5d0827a · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Add configuration for cookie 'SameSite' value.

Values of 'lax' and 'strict' can improve and mitigate some categories of cross-site traffic tampering. Given that the nature of this proxy is often to proxy private tools, this is useful to take advantage of. See: https://www.owasp.org/index.php/SameSite

commit5d0827a028bf543c8dbd40ddfcdf2697d5c93b70 authorPaul Groudas <paul@clubhouse.io> dateMon 16 Dec 2019, 13:10 (7 years ago) parent90f8117

8 files changed+45−6

compare with master

unifiedsplit

contrib/oauth2_proxy_autocomplete.sh+1−1 docs/configuration/configuration.md+1 main.go+1 oauthproxy.go+5−1 options.go+6 pkg/apis/options/cookie.go+1 pkg/cookies/cookies.go+20−2 pkg/sessions/session_store_test.go+10−2

contrib/oauth2_proxy_autocomplete.sh+1−1

@@ -20,7 +20,7 @@ _oauth2_proxy() {

2020 COMPREPLY=( $(compgen -W "google azure facebook github keycloak gitlab linkedin login.gov" -- ${cur}) )

2121 return 0

2222 ;;

2424 return 0

2525 ;;

2626 esac

docs/configuration/configuration.md+1

@@ -38,6 +38,7 @@ An example [oauth2_proxy.cfg]({{ site.gitweb }}/contrib/oauth2_proxy.cfg.example

main.go+1

@@ -86,6 +86,7 @@ func main() {

8686 flagSet.Duration("cookie-refresh", time.Duration(0), "refresh the cookie after this duration; 0 to disable")

8787 flagSet.Bool("cookie-secure", true, "set secure (HTTPS) cookie flag")

8888 flagSet.Bool("cookie-httponly", true, "set HttpOnly cookie flag")

89+ flagSet.String("cookie-samesite", "", "set SameSite cookie attribute (ie: \"lax\", \"strict\", \"none\", or \"\"). ")

8990

9091 flagSet.String("session-store-type", "cookie", "the session storage provider to use")

9192 flagSet.String("redis-connection-url", "", "URL of redis server for redis session storage (eg: redis://HOST[:PORT])")

oauthproxy.go+5−1

@@ -20,6 +20,7 @@ import (

2020 "github.com/coreos/go-oidc"

2121 "github.com/mbland/hmacauth"

2222 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

23+ "github.com/pusher/oauth2_proxy/pkg/cookies"

2324 "github.com/pusher/oauth2_proxy/pkg/encryption"

2425 "github.com/pusher/oauth2_proxy/pkg/logger"

2526 "github.com/pusher/oauth2_proxy/providers"

@@ -68,6 +69,7 @@ type OAuthProxy struct {

6869 CookieHTTPOnly bool

6970 CookieExpire time.Duration

7071 CookieRefresh time.Duration

72+ CookieSameSite string

7173 Validator func(string) bool

7274

7375 RobotsPath string

@@ -260,7 +262,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

260262 refresh = fmt.Sprintf("after %s", opts.CookieRefresh)

261263 }

262264

263− logger.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domain:%s path:%s refresh:%s", opts.CookieName, opts.CookieSecure, opts.CookieHTTPOnly, opts.CookieExpire, opts.CookieDomain, opts.CookiePath, refresh)

265+ logger.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domain:%s path:%s samesite:%s refresh:%s", opts.CookieName, opts.CookieSecure, opts.CookieHTTPOnly, opts.CookieExpire, opts.CookieDomain, opts.CookiePath, opts.CookieSameSite, refresh)

264266

265267 return &OAuthProxy{

266268 CookieName: opts.CookieName,

@@ -272,6 +274,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

272274 CookieHTTPOnly: opts.CookieHTTPOnly,

273275 CookieExpire: opts.CookieExpire,

274276 CookieRefresh: opts.CookieRefresh,

277+ CookieSameSite: opts.CookieSameSite,

275278 Validator: validator,

276279

277280 RobotsPath: "/robots.txt",

@@ -380,6 +383,7 @@ func (p *OAuthProxy) makeCookie(req *http.Request, name string, value string, ex

380383 HttpOnly: p.CookieHTTPOnly,

381384 Secure: p.CookieSecure,

382385 Expires: now.Add(expiration),

386+ SameSite: cookies.ParseSameSite(p.CookieSameSite),

383387 }

384388}

385389

options.go+6

@@ -372,6 +372,12 @@ func (o *Options) Validate() error {

372372 }

373373 }

374374

375+ switch o.CookieSameSite {

376+ case "", "none", "lax", "strict":

377+ default:

378+ msgs = append(msgs, fmt.Sprintf("cookie_samesite (%s) must be one of ['', 'lax', 'strict', 'none']", o.CookieSameSite))

379+ }

380+

375381 msgs = parseSignatureKey(o, msgs)

376382 msgs = validateCookieName(o, msgs)

377383 msgs = setupLogger(o, msgs)

pkg/apis/options/cookie.go+1

@@ -12,4 +12,5 @@ type CookieOptions struct {

1212 CookieRefresh time.Duration `flag:"cookie-refresh" cfg:"cookie_refresh" env:"OAUTH2_PROXY_COOKIE_REFRESH"`

1313 CookieSecure bool `flag:"cookie-secure" cfg:"cookie_secure" env:"OAUTH2_PROXY_COOKIE_SECURE"`

1414 CookieHTTPOnly bool `flag:"cookie-httponly" cfg:"cookie_httponly" env:"OAUTH2_PROXY_COOKIE_HTTPONLY"`

15+ CookieSameSite string `flag:"cookie-samesite" cfg:"cookie_samesite" env:"OAUTH2_PROXY_COOKIE_SAMESITE"`

1516}

pkg/cookies/cookies.go+20−2

@@ -1,6 +1,7 @@

11package cookies

33import (

4+ "fmt"

45 "net"

56 "net/http"

67 "strings"

@@ -12,7 +13,7 @@ import (

1213

1314// MakeCookie constructs a cookie from the given parameters,

1415// discovering the domain from the request if not specified.

