@@ -22,6 +22,7 @@ import (
2222 "github.com/mbland/hmacauth"
2323 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"
2424 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
25+ "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"
2526 "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"
2627 "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/cookie"
2728 "github.com/oauth2-proxy/oauth2-proxy/pkg/validation"
@@ -35,7 +36,7 @@ const (
3536 // The rawCookieSecret is 32 bytes and the base64CookieSecret is the base64
3637 // encoded version of this.
3738 rawCookieSecret = "secretthirtytwobytes+abcdefghijk"
38− base64CookieSecret = "c2VjcmV0dGhpcnR5dHdvYnl0ZXMrYWJjZGVmZ2hpamsK"
39+ base64CookieSecret = "c2VjcmV0dGhpcnR5dHdvYnl0ZXMrYWJjZGVmZ2hpams"
3940)
4041
4142func init() {
@@ -82,10 +83,10 @@ func TestWebSocketProxy(t *testing.T) {
8283
8384 backendURL, _ := url.Parse(backend.URL)
8485
85− options := options.NewOptions()
86+ opts := baseTestOptions()
8687 var auth hmacauth.HmacAuth
87− options.PassHostHeader = true
88− proxyHandler := NewWebSocketOrRestReverseProxy(backendURL, options, auth)
88+ opts.PassHostHeader = true
89+ proxyHandler := NewWebSocketOrRestReverseProxy(backendURL, opts, auth)
8990 frontend := httptest.NewServer(proxyHandler)
9091 defer frontend.Close()
9192
@@ -172,13 +173,14 @@ func TestEncodedSlashes(t *testing.T) {
172173}
173174
174175func TestRobotsTxt(t *testing.T) {
175− opts := options.NewOptions()
176+ opts := baseTestOptions()
176177 opts.ClientID = "asdlkjx"
177178 opts.ClientSecret = "alkgks"
178179 opts.Cookie.Secret = rawCookieSecret
179180 validation.Validate(opts)
180181
181− proxy := NewOAuthProxy(opts, func(string) bool { return true })
182+ proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
183+ assert.NoError(t, err)
182184 rw := httptest.NewRecorder()
183185 req, _ := http.NewRequest("GET", "/robots.txt", nil)
184186 proxy.ServeHTTP(rw, req)
@@ -187,7 +189,7 @@ func TestRobotsTxt(t *testing.T) {
187189}
188190
189191func TestIsValidRedirect(t *testing.T) {
190− opts := options.NewOptions()
192+ opts := baseTestOptions()
191193 opts.ClientID = "skdlfj"
192194 opts.ClientSecret = "fgkdsgj"
193195 opts.Cookie.Secret = base64CookieSecret
@@ -202,7 +204,8 @@ func TestIsValidRedirect(t *testing.T) {
202204 }
203205 validation.Validate(opts)
204206
205− proxy := NewOAuthProxy(opts, func(string) bool { return true })
207+ proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
208+ assert.NoError(t, err)
206209
207210 testCases := []struct {
208211 Desc, Redirect string
@@ -453,11 +456,10 @@ func TestOpenRedirects(t *testing.T) {
453456 "www.whitelisteddomain.tld",
454457 }
455458 err := validation.Validate(opts)
456− if err != nil {
457− t.Fatal(err)
458− }
459+ assert.NoError(t, err)
459460
460− proxy := NewOAuthProxy(opts, func(string) bool { return true })
461+ proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
462+ assert.NoError(t, err)
461463
462464 file, err := os.Open("./test/openredirects.txt")
463465 if err != nil {
@@ -545,7 +547,7 @@ func TestBasicAuthPassword(t *testing.T) {
545547 w.WriteHeader(200)
546548 w.Write([]byte(payload))
547549 }))
548− opts := options.NewOptions()
550+ opts := baseTestOptions()
549551 opts.Upstreams = append(opts.Upstreams, providerServer.URL)
550552 // The CookieSecret must be 32 bytes in order to create the AES
551553 // cipher.
