "+authVal)
1054− } else {
1058+ default:
10551059 rw.Header().Del("Authorization")
10561060 }
10571061 }
oauthproxy_test.go+1−1
@@ -956,7 +956,7 @@ func TestLoadCookiedSession(t *testing.T) {
956956 session, err := pcTest.LoadCookiedSession()
957957 assert.Equal(t, nil, err)
958958 assert.Equal(t, startSession.Email, session.Email)
959− assert.Equal(t, "john.doe@example.com", session.User)
959+ assert.Equal(t, "", session.User)
960960 assert.Equal(t, startSession.AccessToken, session.AccessToken)
961961}
962962
pkg/apis/sessions/session_state.go−3
@@ -193,8 +193,5 @@ func DecodeSessionState(v string, c *encryption.Cipher) (*SessionState, error) {
193193 }
194194 }
195195 }
196− if ss.User == "" {
197− ss.User = ss.Email
198− }
199196 return ss, nil
200197}
pkg/apis/sessions/session_state_test.go+3−3
@@ -33,7 +33,7 @@ func TestSessionStateSerialization(t *testing.T) {
3333 ss, err := sessions.DecodeSessionState(encoded, c)
3434 t.Logf("%#v", ss)
3535 assert.Equal(t, nil, err)
36− assert.Equal(t, "user@domain.com", ss.User)
36+ assert.Equal(t, "", ss.User)
3737 assert.Equal(t, s.Email, ss.Email)
3838 assert.Equal(t, s.PreferredUsername, ss.PreferredUsername)
3939 assert.Equal(t, s.AccessToken, ss.AccessToken)
@@ -112,7 +112,7 @@ func TestSessionStateSerializationNoCipher(t *testing.T) {
112112 // only email should have been serialized
113113 ss, err := sessions.DecodeSessionState(encoded, nil)
114114 assert.Equal(t, nil, err)
115− assert.Equal(t, "user@domain.com", ss.User)
115+ assert.Equal(t, "", ss.User)
116116 assert.Equal(t, s.Email, ss.Email)
117117 assert.Equal(t, s.PreferredUsername, ss.PreferredUsername)
118118 assert.Equal(t, "", ss.AccessToken)
@@ -226,7 +226,7 @@ func TestDecodeSessionState(t *testing.T) {
226226 {
227227 SessionState: sessions.SessionState{
228228 Email: "user@domain.com",
229− User: "user@domain.com",
229+ User: "",
230230 },
231231 Encoded: `{"Email":"user@domain.com"}`,
232232 },