git.iko.soy/typeable/oauth2-proxy
on master help sign in
revert: secrets as []byte instead of string

Signed-off-by: Jan Larwig <jan@larwig.com>

commit810f629ee8844dc56db3605588cc5fdf0e82fbbe authorJan Larwig <jan@larwig.com> dateFri 25 Jul 2025, 13:29 (1 year ago) parentaaf1889
16 files changed+42−40
compare with master
unifiedsplit
docs/docs/configuration/alpha_config.md+2−2 main_test.go+1−1 oauthproxy_test.go+3−3 pkg/apis/options/legacy_options.go+1−1 pkg/apis/options/legacy_options_test.go+2−2 pkg/apis/options/load_test.go+1−1 pkg/apis/options/secret_source.go+2−2 pkg/apis/options/util/util.go+1−1 pkg/apis/options/util/util_test.go+1−1 pkg/header/injector_test.go+8−8 pkg/http/http_suite_test.go+6−6 pkg/http/server_test.go+4−4 pkg/middleware/headers_test.go+4−4 pkg/validation/common_test.go+2−2 pkg/validation/header.go+2 pkg/validation/header_test.go+2−2
docs/docs/configuration/alpha_config.md+2−2
@@ -268,7 +268,7 @@ make up the header value
268268
269269| Field | Type | Description |
270270| ----- | ---- | ----------- |
271−| `value` | _string_ | Value expects a base64 encoded string value. |
271+| `value` | _[]byte_ | Value expects a base64 encoded []byte |
272272| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
273273| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
274274| `claim` | _string_ | Claim is the name of the claim in the session that the value should be<br/>loaded from. Available claims: `access_token` `id_token` `created_at`<br/>`expires_on` `refresh_token` `email` `user` `groups` `preferred_username`. |
@@ -480,7 +480,7 @@ Only one source within the struct should be defined at any time.
480480
481481| Field | Type | Description |
482482| ----- | ---- | ----------- |
483−| `value` | _string_ | Value expects a base64 encoded string value. |
483+| `value` | _[]byte_ | Value expects a base64 encoded []byte |
484484| `fromEnv` | _string_ | FromEnv expects the name of an environment variable. |
485485| `fromFile` | _string_ | FromFile expects a path to a file containing the secret value. |
486486
main_test.go+1−1
@@ -139,7 +139,7 @@ redirect_url="http://localhost:4180/oauth2/callback"
139139 Claim: "user",
140140 Prefix: "Basic ",
141141 BasicAuthPassword: &options.SecretSource{
142− Value: "super-secret-password",
142+ Value: []byte("super-secret-password"),
143143 },
144144 },
145145 },
oauthproxy_test.go+3−3
@@ -215,7 +215,7 @@ func TestBasicAuthPassword(t *testing.T) {
215215 ClaimSource: &options.ClaimSource{
216216 Claim: "email",
217217 BasicAuthPassword: &options.SecretSource{
218− Value: basicAuthPassword,
218+ Value: []byte(basicAuthPassword),
219219 },
220220 },
221221 },
@@ -1282,7 +1282,7 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
12821282 ClaimSource: &options.ClaimSource{
12831283 Claim: "user",
12841284 BasicAuthPassword: &options.SecretSource{
1285− Value: "This is a secure password",
1285+ Value: []byte("This is a secure password"),
12861286 },
12871287 },
12881288 },
@@ -2044,7 +2044,7 @@ func baseTestOptions() *options.Options {
20442044 ClaimSource: &options.ClaimSource{
20452045 Claim: "user",
20462046 BasicAuthPassword: &options.SecretSource{
2047− Value: base64.StdEncoding.EncodeToString([]byte("This is a secure password")),
2047+ Value: []byte(base64.StdEncoding.EncodeToString([]byte("This is a secure password"))),
20482048 },
20492049 },
20502050 },
pkg/apis/options/legacy_options.go+1−1
@@ -294,7 +294,7 @@ func getBasicAuthHeader(preferEmailToUser bool, basicAuthPassword string) Header
294294 Claim: claim,
295295 Prefix: "Basic ",
296296 BasicAuthPassword: &SecretSource{
297− Value: basicAuthPassword,
297+ Value: []byte(basicAuthPassword),
298298 },
299299 },
300300 },
pkg/apis/options/legacy_options_test.go+2−2
@@ -369,7 +369,7 @@ var _ = Describe("Legacy Options", func() {
369369 Claim: "user",
370370 Prefix: "Basic ",
371371 BasicAuthPassword: &SecretSource{
372− Value: basicAuthSecret,
372+ Value: []byte(basicAuthSecret),
373373 },
374374 },
375375 },
@@ -409,7 +409,7 @@ var _ = Describe("Legacy Options", func() {
409409 Claim: "email",
410410 Prefix: "Basic ",
411411 BasicAuthPassword: &SecretSource{
412− Value: basicAuthSecret,
412+ Value: []byte(basicAuthSecret),
413413 },
414414 },
415415 },
pkg/apis/options/load_test.go+1−1
@@ -581,7 +581,7 @@ injectResponseHeaders:
581581 Values: []HeaderValue{
582582 {
583583 SecretSource: &SecretSource{
584− Value: "secret",
584+ Value: []byte("secret"),
585585 },
586586 },
587587 },
pkg/apis/options/secret_source.go+2−2
@@ -3,8 +3,8 @@ package options
33// SecretSource references an individual secret value.
