git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #285 from jmickey/Issue#259-RedirectToHTTPS

Redirect to HTTPS

commit6b8d2bdcc3b5abd61e73001a682d28b1193d1e21 authorJoel Speed <Joel.speed@hotmail.co.uk> dateTue 22 Oct 2019, 14:46 (7 years ago) parent9d0a0c7c0bfe03
6 files changed+68−2
CHANGELOG.md+1 docs/configuration/configuration.md+1 http.go+11 http_test.go+50 main.go+3−2 options.go+2
CHANGELOG.md+1
@@ -3,6 +3,7 @@
33## Changes since v4.0.0
44
55- [#227](https://github.com/pusher/oauth2_proxy/pull/227) Add Keycloak provider (@Ofinka)
6+- [#259](https://github.com/pusher/oauth2_proxy/pull/259) Redirect to HTTPS (@jmickey)
67- [#273](https://github.com/pusher/oauth2_proxy/pull/273) Support Go 1.13 (@dio)
78- [#275](https://github.com/pusher/oauth2_proxy/pull/275) docker: build from debian buster (@syscll)
89- [#258](https://github.com/pusher/oauth2_proxy/pull/258) Add IDToken for Azure provider
docs/configuration/configuration.md+1
@@ -44,6 +44,7 @@ An example [oauth2_proxy.cfg]({{ site.gitweb }}/contrib/oauth2_proxy.cfg.example
4444| `-extra-jwt-issuers` | string | if `-skip-jwt-bearer-tokens` is set, a list of extra JWT `issuer=audience` pairs (where the issuer URL has a `.well-known/openid-configuration` or a `.well-known/jwks.json`) | |
4545| `-exclude-logging-paths` | string | comma separated list of paths to exclude from logging, eg: `"/ping,/path2"` |`""` (no paths excluded) |
4646| `-flush-interval` | duration | period between flushing response buffers when streaming responses | `"1s"` |
47+| `-force-https` | bool | enforce https redirect | `false` |
4748| `-banner` | string | custom banner string. Use `"-"` to disable default banner. | |
4849| `-footer` | string | custom footer string. Use `"-"` to disable default footer. | |
4950| `-gcp-healthchecks` | bool | will enable `/liveness_check`, `/readiness_check`, and `/` (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses | false |
http.go+11
@@ -152,3 +152,14 @@ func (ln tcpKeepAliveListener) Accept() (c net.Conn, err error) {
152152 tc.SetKeepAlivePeriod(3 * time.Minute)
153153 return tc, nil
154154}
155+
156+func redirectToHTTPS(opts *Options, h http.Handler) http.Handler {
157+ return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
158+ proto := r.Header.Get("X-Forwarded-Proto")
159+ if opts.ForceHTTPS && (r.TLS == nil || (proto != "" && strings.ToLower(proto) != "https")) {
160+ http.Redirect(w, r, opts.HTTPSAddress, http.StatusPermanentRedirect)
161+ }
162+
163+ h.ServeHTTP(w, r)
164+ })
165+}
http_test.go+50
@@ -106,3 +106,53 @@ func TestGCPHealthcheckNotIngressPut(t *testing.T) {
106106
107107 assert.Equal(t, "test", rw.Body.String())
108108}
109+
110+func TestRedirectToHTTPSTrue(t *testing.T) {
111+ opts := NewOptions()
112+ opts.ForceHTTPS = true
113+ handler := func(w http.ResponseWriter, req *http.Request) {
114+ w.Write([]byte("test"))
115+ }
116+
117+ h := redirectToHTTPS(opts, http.HandlerFunc(handler))
118+ rw := httptest.NewRecorder()
119+ r, _ := http.NewRequest("GET", "/", nil)
120+ h.ServeHTTP(rw, r)
121+
122+ assert.Equal(t, http.StatusPermanentRedirect, rw.Code, "status code should be %d, got: %d", http.StatusPermanentRedirect, rw.Code)
