@@ -23,7 +23,7 @@ import (
2323 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"
2424 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
2525 "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"
26− "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/cookie"
26+ sessionscookie "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/cookie"
2727 "github.com/oauth2-proxy/oauth2-proxy/pkg/validation"
2828 "github.com/oauth2-proxy/oauth2-proxy/providers"
2929 "github.com/stretchr/testify/assert"
@@ -36,11 +36,12 @@ const (
3636 // encoded version of this.
3737 rawCookieSecret = "secretthirtytwobytes+abcdefghijk"
3838 base64CookieSecret = "c2VjcmV0dGhpcnR5dHdvYnl0ZXMrYWJjZGVmZ2hpams"
39+ clientID = "3984n253984d7348dm8234yf982t"
40+ clientSecret = "gv3498mfc9t23y23974dm2394dm9"
3941)
4042
4143func init() {
4244 logger.SetFlags(logger.Lshortfile)
43−
4445}
4546
4647type WebSocketOrRestHandler struct {
@@ -61,24 +62,30 @@ func TestWebSocketProxy(t *testing.T) {
6162 restHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
6263 w.WriteHeader(200)
6364 hostname, _, _ := net.SplitHostPort(r.Host)
64− w.Write([]byte(hostname))
65+ _, err := w.Write([]byte(hostname))
66+ if err != nil {
67+ t.Fatal(err)
68+ }
6569 }),
6670 wsHandler: websocket.Handler(func(ws *websocket.Conn) {
67− defer ws.Close()
71+ defer func(t *testing.T) {
72+ if err := ws.Close(); err != nil {
73+ t.Fatal(err)
74+ }
75+ }(t)
6876 var data []byte
6977 err := websocket.Message.Receive(ws, &data)
7078 if err != nil {
71− t.Fatalf("err %s", err)
72− return
79+ t.Fatal(err)
7380 }
7481 err = websocket.Message.Send(ws, data)
7582 if err != nil {
76− t.Fatalf("err %s", err)
83+ t.Fatal(err)
7784 }
7885 }),
7986 }
8087 backend := httptest.NewServer(&handler)
81− defer backend.Close()
88+ t.Cleanup(backend.Close)
8289
8390 backendURL, _ := url.Parse(backend.URL)
8491
@@ -87,24 +94,24 @@ func TestWebSocketProxy(t *testing.T) {
8794 opts.PassHostHeader = true
8895 proxyHandler := NewWebSocketOrRestReverseProxy(backendURL, opts, auth)
8996 frontend := httptest.NewServer(proxyHandler)
90− defer frontend.Close()
97+ t.Cleanup(frontend.Close)
9198
9299 frontendURL, _ := url.Parse(frontend.URL)
93100 frontendWSURL := "ws://" + frontendURL.Host + "/"
94101
95102 ws, err := websocket.Dial(frontendWSURL, "", "http://localhost/")
96103 if err != nil {
97− t.Fatalf("err %s", err)
104+ t.Fatal(err)
98105 }
99106 request := []byte("hello, world!")
100107 err = websocket.Message.Send(ws, request)
101108 if err != nil {
102− t.Fatalf("err %s", err)
109+ t.Fatal(err)
103110 }
104111 var response = make([]byte, 1024)
105− websocket.Message.Receive(ws, &response)
112+ err = websocket.Message.Receive(ws, &response)
106113 if err != nil {
107− t.Fatalf("err %s", err)
114+ t.Fatal(err)
108115 }
109116 if g, e := string(request), string(response); g != e {
110117 t.Errorf("got body %q; expected %q", g, e)
@@ -123,9 +130,12 @@ func TestNewReverseProxy(t *testing.T) {
123130 backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
124131 w.WriteHeader(200)
125132 hostname, _, _ := net.SplitHostPort(r.Host)
126− w.Write([]byte(hostname))
133+ _, err := w.Write([]byte(hostname))
134+ if err != nil {
135+ t.Fatal(err)
136+ }
127137 }))
128− defer backend.Close()
138+ t.Cleanup(backend.Close)
129139
130140 backendURL, _ := url.Parse(backend.URL)
131141 backendHostname, backendPort, _ := net.SplitHostPort(backendURL.Host)
@@ -135,7 +145,7 @@ func TestNewReverseProxy(t *testing.T) {
135145 proxyHandler := NewReverseProxy(proxyURL, &options.Options{FlushInterval: time.Second})
136146 setProxyUpstreamHostHeader(proxyHandler, proxyURL)
137147 frontend := httptest.NewServer(proxyHandler)
138− defer frontend.Close()
148+ t.Cleanup(frontend.Close)
139149
140150 getReq, _ := http.NewRequest("GET", frontend.URL, nil)
