git.iko.soy/typeable/oauth2-proxy
on master help sign in
fix: self signed certificate handling
commit8fd7312a9007d67f2f15bd4177850787addb0f37 authortuunit <jan@larwig.com> dateSat 5 Oct 2024, 17:29 (2 years ago) parentcda6414
2 files changed+14−11
compare with master
unifiedsplit
pkg/requests/http.go+7−5 pkg/validation/options.go+7−6
pkg/requests/http.go+7−5
@@ -7,20 +7,22 @@ import (
77)
88
99type userAgentTransport struct {
10− next http.RoundTripper
10+ Next http.RoundTripper
1111 userAgent string
1212}
1313
1414func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
1515 r := req.Clone(req.Context())
1616 setDefaultUserAgent(r.Header, t.userAgent)
17− return t.next.RoundTrip(r)
17+ return t.Next.RoundTrip(r)
1818}
1919
20−var DefaultHTTPClient = &http.Client{Transport: &userAgentTransport{
21− next: http.DefaultTransport,
20+var DefaultHTTPClient = &http.Client{Transport: &DefaultTransport}
21+
22+var DefaultTransport = userAgentTransport{
23+ Next: http.DefaultTransport,
2224 userAgent: "oauth2-proxy/" + version.VERSION,
23−}}
25+}
2426
2527func setDefaultUserAgent(header http.Header, userAgent string) {
2628 if header != nil && len(header.Values("User-Agent")) == 0 {
pkg/validation/options.go+7−6
@@ -13,6 +13,7 @@ import (
1313 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
1414 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
1515 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
16+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
1617 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
1718)
1819
@@ -30,20 +31,20 @@ func Validate(o *options.Options) error {
3031 msgs = parseSignatureKey(o, msgs)
3132
3233 if o.SSLInsecureSkipVerify {
33− insecureTransport := &http.Transport{
34− TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
35− }
36− http.DefaultClient = &http.Client{Transport: insecureTransport}
34+ transport := requests.DefaultTransport.Next.(*http.Transport).Clone()
35+ transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
36+
37+ requests.DefaultHTTPClient = &http.Client{Transport: transport}
3738 } else if len(o.Providers[0].CAFiles) > 0 {
3839 pool, err := util.GetCertPool(o.Providers[0].CAFiles, o.Providers[0].UseSystemTrustStore)
3940 if err == nil {
40− transport := http.DefaultTransport.(*http.Transport).Clone()
41+ transport := requests.DefaultTransport.Next.(*http.Transport).Clone()
4142 transport.TLSClientConfig = &tls.Config{
4243 RootCAs: pool,
4344 MinVersion: tls.VersionTLS12,
4445 }
4546
46− http.DefaultClient = &http.Client{Transport: transport}
47+ requests.DefaultHTTPClient = &http.Client{Transport: transport}
4748 } else {
4849 msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err))
4950 }