@@ -564,9 +566,10 @@ func TestBasicAuthPassword(t *testing.T) {
564566 const emailAddress = "john.doe@example.com"
565567
566568 opts.SetProvider(NewTestProvider(providerURL, emailAddress))
567− proxy := NewOAuthProxy(opts, func(email string) bool {
569+ proxy, err := NewOAuthProxy(opts, func(email string) bool {
568570 return email == emailAddress
569571 })
572+ assert.NoError(t, err)
570573
571574 rw := httptest.NewRecorder()
572575 req, _ := http.NewRequest("GET", "/oauth2/callback?code=callback_code&state=nonce:", strings.NewReader(""))
@@ -611,11 +614,12 @@ func TestBasicAuthPassword(t *testing.T) {
611614}
612615
613616func TestBasicAuthWithEmail(t *testing.T) {
614− opts := options.NewOptions()
617+ opts := baseTestOptions()
615618 opts.PassBasicAuth = true
616619 opts.PassUserHeaders = false
617620 opts.PreferEmailToUser = false
618621 opts.BasicAuthPassword = "This is a secure password"
622+ opts.Cookie.Secret = rawCookieSecret
619623 validation.Validate(opts)
620624
621625 const emailAddress = "john.doe@example.com"
@@ -635,9 +639,10 @@ func TestBasicAuthWithEmail(t *testing.T) {
635639 {
636640 rw := httptest.NewRecorder()
637641 req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase0", nil)
638− proxy := NewOAuthProxy(opts, func(email string) bool {
642+ proxy, err := NewOAuthProxy(opts, func(email string) bool {
639643 return email == emailAddress
640644 })
645+ assert.NoError(t, err)
641646 proxy.addHeadersForProxying(rw, req, session)
642647 assert.Equal(t, expectedUserHeader, req.Header["Authorization"][0])
643648 assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
@@ -648,9 +653,10 @@ func TestBasicAuthWithEmail(t *testing.T) {
648653 rw := httptest.NewRecorder()
649654 req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase1", nil)
650655
651− proxy := NewOAuthProxy(opts, func(email string) bool {
656+ proxy, err := NewOAuthProxy(opts, func(email string) bool {
652657 return email == emailAddress
653658 })
659+ assert.NoError(t, err)
654660 proxy.addHeadersForProxying(rw, req, session)
655661 assert.Equal(t, expectedEmailHeader, req.Header["Authorization"][0])
656662 assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
@@ -658,10 +664,11 @@ func TestBasicAuthWithEmail(t *testing.T) {
658664}
659665
660666func TestPassUserHeadersWithEmail(t *testing.T) {
661− opts := options.NewOptions()
667+ opts := baseTestOptions()
662668 opts.PassBasicAuth = false
663669 opts.PassUserHeaders = true
664670 opts.PreferEmailToUser = false
671+ opts.Cookie.Secret = base64CookieSecret
665672 validation.Validate(opts)
666673
667674 const emailAddress = "john.doe@example.com"
@@ -677,9 +684,10 @@ func TestPassUserHeadersWithEmail(t *testing.T) {
677684 {
678685 rw := httptest.NewRecorder()
679686 req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase0", nil)
680− proxy := NewOAuthProxy(opts, func(email string) bool {
687+ proxy, err := NewOAuthProxy(opts, func(email string) bool {
681688 return email == emailAddress
682689 })
690+ assert.NoError(t, err)
683691 proxy.addHeadersForProxying(rw, req, session)
684692 assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
685693 }
@@ -689,9 +697,10 @@ func TestPassUserHeadersWithEmail(t *testing.T) {
689697 rw := httptest.NewRecorder()
690698 req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase1", nil)
691699
692− proxy := NewOAuthProxy(opts, func(email string) bool {
700+ proxy, err := NewOAuthProxy(opts, func(email string) bool {
693701 return email == emailAddress
694702 })
703+ assert.NoError(t, err)
695704 proxy.addHeadersForProxying(rw, req, session)