44// Only one source within the struct should be defined at any time.
55type SecretSource struct {
6− // Value expects a base64 encoded string value.
7− Value string `yaml:"value,omitempty"`
6+ // Value expects a base64 encoded []byte
7+ Value []byte `yaml:"value,omitempty"`
88
99 // FromEnv expects the name of an environment variable.
1010 FromEnv string `yaml:"fromEnv,omitempty"`
pkg/apis/options/util/util.go+1−1
@@ -11,7 +11,7 @@ import (
1111func GetSecretValue(source *options.SecretSource) ([]byte, error) {
1212 switch {
1313 case len(source.Value) > 0 && source.FromEnv == "" && source.FromFile == "":
14− return []byte(source.Value), nil
14+ return source.Value, nil
1515 case len(source.Value) == 0 && source.FromEnv != "" && source.FromFile == "":
1616 return []byte(os.Getenv(source.FromEnv)), nil
1717 case len(source.Value) == 0 && source.FromEnv == "" && source.FromFile != "":
pkg/apis/options/util/util_test.go+1−1
@@ -31,7 +31,7 @@ var _ = Describe("GetSecretValue", func() {
3131
3232 It("returns the correct value from the string value", func() {
3333 value, err := GetSecretValue(&options.SecretSource{
34− Value: "secret-value-1",
34+ Value: []byte("secret-value-1"),
3535 })
3636 Expect(err).ToNot(HaveOccurred())
3737 Expect(string(value)).To(Equal("secret-value-1"))
pkg/header/injector_test.go+8−8
@@ -55,7 +55,7 @@ var _ = Describe("Injector Suite", func() {
5555 Values: []options.HeaderValue{
5656 {
5757 SecretSource: &options.SecretSource{
58− Value: "super-secret",
58+ Value: []byte("super-secret"),
5959 },
6060 },
6161 },
@@ -199,7 +199,7 @@ var _ = Describe("Injector Suite", func() {
199199 ClaimSource: &options.ClaimSource{
200200 Claim: "user",
201201 BasicAuthPassword: &options.SecretSource{
202− Value: "basic-password",
202+ Value: []byte("basic-password"),
203203 },
204204 },
205205 },
@@ -227,7 +227,7 @@ var _ = Describe("Injector Suite", func() {
227227 ClaimSource: &options.ClaimSource{
228228 Claim: "user",
229229 BasicAuthPassword: &options.SecretSource{
230− Value: base64.StdEncoding.EncodeToString([]byte("basic-password")),
230+ Value: []byte(base64.StdEncoding.EncodeToString([]byte("basic-password"))),
231231 },
232232 },
233233 },
@@ -322,7 +322,7 @@ var _ = Describe("Injector Suite", func() {
322322 ClaimSource: &options.ClaimSource{
323323 Claim: "user",
324324 BasicAuthPassword: &options.SecretSource{
325− Value: base64.StdEncoding.EncodeToString([]byte("basic-password")),
325+ Value: []byte(base64.StdEncoding.EncodeToString([]byte("basic-password"))),
326326 FromEnv: "SECRET_ENV",
327327 },
328328 },
@@ -348,7 +348,7 @@ var _ = Describe("Injector Suite", func() {
348348 ClaimSource: &options.ClaimSource{
349349 Claim: "user",
350350 BasicAuthPassword: &options.SecretSource{
351− Value: "basic-password",
351+ Value: []byte("basic-password"),
352352 },
353353 },
354354 },
@@ -379,17 +379,17 @@ var _ = Describe("Injector Suite", func() {
379379 Values: []options.HeaderValue{
380380 {
381381 SecretSource: &options.SecretSource{
382− Value: "major=1",
382+ Value: []byte("major=1"),