15−func MakeCookie(req *http.Request, name string, value string, path string, domain string, httpOnly bool, secure bool, expiration time.Duration, now time.Time) *http.Cookie {

16+func MakeCookie(req *http.Request, name string, value string, path string, domain string, httpOnly bool, secure bool, expiration time.Duration, now time.Time, sameSite http.SameSite) *http.Cookie {

1617 if domain != "" {

1718 host := req.Host

1819 if h, _, err := net.SplitHostPort(host); err == nil {

@@ -31,11 +32,28 @@ func MakeCookie(req *http.Request, name string, value string, path string, domai

3132 HttpOnly: httpOnly,

3233 Secure: secure,

3334 Expires: now.Add(expiration),

35+ SameSite: sameSite,

3436 }

3537}

3638

3739// MakeCookieFromOptions constructs a cookie based on the given *options.CookieOptions,

3840// value and creation time

3941func MakeCookieFromOptions(req *http.Request, name string, value string, opts *options.CookieOptions, expiration time.Duration, now time.Time) *http.Cookie {

40− return MakeCookie(req, name, value, opts.CookiePath, opts.CookieDomain, opts.CookieHTTPOnly, opts.CookieSecure, expiration, now)

42+ return MakeCookie(req, name, value, opts.CookiePath, opts.CookieDomain, opts.CookieHTTPOnly, opts.CookieSecure, expiration, now, ParseSameSite(opts.CookieSameSite))

43+}

44+

45+// Parse a valid http.SameSite value from a user supplied string for use of making cookies.

46+func ParseSameSite(v string) http.SameSite {

47+ switch v {

48+ case "lax":

49+ return http.SameSiteLaxMode

50+ case "strict":

51+ return http.SameSiteStrictMode

52+ case "none":

53+ return http.SameSiteNoneMode

54+ case "":

55+ return http.SameSiteDefaultMode

56+ default:

57+ panic(fmt.Sprintf("Invalid value for SameSite: %s", v))

58+ }

4159}

pkg/sessions/session_store_test.go+10−2

@@ -15,7 +15,7 @@ import (

1515 . "github.com/onsi/gomega"

1616 "github.com/pusher/oauth2_proxy/pkg/apis/options"

1717 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

18− "github.com/pusher/oauth2_proxy/pkg/cookies"

18+ cookiesapi "github.com/pusher/oauth2_proxy/pkg/cookies"

1919 "github.com/pusher/oauth2_proxy/pkg/encryption"

2020 "github.com/pusher/oauth2_proxy/pkg/sessions"

2121 sessionscookie "github.com/pusher/oauth2_proxy/pkg/sessions/cookie"

@@ -79,6 +79,12 @@ var _ = Describe("NewSessionStore", func() {

7979 }

8080 })

8181

82+ It("have the correct SameSite set", func() {

83+ for _, cookie := range cookies {

84+ Expect(cookie.SameSite).To(Equal(cookiesapi.ParseSameSite(cookieOpts.CookieSameSite)))

85+ }

86+ })

87+

8288 It("have a signature timestamp matching session.CreatedAt", func() {

8389 for _, cookie := range cookies {

8490 if cookie.Value != "" {

@@ -159,7 +165,7 @@ var _ = Describe("NewSessionStore", func() {

159165 By("Using a valid cookie with a different providers session encoding")

160166 broken := "BrokenSessionFromADifferentSessionImplementation"

161167 value := encryption.SignedValue(cookieOpts.CookieSecret, cookieOpts.CookieName, broken, time.Now())

162− cookie := cookies.MakeCookieFromOptions(request, cookieOpts.CookieName, value, cookieOpts, cookieOpts.CookieExpire, time.Now())

168+ cookie := cookiesapi.MakeCookieFromOptions(request, cookieOpts.CookieName, value, cookieOpts, cookieOpts.CookieExpire, time.Now())

163169 request.AddCookie(cookie)

164170

165171 err := ss.Save(response, request, session)

@@ -338,6 +344,7 @@ var _ = Describe("NewSessionStore", func() {

338344 CookieSecure: false,

339345 CookieHTTPOnly: false,

340346 CookieDomain: "example.com",

347+ CookieSameSite: "strict",

341348 }

342349

343350 var err error

@@ -379,6 +386,7 @@ var _ = Describe("NewSessionStore", func() {

379386 CookieRefresh: time.Duration(1) * time.Hour,

380387 CookieSecure: true,

381388 CookieHTTPOnly: true,

389+ CookieSameSite: "",

382390 }

383391

384392 session = &sessionsapi.SessionState{