git.iko.soy/typeable/oauth2-proxy
on master help sign in
Drop fallback to email when user is empty (#537)
4e3dd09Joel Speed
CHANGELOG.md+8
compare with master
unifiedsplit
@@ -25,9 +25,17 @@
25- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies
25- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies
26 - The encoding for session cookies was changed starting in v3.1.0, support for the previous encoding is now dropped
26 - The encoding for session cookies was changed starting in v3.1.0, support for the previous encoding is now dropped
27 - If you are upgrading from a version earlier than this, please upgrade via a version between v3.1.0 and v5.1.1
27 - If you are upgrading from a version earlier than this, please upgrade via a version between v3.1.0 and v5.1.1
28+- [#537](https://github.com/oauth2-proxy/oauth2-proxy/pull/537) Drop Fallback to Email if User not set
29+ - Previously, when a session was loaded, if the User was not set, it would be replaced by the Email.
30+ This behaviour was inconsistent as it required the session to be stored and then loaded to function properly.
31+ - This behaviour has now been removed and the User field will remain empty if it was not set when the session was saved.
32+ - In some scenarios `X-Forwarded-User` will now be empty. Use `X-Forwarded-Email` instead.
33+ - In some scenarios, this may break setting Basic Auth on upstream or responses.
34+ Use `--prefer-email-to-user` to restore falling back to the Email in these cases.
28
35
29## Changes since v5.1.1
36## Changes since v5.1.1
30
37
38+- [#537](https://github.com/oauth2-proxy/oauth2-proxy/pull/537) Drop Fallback to Email if User not set (@JoelSpeed)
31- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies (@JoelSpeed)
39- [#535](https://github.com/oauth2-proxy/oauth2-proxy/pull/535) Drop support for pre v3.1 cookies (@JoelSpeed)
32- [#533](https://github.com/oauth2-proxy/oauth2-proxy/pull/487) Set up code coverage within Travis for Code Climate (@JoelSpeed)
40- [#533](https://github.com/oauth2-proxy/oauth2-proxy/pull/487) Set up code coverage within Travis for Code Climate (@JoelSpeed)
33- [#514](https://github.com/oauth2-proxy/oauth2-proxy/pull/514) Add basic string functions to templates
41- [#514](https://github.com/oauth2-proxy/oauth2-proxy/pull/514) Add basic string functions to templates
oauthproxy.go+6−2
@@ -1048,10 +1048,14 @@ func (p *OAuthProxy) addHeadersForProxying(rw http.ResponseWriter, req *http.Req
1048 }
1048 }
1049 }
1049 }
1050 if p.SetBasicAuth {
1050 if p.SetBasicAuth {
1051+ switch {
1052+ case p.PreferEmailToUser && session.Email != "":
1053+ authVal := b64.StdEncoding.EncodeToString([]byte(session.Email + ":" + p.BasicAuthPassword))
1054+ rw.Header().Set("Authorization", "Basic "+authVal)
1051− if session.User != "" {
1055+ case session.User != "":
1052 authVal := b64.StdEncoding.EncodeToString([]byte(session.User + ":" + p.BasicAuthPassword))
1056 authVal := b64.StdEncoding.EncodeToString([]byte(session.User + ":" + p.BasicAuthPassword))
1053 rw.Header().Set("Authorization", "Basic "+authVal)
1057 rw.Header().Set("Authorization", "Basic "+authVal)
1054− } else {
1058+ default:
1055 rw.Header().Del("Authorization")
1059 rw.Header().Del("Authorization")
1056 }
1060 }
1057 }
1061 }
oauthproxy_test.go+1−1
@@ -956,7 +956,7 @@ func TestLoadCookiedSession(t *testing.T) {
956 session, err := pcTest.LoadCookiedSession()
956 session, err := pcTest.LoadCookiedSession()
957 assert.Equal(t, nil, err)
957 assert.Equal(t, nil, err)
958 assert.Equal(t, startSession.Email, session.Email)
958 assert.Equal(t, startSession.Email, session.Email)
959− assert.Equal(t, "john.doe@example.com", session.User)
959+ assert.Equal(t, "", session.User)
960 assert.Equal(t, startSession.AccessToken, session.AccessToken)
960 assert.Equal(t, startSession.AccessToken, session.AccessToken)
961}
961}
962
962
pkg/apis/sessions/session_state.go−3
@@ -193,8 +193,5 @@ func DecodeSessionState(v string, c *encryption.Cipher) (*SessionState, error) {
193 }
193 }
194 }
194 }
195 }
195 }
196− if ss.User == "" {
197− ss.User = ss.Email
198− }
199 return ss, nil
196 return ss, nil
200}
197}
pkg/apis/sessions/session_state_test.go+3−3
@@ -33,7 +33,7 @@ func TestSessionStateSerialization(t *testing.T) {
33 ss, err := sessions.DecodeSessionState(encoded, c)
33 ss, err := sessions.DecodeSessionState(encoded, c)
34 t.Logf("%#v", ss)
34 t.Logf("%#v", ss)
35 assert.Equal(t, nil, err)
35 assert.Equal(t, nil, err)
36− assert.Equal(t, "user@domain.com", ss.User)
36+ assert.Equal(t, "", ss.User)
37 assert.Equal(t, s.Email, ss.Email)
37 assert.Equal(t, s.Email, ss.Email)
38 assert.Equal(t, s.PreferredUsername, ss.PreferredUsername)
38 assert.Equal(t, s.PreferredUsername, ss.PreferredUsername)
39 assert.Equal(t, s.AccessToken, ss.AccessToken)
39 assert.Equal(t, s.AccessToken, ss.AccessToken)
@@ -112,7 +112,7 @@ func TestSessionStateSerializationNoCipher(t *testing.T) {
112 // only email should have been serialized
112 // only email should have been serialized
113 ss, err := sessions.DecodeSessionState(encoded, nil)
113 ss, err := sessions.DecodeSessionState(encoded, nil)
114 assert.Equal(t, nil, err)
114 assert.Equal(t, nil, err)
115− assert.Equal(t, "user@domain.com", ss.User)
115+ assert.Equal(t, "", ss.User)
116 assert.Equal(t, s.Email, ss.Email)
116 assert.Equal(t, s.Email, ss.Email)
117 assert.Equal(t, s.PreferredUsername, ss.PreferredUsername)
117 assert.Equal(t, s.PreferredUsername, ss.PreferredUsername)
118 assert.Equal(t, "", ss.AccessToken)
118 assert.Equal(t, "", ss.AccessToken)
@@ -226,7 +226,7 @@ func TestDecodeSessionState(t *testing.T) {
226 {
226 {
227 SessionState: sessions.SessionState{
227 SessionState: sessions.SessionState{
228 Email: "user@domain.com",
228 Email: "user@domain.com",
229− User: "user@domain.com",
229+ User: "",
230 },
230 },
231 Encoded: `{"Email":"user@domain.com"}`,
231 Encoded: `{"Email":"user@domain.com"}`,
232 },
232 },