383383 },
384384 },
385385 {
386386 SecretSource: &options.SecretSource{
387− Value: "minor=2",
387+ Value: []byte("minor=2"),
388388 },
389389 },
390390 {
391391 SecretSource: &options.SecretSource{
392− Value: "patch=3",
392+ Value: []byte("patch=3"),
393393 },
394394 },
395395 },
pkg/http/http_suite_test.go+6−6
@@ -48,10 +48,10 @@ var _ = BeforeSuite(func() {
4848
4949 certOut := new(bytes.Buffer)
5050 Expect(pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: certBytes})).To(Succeed())
51− ipv4CertDataSource.Value = certOut.String()
51+ ipv4CertDataSource.Value = certOut.Bytes()
5252 keyOut := new(bytes.Buffer)
5353 Expect(pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: keyBytes})).To(Succeed())
54− ipv4KeyDataSource.Value = keyOut.String()
54+ ipv4KeyDataSource.Value = keyOut.Bytes()
5555 })
5656
5757 By("Generating a ipv6 self-signed cert for TLS tests", func() {
@@ -61,16 +61,16 @@ var _ = BeforeSuite(func() {
6161
6262 certOut := new(bytes.Buffer)
6363 Expect(pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: certBytes})).To(Succeed())
64− ipv6CertDataSource.Value = certOut.String()
64+ ipv6CertDataSource.Value = certOut.Bytes()
6565 keyOut := new(bytes.Buffer)
6666 Expect(pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: keyBytes})).To(Succeed())
67− ipv6KeyDataSource.Value = keyOut.String()
67+ ipv6KeyDataSource.Value = keyOut.Bytes()
6868 })
6969
7070 By("Setting up a http client", func() {
71− ipv4cert, err := tls.X509KeyPair([]byte(ipv4CertDataSource.Value), []byte(ipv4KeyDataSource.Value))
71+ ipv4cert, err := tls.X509KeyPair(ipv4CertDataSource.Value, ipv4KeyDataSource.Value)
7272 Expect(err).ToNot(HaveOccurred())
73− ipv6cert, err := tls.X509KeyPair([]byte(ipv6CertDataSource.Value), []byte(ipv6KeyDataSource.Value))
73+ ipv6cert, err := tls.X509KeyPair(ipv6CertDataSource.Value, ipv6KeyDataSource.Value)
7474 Expect(err).ToNot(HaveOccurred())
7575
7676 ipv4certificate, err := x509.ParseCertificate(ipv4cert.Certificate[0])
pkg/http/server_test.go+4−4
@@ -234,7 +234,7 @@ var _ = Describe("Server", func() {
234234 SecureBindAddress: "127.0.0.1:0",
235235 TLS: &options.TLS{
236236 Key: &options.SecretSource{
237− Value: "invalid",
237+ Value: []byte("invalid"),
238238 },
239239 Cert: &ipv4CertDataSource,
240240 },
@@ -250,7 +250,7 @@ var _ = Describe("Server", func() {
250250 TLS: &options.TLS{
251251 Key: &ipv4KeyDataSource,
252252 Cert: &options.SecretSource{
253− Value: "invalid",
253+ Value: []byte("invalid"),
254254 },
255255 },
256256 },
@@ -506,7 +506,7 @@ var _ = Describe("Server", func() {
506506 SecureBindAddress: "[::1]:0",
507507 TLS: &options.TLS{
508508 Key: &options.SecretSource{
509− Value: "invalid",
509+ Value: []byte("invalid"),
510510 },
511511 Cert: &ipv6CertDataSource,
512512 },
@@ -523,7 +523,7 @@ var _ = Describe("Server", func() {
523523 TLS: &options.TLS{
524524 Key: &ipv6KeyDataSource,
525525 Cert: &options.SecretSource{
526− Value: "invalid",
526+ Value: []byte("invalid"),
527527 },
528528 },
529529 },
pkg/middleware/headers_test.go+4−4