141151 res, _ := http.DefaultClient.Do(getReq)
@@ -151,20 +161,20 @@ func TestEncodedSlashes(t *testing.T) {
151161 w.WriteHeader(200)
152162 seen = r.RequestURI
153163 }))
154− defer backend.Close()
164+ t.Cleanup(backend.Close)
155165
156166 b, _ := url.Parse(backend.URL)
157167 proxyHandler := NewReverseProxy(b, &options.Options{FlushInterval: time.Second})
158168 setProxyDirector(proxyHandler)
159169 frontend := httptest.NewServer(proxyHandler)
160− defer frontend.Close()
170+ t.Cleanup(frontend.Close)
161171
162172 f, _ := url.Parse(frontend.URL)
163173 encodedPath := "/a%2Fb/?c=1"
164174 getReq := &http.Request{URL: &url.URL{Scheme: "http", Host: f.Host, Opaque: encodedPath}}
165175 _, err := http.DefaultClient.Do(getReq)
166176 if err != nil {
167− t.Fatalf("err %s", err)
177+ t.Fatal(err)
168178 }
169179 if seen != encodedPath {
170180 t.Errorf("got bad request %q expected %q", seen, encodedPath)
@@ -173,13 +183,13 @@ func TestEncodedSlashes(t *testing.T) {
173183
174184func TestRobotsTxt(t *testing.T) {
175185 opts := baseTestOptions()
176− opts.ClientID = "asdlkjx"
177− opts.ClientSecret = "alkgks"
178− opts.Cookie.Secret = rawCookieSecret
179− validation.Validate(opts)
186+ err := validation.Validate(opts)
187+ assert.NoError(t, err)
180188
181189 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
182− assert.NoError(t, err)
190+ if err != nil {
191+ t.Fatal(err)
192+ }
183193 rw := httptest.NewRecorder()
184194 req, _ := http.NewRequest("GET", "/robots.txt", nil)
185195 proxy.ServeHTTP(rw, req)
@@ -189,9 +199,6 @@ func TestRobotsTxt(t *testing.T) {
189199
190200func TestIsValidRedirect(t *testing.T) {
191201 opts := baseTestOptions()
192− opts.ClientID = "skdlfj"
193− opts.ClientSecret = "fgkdsgj"
194− opts.Cookie.Secret = base64CookieSecret
195202 // Should match domains that are exactly foo.bar and any subdomain of bar.foo
196203 opts.WhitelistDomains = []string{
197204 "foo.bar",
@@ -201,10 +208,13 @@ func TestIsValidRedirect(t *testing.T) {
201208 "anyport.bar:*",
202209 ".sub.anyport.bar:*",
203210 }
204− validation.Validate(opts)
211+ err := validation.Validate(opts)
212+ assert.NoError(t, err)
205213
206214 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
207− assert.NoError(t, err)
215+ if err != nil {
216+ t.Fatal(err)
217+ }
208218
209219 testCases := []struct {
210220 Desc, Redirect string
@@ -439,11 +449,7 @@ func TestIsValidRedirect(t *testing.T) {
439449}
440450
441451func TestOpenRedirects(t *testing.T) {
442− opts := options.NewOptions()
443− opts.ClientID = "skdlfj"
444− opts.ClientSecret = "fgkdsgj"
445− opts.Cookie.Secret = rawCookieSecret
446− opts.EmailDomains = []string{"*"}
452+ opts := baseTestOptions()
447453 // Should match domains that are exactly foo.bar and any subdomain of bar.foo
448454 opts.WhitelistDomains = []string{
449455 "foo.bar",
@@ -458,13 +464,19 @@ func TestOpenRedirects(t *testing.T) {
458464 assert.NoError(t, err)
459465
460466 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
461− assert.NoError(t, err)
467+ if err != nil {
468+ t.Fatal(err)
469+ }
462470
463471 file, err := os.Open("./test/openredirects.txt")
464472 if err != nil {
465473 t.Fatal(err)
466474 }
467− defer file.Close()
475+ defer func(t *testing.T) {
476+ if err := file.Close(); err != nil {
477+ t.Fatal(err)
478+ }
479+ }(t)
468480
469481 scanner := bufio.NewScanner(file)
470482 for scanner.Scan() {
@@ -544,22 +556,21 @@ func TestBasicAuthPassword(t *testing.T) {
544556 }
545557 }
546558 w.WriteHeader(200)
547− w.Write([]byte(payload))
559+ _, err := w.Write([]byte(payload))
560+ if err != nil {
561+ t.Fatal(err)
562+ }
548563 }))
549564 opts := baseTestOptions()
550565 opts.Upstreams = append(opts.Upstreams, providerServer.URL)
551− // The CookieSecret must be 32 bytes in order to create the AES
552− // cipher.