696705 assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
697706 }
@@ -727,7 +736,7 @@ func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTes
727736 w.Write([]byte(payload))
728737 }))
729738
730− t.opts = options.NewOptions()
739+ t.opts = baseTestOptions()
731740 t.opts.Upstreams = append(t.opts.Upstreams, t.providerServer.URL)
732741 if opts.ProxyUpstream != "" {
733742 t.opts.Upstreams = append(t.opts.Upstreams, opts.ProxyUpstream)
@@ -745,9 +754,13 @@ func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTes
745754 const emailAddress = "michael.bland@gsa.gov"
746755
747756 t.opts.SetProvider(NewTestProvider(providerURL, emailAddress))
748− t.proxy = NewOAuthProxy(t.opts, func(email string) bool {
757+ var err error
758+ t.proxy, err = NewOAuthProxy(t.opts, func(email string) bool {
749759 return email == emailAddress
750760 })
761+ if err != nil {
762+ panic(err)
763+ }
751764 return t
752765}
753766
@@ -886,16 +899,20 @@ const signInSkipProvider = `>Found<`
886899func NewSignInPageTest(skipProvider bool) *SignInPageTest {
887900 var sipTest SignInPageTest
888901
889− sipTest.opts = options.NewOptions()
902+ sipTest.opts = baseTestOptions()
890903 sipTest.opts.Cookie.Secret = rawCookieSecret
891904 sipTest.opts.ClientID = "lkdgj"
892905 sipTest.opts.ClientSecret = "sgiufgoi"
893906 sipTest.opts.SkipProviderButton = skipProvider
894907 validation.Validate(sipTest.opts)
895908
896− sipTest.proxy = NewOAuthProxy(sipTest.opts, func(email string) bool {
909+ var err error
910+ sipTest.proxy, err = NewOAuthProxy(sipTest.opts, func(email string) bool {
897911 return true
898912 })
913+ if err != nil {
914+ panic(err)
915+ }
899916 sipTest.signInRegexp = regexp.MustCompile(signInRedirectPattern)
900917 sipTest.signInProviderRegexp = regexp.MustCompile(signInSkipProvider)
901918
@@ -987,7 +1004,7 @@ type OptionsModifier func(*options.Options)
9871004func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifier) *ProcessCookieTest {
9881005 var pcTest ProcessCookieTest
9891006
990− pcTest.opts = options.NewOptions()
1007+ pcTest.opts = baseTestOptions()
9911008 for _, modifier := range modifiers {
9921009 modifier(pcTest.opts)
9931010 }
@@ -999,9 +1016,13 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifi
9991016 pcTest.opts.Cookie.Refresh = time.Hour
10001017 validation.Validate(pcTest.opts)
10011018
1002− pcTest.proxy = NewOAuthProxy(pcTest.opts, func(email string) bool {
1019+ var err error
1020+ pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
10031021 return pcTest.validateUser
10041022 })
1023+ if err != nil {
1024+ panic(err)
1025+ }
10051026 pcTest.proxy.provider = &TestProvider{
10061027 ValidToken: opts.providerValidateCookieResponse,
10071028 }
@@ -1201,13 +1222,19 @@ func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {
12011222func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
12021223 var pcTest ProcessCookieTest
12031224
1204− pcTest.opts = options.NewOptions()
1225+ pcTest.opts = baseTestOptions()
12051226 pcTest.opts.SetXAuthRequest = true
1206− validation.Validate(pcTest.opts)
1227+ err := validation.Validate(pcTest.opts)
1228+ if err != nil {
1229+ panic(err)
1230+ }
12071231
1208− pcTest.proxy = NewOAuthProxy(pcTest.opts, func(email string) bool {
1232+ pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
12091233 return pcTest.validateUser
12101234 })
1235+ if err != nil {
1236+ panic(err)
1237+ }
12111238 pcTest.proxy.provider = &TestProvider{
12121239 ValidToken: true,
12131240 }
@@ -1232,14 +1259,18 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