@@ -188,7 +188,7 @@ var _ = Describe("Headers Suite", func() {
188188 ClaimSource: &options.ClaimSource{
189189 Claim: "user",
190190 BasicAuthPassword: &options.SecretSource{
191− Value: base64.StdEncoding.EncodeToString([]byte("basic-password")),
191+ Value: []byte(base64.StdEncoding.EncodeToString([]byte("basic-password"))),
192192 FromEnv: "SECRET_ENV",
193193 },
194194 },
@@ -304,7 +304,7 @@ var _ = Describe("Headers Suite", func() {
304304 Values: []options.HeaderValue{
305305 {
306306 SecretSource: &options.SecretSource{
307− Value: "_oauth2_proxy=ey123123123",
307+ Value: []byte("_oauth2_proxy=ey123123123"),
308308 },
309309 },
310310 },
@@ -314,7 +314,7 @@ var _ = Describe("Headers Suite", func() {
314314 Values: []options.HeaderValue{
315315 {
316316 SecretSource: &options.SecretSource{
317− Value: "oauth_user",
317+ Value: []byte("oauth_user"),
318318 },
319319 },
320320 },
@@ -460,7 +460,7 @@ var _ = Describe("Headers Suite", func() {
460460 ClaimSource: &options.ClaimSource{
461461 Claim: "user",
462462 BasicAuthPassword: &options.SecretSource{
463− Value: base64.StdEncoding.EncodeToString([]byte("basic-password")),
463+ Value: []byte(base64.StdEncoding.EncodeToString([]byte("basic-password"))),
464464 FromEnv: "SECRET_ENV",
465465 },
466466 },
pkg/validation/common_test.go+2−2
@@ -9,12 +9,12 @@ import (
99)
1010
1111var _ = Describe("Common", func() {
12− var validSecretSourceValue string
12+ var validSecretSourceValue []byte
1313 const validSecretSourceEnv = "OAUTH2_PROXY_TEST_SECRET_SOURCE_ENV"
1414 var validSecretSourceFile string
1515
1616 BeforeEach(func() {
17− validSecretSourceValue = "This is a secret source value"
17+ validSecretSourceValue = []byte("This is a secret source value")
1818 Expect(os.Setenv(validSecretSourceEnv, "This is a secret source env")).To(Succeed())
1919 tmp, err := os.CreateTemp("", "oauth2-proxy-secret-source-test")
2020 Expect(err).ToNot(HaveOccurred())
pkg/validation/header.go+2
@@ -51,9 +51,11 @@ func validateHeaderValue(_ string, value options.HeaderValue) []string {
5151
5252func validateHeaderValueClaimSource(claim options.ClaimSource) []string {
5353 msgs := []string{}
54+
5455 if claim.Claim == "" {
5556 msgs = append(msgs, "claim should not be empty")
5657 }
58+
5759 if claim.BasicAuthPassword != nil {
5860 msgs = append(msgs, prefixValues("invalid basicAuthPassword: ", validateSecretSource(*claim.BasicAuthPassword))...)
5961 }
pkg/validation/header_test.go+2−2
@@ -30,7 +30,7 @@ var _ = Describe("Headers", func() {
3030 Values: []options.HeaderValue{
3131 {
3232 SecretSource: &options.SecretSource{
33− Value: base64.StdEncoding.EncodeToString([]byte("secret")),
33+ Value: []byte(base64.StdEncoding.EncodeToString([]byte("secret"))),
3434 },
3535 },
3636 },
@@ -43,7 +43,7 @@ var _ = Describe("Headers", func() {
4343 ClaimSource: &options.ClaimSource{
4444 Claim: "email",
4545 BasicAuthPassword: &options.SecretSource{
46− Value: base64.StdEncoding.EncodeToString([]byte("secret")),
46+ Value: []byte(base64.StdEncoding.EncodeToString([]byte("secret"))),
4747 },
4848 },
4949 },