git.iko.soy/typeable/oauth2-proxy
on master help sign in
fix: static upstreams failing validation due to `passHostHeader` and `proxyWebSockets` defaults being set incorrectly (#3302)

* fix: static upstream validation failure Signed-off-by: Sourav Agrawal <souravagr01@gmail.com> * fix: enforcement of defaults compatible with static upstreams Signed-off-by: Jan Larwig <jan@larwig.com> --------- Signed-off-by: Sourav Agrawal <souravagr01@gmail.com> Signed-off-by: Jan Larwig <jan@larwig.com> Co-authored-by: Jan Larwig <jan@larwig.com>

commit59f4e42a5af56bc360cd38221451ac7f134b4856 authorSourav Agrawal <146818014+sourava01@users.noreply.github.com> dateSat 17 Jan 2026, 19:45 (9 months ago) parent9c61c49
6 files changed+60−23
compare with master
unifiedsplit
CHANGELOG.md+1 pkg/apis/options/legacy_options.go+4−4 pkg/apis/options/legacy_options_test.go+12−12 pkg/apis/options/upstreams.go+21−3 pkg/validation/upstreams.go+3−3 pkg/validation/upstreams_test.go+19−1
CHANGELOG.md+1
@@ -9,6 +9,7 @@
99## Changes since v7.14.0
1010
1111- [#3309](https://github.com/oauth2-proxy/oauth2-proxy/pull/3309) fix: Return 302 redirect from AuthOnly endpoint when skip-provider-button is true (@StefanMarkmann)
12+- [#3302](https://github.com/oauth2-proxy/oauth2-proxy/pull/3302) fix: static upstreams failing validation due to `passHostHeader` and `proxyWebSockets` defaults being set incorrectly (@sourava01 / @tuunit)
1213
1314# V7.14.0
1415
pkg/apis/options/legacy_options.go+4−4
@@ -179,10 +179,10 @@ func (l *LegacyUpstreams) convert() (UpstreamConfig, error) {
179179 upstream.URI = ""
180180 upstream.InsecureSkipTLSVerify = ptr.To(false)
181181 upstream.DisableKeepAlives = ptr.To(false)
182− upstream.PassHostHeader = nil
183− upstream.ProxyWebSockets = nil
184− upstream.FlushInterval = nil
185− upstream.Timeout = nil
182+ upstream.PassHostHeader = ptr.To(false)
183+ upstream.ProxyWebSockets = ptr.To(false)
184+ upstream.FlushInterval = ptr.To(DefaultUpstreamFlushInterval)
185+ upstream.Timeout = ptr.To(DefaultUpstreamTimeout)
186186 case "unix":
187187 upstream.Path = "/"
188188 }
pkg/apis/options/legacy_options_test.go+12−12
@@ -204,12 +204,12 @@ var _ = Describe("Legacy Options", func() {
204204 URI: "",
205205 Static: ptr.To(true),
206206 StaticCode: &validStaticCode,
207− InsecureSkipTLSVerify: ptr.To(false),
208− PassHostHeader: nil,
209− ProxyWebSockets: nil,
210− FlushInterval: nil,
211− Timeout: nil,
212− DisableKeepAlives: ptr.To(false),
207+ InsecureSkipTLSVerify: ptr.To(DefaultUpsteamInsecureSkipTLSVerify),
208+ PassHostHeader: ptr.To(DefaultStaticPassHostHeader),
209+ ProxyWebSockets: ptr.To(DefaultStaticProxyWebSockets),
210+ FlushInterval: ptr.To(DefaultUpstreamFlushInterval),
211+ Timeout: ptr.To(DefaultUpstreamTimeout),
212+ DisableKeepAlives: ptr.To(DefaultUpstreamDisableKeepAlives),
213213 }
214214
215215 invalidStatic := "static://abc"
@@ -220,12 +220,12 @@ var _ = Describe("Legacy Options", func() {
220220 URI: "",
221221 Static: ptr.To(true),
222222 StaticCode: &invalidStaticCode,
223− InsecureSkipTLSVerify: ptr.To(false),
224− PassHostHeader: nil,
225− ProxyWebSockets: nil,
226− FlushInterval: nil,
227− Timeout: nil,
228− DisableKeepAlives: ptr.To(false),
223+ InsecureSkipTLSVerify: ptr.To(DefaultUpsteamInsecureSkipTLSVerify),
224+ PassHostHeader: ptr.To(DefaultStaticPassHostHeader),
225+ ProxyWebSockets: ptr.To(DefaultStaticProxyWebSockets),
226+ FlushInterval: ptr.To(DefaultUpstreamFlushInterval),
227+ Timeout: ptr.To(DefaultUpstreamTimeout),
228+ DisableKeepAlives: ptr.To(DefaultUpstreamDisableKeepAlives),
229229 }
230230
231231 invalidHTTP := ":foo"
pkg/apis/options/upstreams.go+21−3
@@ -29,9 +29,15 @@ const (
2929 // DefaultUpstreamPassHostHeader determines if upstreams will pass the host header by default.
3030 DefaultUpstreamPassHostHeader bool = true
3131
32+ // Static upstreams cannot pass the host header.
33+ DefaultStaticPassHostHeader bool = false
34+
3235 // DefaultUpstreamProxyWebSockets determines if upstreams will proxy websockets by default.