12321259func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
12331260 var pcTest ProcessCookieTest
12341261
1235− pcTest.opts = options.NewOptions()
1262+ pcTest.opts = baseTestOptions()
12361263 pcTest.opts.SetXAuthRequest = true
12371264 pcTest.opts.SetBasicAuth = true
12381265 validation.Validate(pcTest.opts)
12391266
1240− pcTest.proxy = NewOAuthProxy(pcTest.opts, func(email string) bool {
1267+ var err error
1268+ pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
12411269 return pcTest.validateUser
12421270 })
1271+ if err != nil {
1272+ panic(err)
1273+ }
12431274 pcTest.proxy.provider = &TestProvider{
12441275 ValidToken: true,
12451276 }
@@ -1266,14 +1297,18 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
12661297func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
12671298 var pcTest ProcessCookieTest
12681299
1269− pcTest.opts = options.NewOptions()
1300+ pcTest.opts = baseTestOptions()
12701301 pcTest.opts.SetXAuthRequest = true
12711302 pcTest.opts.SetBasicAuth = false
12721303 validation.Validate(pcTest.opts)
12731304
1274− pcTest.proxy = NewOAuthProxy(pcTest.opts, func(email string) bool {
1305+ var err error
1306+ pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
12751307 return pcTest.validateUser
12761308 })
1309+ if err != nil {
1310+ panic(err)
1311+ }
12771312 pcTest.proxy.provider = &TestProvider{
12781313 ValidToken: true,
12791314 }
@@ -1303,18 +1338,16 @@ func TestAuthSkippedForPreflightRequests(t *testing.T) {
13031338 }))
13041339 defer upstream.Close()
13051340
1306− opts := options.NewOptions()
1341+ opts := baseTestOptions()
13071342 opts.Upstreams = append(opts.Upstreams, upstream.URL)
1308− opts.ClientID = "aljsal"
1309− opts.ClientSecret = "jglkfsdgj"
1310− opts.Cookie.Secret = base64CookieSecret
13111343 opts.SkipAuthPreflight = true
13121344 validation.Validate(opts)
13131345
13141346 upstreamURL, _ := url.Parse(upstream.URL)
13151347 opts.SetProvider(NewTestProvider(upstreamURL, ""))
13161348
1317− proxy := NewOAuthProxy(opts, func(string) bool { return false })
1349+ proxy, err := NewOAuthProxy(opts, func(string) bool { return false })
1350+ assert.NoError(t, err)
13181351 rw := httptest.NewRecorder()
13191352 req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)
13201353 proxy.ServeHTTP(rw, req)
@@ -1353,7 +1386,7 @@ type SignatureTest struct {
13531386}
13541387
13551388func NewSignatureTest() *SignatureTest {
1356− opts := options.NewOptions()
1389+ opts := baseTestOptions()
13571390 opts.Cookie.Secret = rawCookieSecret
13581391 opts.ClientID = "client ID"
13591392 opts.ClientSecret = "client secret"
@@ -1409,7 +1442,10 @@ func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) {
14091442 if err != nil {
14101443 panic(err)
14111444 }
1412− proxy := NewOAuthProxy(st.opts, func(email string) bool { return true })
1445+ proxy, err := NewOAuthProxy(st.opts, func(email string) bool { return true })
1446+ if err != nil {
1447+ panic(err)
1448+ }
14131449
14141450 var bodyBuf io.ReadCloser
14151451 if body != "" {
@@ -1461,10 +1497,12 @@ func TestRequestSignaturePostRequest(t *testing.T) {
14611497}
14621498
14631499func TestGetRedirect(t *testing.T) {
1464− options := options.NewOptions()
1465− _ = validation.Validate(options)
1466− require.NotEmpty(t, options.ProxyPrefix)
1467− proxy := NewOAuthProxy(options, func(s string) bool { return false })
1500+ opts := baseTestOptions()
1501+ err := validation.Validate(opts)
1502+ assert.NoError(t, err)
1503+ require.NotEmpty(t, opts.ProxyPrefix)
1504+ proxy, err := NewOAuthProxy(opts, func(s string) bool { return false })
