7529095 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

fix: use X-Forwarded-Uri if it exists for pathRegex match

the functions `isApiPath` and `isAllowedPath` use the `req.URL.Path` property which leads to faulty behavior when behind a reverse proxy. The correct path can be inferred from the `X-Forwarded-Uri` header by making use of the already provided `requestutil.GetRequestURI` function. Co-authored-by: Jan Wystub <jan@bam-bam-bam.com>

commit7529095e1ac4304d373a5f9774f8dea2d6bd9435 authorMarius Zander <marius@bam-bam-bam.com> dateWed 14 Jun 2023, 17:49 (3 years ago) parent7b3a36b

1 file changed+2−2

compare with master

unifiedsplit

oauthproxy.go+2−2

oauthproxy.go+2−2

@@ -554,7 +554,7 @@ func isAllowedMethod(req *http.Request, route allowedRoute) bool {

554554}

555555

556556func isAllowedPath(req *http.Request, route allowedRoute) bool {

557− matches := route.pathRegex.MatchString(req.URL.Path)

557+ matches := route.pathRegex.MatchString(requestutil.GetRequestURI(req))

558558

559559 if route.negate {

560560 return !matches

@@ -575,7 +575,7 @@ func (p *OAuthProxy) isAllowedRoute(req *http.Request) bool {

575575

576576func (p *OAuthProxy) isAPIPath(req *http.Request) bool {

577577 for _, route := range p.apiRoutes {

578− if route.pathRegex.MatchString(req.URL.Path) {

578+ if route.pathRegex.MatchString(requestutil.GetRequestURI(req)) {

579579 return true

580580 }

581581 }