123+}
124+
125+func TestRedirectToHTTPSFalse(t *testing.T) {
126+ opts := NewOptions()
127+ handler := func(w http.ResponseWriter, req *http.Request) {
128+ w.Write([]byte("test"))
129+ }
130+
131+ h := redirectToHTTPS(opts, http.HandlerFunc(handler))
132+ rw := httptest.NewRecorder()
133+ r, _ := http.NewRequest("GET", "/", nil)
134+ h.ServeHTTP(rw, r)
135+
136+ assert.Equal(t, http.StatusOK, rw.Code, "status code should be %d, got: %d", http.StatusOK, rw.Code)
137+}
138+
139+func TestRedirectNotWhenHTTPS(t *testing.T) {
140+ opts := NewOptions()
141+ opts.ForceHTTPS = true
142+ handler := func(w http.ResponseWriter, req *http.Request) {
143+ w.Write([]byte("test"))
144+ }
145+
146+ h := redirectToHTTPS(opts, http.HandlerFunc(handler))
147+ s := httptest.NewTLSServer(h)
148+ defer s.Close()
149+
150+ opts.HTTPSAddress = s.URL
151+ client := s.Client()
152+ res, err := client.Get(s.URL)
153+ if err != nil {
154+ t.Fatalf("request to test server failed with error: %v", err)
155+ }
156+
157+ assert.Equal(t, http.StatusOK, res.StatusCode, "status code should be %d, got: %d", http.StatusOK, res.StatusCode)
158+}
main.go+3−2
@@ -32,6 +32,7 @@ func main() {
3232
3333 flagSet.String("http-address", "127.0.0.1:4180", "[http://]<addr>:<port> or unix://<path> to listen on for HTTP clients")
3434 flagSet.String("https-address", ":443", "<addr>:<port> to listen on for HTTPS clients")
35+ flagSet.Bool("force-https", false, "force HTTPS redirect for HTTP requests")
3536 flagSet.String("tls-cert-file", "", "path to certificate file")
3637 flagSet.String("tls-key-file", "", "path to private key file")
3738 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")
@@ -185,9 +186,9 @@ func main() {
185186
186187 var handler http.Handler
187188 if opts.GCPHealthChecks {
188− handler = gcpHealthcheck(LoggingHandler(oauthproxy))
189+ handler = redirectToHTTPS(opts, gcpHealthcheck(LoggingHandler(oauthproxy)))
189190 } else {
190− handler = LoggingHandler(oauthproxy)
191+ handler = redirectToHTTPS(opts, LoggingHandler(oauthproxy))
191192 }
192193 s := &Server{
193194 Handler: handler,
options.go+2
@@ -34,6 +34,7 @@ type Options struct {
3434 ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets" env:"OAUTH2_PROXY_PROXY_WEBSOCKETS"`
3535 HTTPAddress string `flag:"http-address" cfg:"http_address" env:"OAUTH2_PROXY_HTTP_ADDRESS"`
3636 HTTPSAddress string `flag:"https-address" cfg:"https_address" env:"OAUTH2_PROXY_HTTPS_ADDRESS"`
37+ ForceHTTPS bool `flag:"force-https" cfg:"force_https" env:"OAUTH2_PROXY_FORCE_HTTPS"`
3738 RedirectURL string `flag:"redirect-url" cfg:"redirect_url" env:"OAUTH2_PROXY_REDIRECT_URL"`
3839 ClientID string `flag:"client-id" cfg:"client_id" env:"OAUTH2_PROXY_CLIENT_ID"`
3940 ClientSecret string `flag:"client-secret" cfg:"client_secret" env:"OAUTH2_PROXY_CLIENT_SECRET"`
@@ -145,6 +146,7 @@ func NewOptions() *Options {
145146 ProxyWebSockets: true,
146147 HTTPAddress: "127.0.0.1:4180",
147148 HTTPSAddress: ":443",
149+ ForceHTTPS: false,
148150 DisplayHtpasswdForm: true,
149151 CookieOptions: options.CookieOptions{
150152 CookieName: "_oauth2_proxy",