git.iko.soy/typeable/oauth2-proxy
on master help sign in
fix: self signed certificate handling
8fd7312tuunit
pkg/requests/http.go+7−5
compare with master
unifiedsplit
@@ -7,20 +7,22 @@ import (
7)
7)
8
8
9type userAgentTransport struct {
9type userAgentTransport struct {
10− next http.RoundTripper
10+ Next http.RoundTripper
11 userAgent string
11 userAgent string
12}
12}
13
13
14func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
14func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
15 r := req.Clone(req.Context())
15 r := req.Clone(req.Context())
16 setDefaultUserAgent(r.Header, t.userAgent)
16 setDefaultUserAgent(r.Header, t.userAgent)
17− return t.next.RoundTrip(r)
17+ return t.Next.RoundTrip(r)
18}
18}
19
19
20−var DefaultHTTPClient = &http.Client{Transport: &userAgentTransport{
20+var DefaultHTTPClient = &http.Client{Transport: &DefaultTransport}
21+
22+var DefaultTransport = userAgentTransport{
21− next: http.DefaultTransport,
23+ Next: http.DefaultTransport,
22 userAgent: "oauth2-proxy/" + version.VERSION,
24 userAgent: "oauth2-proxy/" + version.VERSION,
23−}}
25+}
24
26
25func setDefaultUserAgent(header http.Header, userAgent string) {
27func setDefaultUserAgent(header http.Header, userAgent string) {
26 if header != nil && len(header.Values("User-Agent")) == 0 {
28 if header != nil && len(header.Values("User-Agent")) == 0 {
pkg/validation/options.go+7−6
@@ -13,6 +13,7 @@ import (
13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
14 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
14 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
15 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
15 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
16+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
16 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
17 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
17)
18)
18
19
@@ -30,20 +31,20 @@ func Validate(o *options.Options) error {
30 msgs = parseSignatureKey(o, msgs)
31 msgs = parseSignatureKey(o, msgs)
31
32
32 if o.SSLInsecureSkipVerify {
33 if o.SSLInsecureSkipVerify {
33− insecureTransport := &http.Transport{
34+ transport := requests.DefaultTransport.Next.(*http.Transport).Clone()
34− TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
35+ transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
35− }
36+
36− http.DefaultClient = &http.Client{Transport: insecureTransport}
37+ requests.DefaultHTTPClient = &http.Client{Transport: transport}
37 } else if len(o.Providers[0].CAFiles) > 0 {
38 } else if len(o.Providers[0].CAFiles) > 0 {
38 pool, err := util.GetCertPool(o.Providers[0].CAFiles, o.Providers[0].UseSystemTrustStore)
39 pool, err := util.GetCertPool(o.Providers[0].CAFiles, o.Providers[0].UseSystemTrustStore)
39 if err == nil {
40 if err == nil {
40− transport := http.DefaultTransport.(*http.Transport).Clone()
41+ transport := requests.DefaultTransport.Next.(*http.Transport).Clone()
41 transport.TLSClientConfig = &tls.Config{
42 transport.TLSClientConfig = &tls.Config{
42 RootCAs: pool,
43 RootCAs: pool,
43 MinVersion: tls.VersionTLS12,
44 MinVersion: tls.VersionTLS12,
44 }
45 }
45
46
46− http.DefaultClient = &http.Client{Transport: transport}
47+ requests.DefaultHTTPClient = &http.Client{Transport: transport}
47 } else {
48 } else {
48 msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err))
49 msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err))
49 }
50 }