3336 DefaultUpstreamProxyWebSockets bool = true
3437
38+ // Static upstreams cannot proxy websockets.
39+ DefaultStaticProxyWebSockets bool = false
40+
3541 // DefaultUpstreamDisableKeepAlives determines if upstreams will disable keep-alives by default.
3642 DefaultUpstreamDisableKeepAlives bool = false
3743)
@@ -143,19 +149,31 @@ func (u *Upstream) EnsureDefaults() {
143149 if u.Static == nil {
144150 u.Static = ptr.To(DefaultUpstreamStatic)
145151 }
146− if u.FlushInterval == nil {
147− u.FlushInterval = ptr.To(DefaultUpstreamFlushInterval)
148− }
149152 if u.PassHostHeader == nil {
150153 u.PassHostHeader = ptr.To(DefaultUpstreamPassHostHeader)
151154 }
152155 if u.ProxyWebSockets == nil {
153156 u.ProxyWebSockets = ptr.To(DefaultUpstreamProxyWebSockets)
154157 }
158+ if u.FlushInterval == nil {
159+ u.FlushInterval = ptr.To(DefaultUpstreamFlushInterval)
160+ }
155161 if u.Timeout == nil {
156162 u.Timeout = ptr.To(DefaultUpstreamTimeout)
157163 }
158164 if u.DisableKeepAlives == nil {
159165 u.DisableKeepAlives = ptr.To(DefaultUpstreamDisableKeepAlives)
160166 }
167+
168+ // Force defaults compatible with static upstreams.
169+ // This overrides any user provided values to ensure static upstreams behave correctly.
170+ if ptr.Deref(u.Static, DefaultUpstreamStatic) {
171+ u.URI = ""
172+ u.InsecureSkipTLSVerify = ptr.To(DefaultUpsteamInsecureSkipTLSVerify)
173+ u.DisableKeepAlives = ptr.To(DefaultUpstreamDisableKeepAlives)
174+ u.PassHostHeader = ptr.To(DefaultStaticPassHostHeader)
175+ u.ProxyWebSockets = ptr.To(DefaultStaticProxyWebSockets)
176+ u.FlushInterval = ptr.To(DefaultUpstreamFlushInterval)
177+ u.Timeout = ptr.To(DefaultUpstreamTimeout)
178+ }
161179}
pkg/validation/upstreams.go+3−3
@@ -70,13 +70,13 @@ func validateStaticUpstream(upstream options.Upstream) []string {
7070 if ptr.Deref(upstream.InsecureSkipTLSVerify, options.DefaultUpsteamInsecureSkipTLSVerify) {
7171 msgs = append(msgs, fmt.Sprintf("upstream %q has insecureSkipTLSVerify, but is a static upstream, this will have no effect.", upstream.ID))
7272 }
73− if upstream.FlushInterval != nil && *upstream.FlushInterval != options.DefaultUpstreamFlushInterval {
73+ if ptr.Deref(upstream.FlushInterval, options.DefaultUpstreamFlushInterval) != options.DefaultUpstreamFlushInterval {
7474 msgs = append(msgs, fmt.Sprintf("upstream %q has flushInterval, but is a static upstream, this will have no effect.", upstream.ID))
7575 }
76− if upstream.PassHostHeader != nil {
76+ if ptr.Deref(upstream.PassHostHeader, options.DefaultStaticPassHostHeader) != options.DefaultStaticPassHostHeader {
7777 msgs = append(msgs, fmt.Sprintf("upstream %q has passHostHeader, but is a static upstream, this will have no effect.", upstream.ID))
7878 }
79− if upstream.ProxyWebSockets != nil {
79+ if ptr.Deref(upstream.ProxyWebSockets, options.DefaultStaticProxyWebSockets) != options.DefaultStaticProxyWebSockets {
8080 msgs = append(msgs, fmt.Sprintf("upstream %q has proxyWebSockets, but is a static upstream, this will have no effect.", upstream.ID))
8181 }
8282
pkg/validation/upstreams_test.go+19−1
@@ -138,7 +138,7 @@ var _ = Describe("Upstreams", func() {
138138 },
139139 errStrings: []string{invalidURISchemeMsg},
140140 }),
141− Entry("with a static upstream and invalid optons", &validateUpstreamTableInput{
141+ Entry("with a static upstream and invalid options", &validateUpstreamTableInput{
142142 upstreams: options.UpstreamConfig{
143143 Upstreams: []options.Upstream{
144144 {
@@ -161,6 +161,24 @@ var _ = Describe("Upstreams", func() {
161161 staticWithProxyWebSocketsMsg,
162162 },
163163 }),
164+ Entry("with a static upstream and sane default options", &validateUpstreamTableInput{
165+ upstreams: options.UpstreamConfig{
166+ Upstreams: []options.Upstream{
167+ {
168+ ID: "foo",
169+ Path: "/foo",
170+ URI: "ftp://foo",
171+ Static: ptr.To(true),
172+ PassHostHeader: ptr.To(false),
173+ ProxyWebSockets: ptr.To(false),
174+ InsecureSkipTLSVerify: ptr.To(false),
175+ },
176+ },
177+ },
178+ errStrings: []string{
179+ staticWithURIMsg,
180+ },
181+ }),
164182 Entry("with duplicate IDs", &validateUpstreamTableInput{
165183 upstreams: options.UpstreamConfig{
166184 Upstreams: []options.Upstream{