5f8f856 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Remove failed bearer tokens from logs

commit5f8f8562602969701b604980289a87977e0e4c5f authorNick Meves <nick.meves@greenhouse.io> dateThu 26 Nov 2020, 11:47 (6 years ago) parent22f60e9

2 files changed+10−8

compare with master

unifiedsplit

pkg/middleware/jwt_session.go+8−6 pkg/middleware/jwt_session_test.go+2−2

pkg/middleware/jwt_session.go+8−6

@@ -1,6 +1,7 @@

11package middleware

33import (

4+ "errors"

45 "fmt"

56 "net/http"

67 "regexp"

@@ -9,7 +10,7 @@ import (

910 middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"

1011 sessionsapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

1112 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

12− "k8s.io/apimachinery/pkg/util/errors"

13+ k8serrors "k8s.io/apimachinery/pkg/util/errors"

1314)

1415

1516const jwtRegexFormat = `^ey[IJ][a-zA-Z0-9_-]*\.ey[IJ][a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+$`

@@ -70,17 +71,18 @@ func (j *jwtSessionLoader) getJwtSession(req *http.Request) (*sessionsapi.Sessio

7071 return nil, err

7172 }

7273

73− errs := []error{fmt.Errorf("unable to verify jwt token: %q", req.Header.Get("Authorization"))}

74+ // This leading error message only occurs if all session loaders fail

75+ errs := []error{errors.New("unable to verify bearer token")}

7476 for _, loader := range j.sessionLoaders {

7577 session, err := loader(req.Context(), token)

76− if err == nil {

77− return session, nil

78− } else {

78+ if err != nil {

7979 errs = append(errs, err)

80+ continue

8081 }

82+ return session, nil

8183 }

8284

83− return nil, errors.NewAggregate(errs)

85+ return nil, k8serrors.NewAggregate(errs)

8486}

8587

8688// findTokenFromHeader finds a valid JWT token from the Authorization header of a given request.

pkg/middleware/jwt_session_test.go+2−2

@@ -225,7 +225,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`

225225 Entry("Bearer <nonVerifiedToken>", getJWTSessionTableInput{

226226 authorizationHeader: fmt.Sprintf("Bearer %s", nonVerifiedToken),

227227 expectedErr: k8serrors.NewAggregate([]error{

228− errors.New("unable to verify jwt token: \"Bearer eyJfoobar.eyJfoobar.12345asdf\""),

228+ errors.New("unable to verify bearer token"),

229229 errors.New("oidc: malformed jwt: illegal base64 data at input byte 8"),

230230 }),

231231 expectedSession: nil,

@@ -238,7 +238,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`

238238 Entry("Basic Base64(<nonVerifiedToken>:) (No password)", getJWTSessionTableInput{

239239 authorizationHeader: "Basic ZXlKZm9vYmFyLmV5SmZvb2Jhci4xMjM0NWFzZGY6",

240240 expectedErr: k8serrors.NewAggregate([]error{

241− errors.New("unable to verify jwt token: \"Basic ZXlKZm9vYmFyLmV5SmZvb2Jhci4xMjM0NWFzZGY6\""),

241+ errors.New("unable to verify bearer token"),

242242 errors.New("oidc: malformed jwt: illegal base64 data at input byte 8"),

243243 }),

244244 expectedSession: nil,