1505+ assert.NoError(t, err)
14681506
14691507 tests := []struct {
14701508 name string
@@ -1500,14 +1538,19 @@ type ajaxRequestTest struct {
15001538
15011539func newAjaxRequestTest() *ajaxRequestTest {
15021540 test := &ajaxRequestTest{}
1503− test.opts = options.NewOptions()
1541+ test.opts = baseTestOptions()
15041542 test.opts.Cookie.Secret = base64CookieSecret
15051543 test.opts.ClientID = "gkljfdl"
15061544 test.opts.ClientSecret = "sdflkjs"
15071545 validation.Validate(test.opts)
1508− test.proxy = NewOAuthProxy(test.opts, func(email string) bool {
1546+
1547+ var err error
1548+ test.proxy, err = NewOAuthProxy(test.opts, func(email string) bool {
15091549 return true
15101550 })
1551+ if err != nil {
1552+ panic(err)
1553+ }
15111554 return test
15121555}
15131556
@@ -1558,11 +1601,14 @@ func TestAjaxForbiddendRequest(t *testing.T) {
15581601}
15591602
15601603func TestClearSplitCookie(t *testing.T) {
1561− opts := options.NewOptions()
1604+ opts := baseTestOptions()
1605+ opts.Cookie.Secret = base64CookieSecret
15621606 opts.Cookie.Name = "oauth2"
15631607 opts.Cookie.Domains = []string{"abc"}
1564− store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
1565− assert.Equal(t, err, nil)
1608+ cipher, err := encryption.NewBase64Cipher(encryption.NewCFBCipher, encryption.SecretBytes(opts.Cookie.Secret))
1609+ assert.Equal(t, nil, err)
1610+ store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie, cipher)
1611+ assert.Equal(t, nil, err)
15661612 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}
15671613 var rw = httptest.NewRecorder()
15681614 req := httptest.NewRequest("get", "/", nil)
@@ -1587,11 +1633,13 @@ func TestClearSplitCookie(t *testing.T) {
15871633}
15881634
15891635func TestClearSingleCookie(t *testing.T) {
1590− opts := options.NewOptions()
1636+ opts := baseTestOptions()
15911637 opts.Cookie.Name = "oauth2"
15921638 opts.Cookie.Domains = []string{"abc"}
1593− store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
1594− assert.Equal(t, err, nil)
1639+ cipher, err := encryption.NewBase64Cipher(encryption.NewCFBCipher, encryption.SecretBytes(opts.Cookie.Secret))
1640+ assert.Equal(t, nil, err)
1641+ store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie, cipher)
1642+ assert.Equal(t, nil, err)
15951643 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}
15961644 var rw = httptest.NewRecorder()
15971645 req := httptest.NewRequest("get", "/", nil)
@@ -1768,13 +1816,14 @@ func Test_noCacheHeadersDoesNotExistsInResponseHeadersFromUpstream(t *testing.T)
17681816 }))
17691817 t.Cleanup(upstream.Close)
17701818
1771− opts := options.NewOptions()
1819+ opts := baseTestOptions()
17721820 opts.Upstreams = []string{upstream.URL}
17731821 opts.SkipAuthRegex = []string{".*"}
17741822 _ = validation.Validate(opts)
1775− proxy := NewOAuthProxy(opts, func(email string) bool {
1823+ proxy, err := NewOAuthProxy(opts, func(email string) bool {
17761824 return true
17771825 })
1826+ assert.NoError(t, err)
17781827
17791828 rec := httptest.NewRecorder()
17801829 req := httptest.NewRequest(http.MethodGet, "/upstream", nil)
@@ -1788,3 +1837,12 @@ func Test_noCacheHeadersDoesNotExistsInResponseHeadersFromUpstream(t *testing.T)
17881837 assert.Equal(t, "", rec.Header().Get(k))
17891838 }
17901839}
1840+
1841+func baseTestOptions() *options.Options {
1842+ opts := options.NewOptions()
1843+ opts.Cookie.Secret = rawCookieSecret
1844+ opts.ClientID = "cliend-id"
1845+ opts.ClientSecret = "client-secret"
1846+ opts.EmailDomains = []string{"*"}
1847+ return opts
1848+}