553− opts.Cookie.Secret = "xyzzyplughxyzzyplughxyzzyplughxp"
554− opts.ClientID = "dlgkj"
555− opts.ClientSecret = "alkgret"
556566 opts.Cookie.Secure = false
557567 opts.PassBasicAuth = true
558568 opts.SetBasicAuth = true
559569 opts.PassUserHeaders = true
560570 opts.PreferEmailToUser = true
561571 opts.BasicAuthPassword = "This is a secure password"
562− validation.Validate(opts)
572+ err := validation.Validate(opts)
573+ assert.NoError(t, err)
563574
564575 providerURL, _ := url.Parse(providerServer.URL)
565576 const emailAddress = "john.doe@example.com"
@@ -568,7 +579,9 @@ func TestBasicAuthPassword(t *testing.T) {
568579 proxy, err := NewOAuthProxy(opts, func(email string) bool {
569580 return email == emailAddress
570581 })
571− assert.NoError(t, err)
582+ if err != nil {
583+ t.Fatal(err)
584+ }
572585
573586 rw := httptest.NewRecorder()
574587 req, _ := http.NewRequest("GET", "/oauth2/callback?code=callback_code&state=nonce:", strings.NewReader(""))
@@ -618,8 +631,8 @@ func TestBasicAuthWithEmail(t *testing.T) {
618631 opts.PassUserHeaders = false
619632 opts.PreferEmailToUser = false
620633 opts.BasicAuthPassword = "This is a secure password"
621− opts.Cookie.Secret = rawCookieSecret
622− validation.Validate(opts)
634+ err := validation.Validate(opts)
635+ assert.NoError(t, err)
623636
624637 const emailAddress = "john.doe@example.com"
625638 const userName = "9fcab5c9b889a557"
@@ -641,7 +654,9 @@ func TestBasicAuthWithEmail(t *testing.T) {
641654 proxy, err := NewOAuthProxy(opts, func(email string) bool {
642655 return email == emailAddress
643656 })
644− assert.NoError(t, err)
657+ if err != nil {
658+ t.Fatal(err)
659+ }
645660 proxy.addHeadersForProxying(rw, req, session)
646661 assert.Equal(t, expectedUserHeader, req.Header["Authorization"][0])
647662 assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
@@ -655,7 +670,9 @@ func TestBasicAuthWithEmail(t *testing.T) {
655670 proxy, err := NewOAuthProxy(opts, func(email string) bool {
656671 return email == emailAddress
657672 })
658− assert.NoError(t, err)
673+ if err != nil {
674+ t.Fatal(err)
675+ }
659676 proxy.addHeadersForProxying(rw, req, session)
660677 assert.Equal(t, expectedEmailHeader, req.Header["Authorization"][0])
661678 assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
@@ -664,11 +681,8 @@ func TestBasicAuthWithEmail(t *testing.T) {
664681
665682func TestPassUserHeadersWithEmail(t *testing.T) {
666683 opts := baseTestOptions()
667− opts.PassBasicAuth = false
668− opts.PassUserHeaders = true
669− opts.PreferEmailToUser = false
670− opts.Cookie.Secret = base64CookieSecret
671− validation.Validate(opts)
684+ err := validation.Validate(opts)
685+ assert.NoError(t, err)
672686
673687 const emailAddress = "john.doe@example.com"
674688 const userName = "9fcab5c9b889a557"
@@ -686,7 +700,9 @@ func TestPassUserHeadersWithEmail(t *testing.T) {
686700 proxy, err := NewOAuthProxy(opts, func(email string) bool {
687701 return email == emailAddress
688702 })
689− assert.NoError(t, err)
703+ if err != nil {
704+ t.Fatal(err)
705+ }
690706 proxy.addHeadersForProxying(rw, req, session)
691707 assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
692708 }
@@ -699,7 +715,9 @@ func TestPassUserHeadersWithEmail(t *testing.T) {
699715 proxy, err := NewOAuthProxy(opts, func(email string) bool {
700716 return email == emailAddress
701717 })
702− assert.NoError(t, err)
718+ if err != nil {
719+ t.Fatal(err)
720+ }
703721 proxy.addHeadersForProxying(rw, req, session)
704722 assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
705723 }
@@ -716,10 +734,10 @@ type PassAccessTokenTestOptions struct {
716734 ProxyUpstream string
717735}
718736
719−func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTest {
720− t := &PassAccessTokenTest{}
737+func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) (*PassAccessTokenTest, error) {
738+ patt := &PassAccessTokenTest{}
721739
722− t.providerServer = httptest.NewServer(
740+ patt.providerServer = httptest.NewServer(
723741 http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
724742 var payload string
725743 switch r.URL.Path {
@@ -732,35 +750,35 @@ func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTes
732750 }
733751 }
734752 w.WriteHeader(200)
735− w.Write([]byte(payload))
753+ _, err := w.Write([]byte(payload))
754+ if err != nil {
755+ panic(err)
756+ }
736757 }))
737758
738− t.opts = baseTestOptions()
739− t.opts.Upstreams = append(t.opts.Upstreams, t.providerServer.URL)
759+ patt.opts = baseTestOptions()
760+ patt.opts.Upstreams = append(patt.opts.Upstreams, patt.providerServer.URL)
740761 if opts.ProxyUpstream != "" {
741− t.opts.Upstreams = append(t.opts.Upstreams, opts.ProxyUpstream)
742− }
743− // The CookieSecret must be 32 bytes in order to create the AES
744− // cipher.
745− t.opts.Cookie.Secret = "xyzzyplughxyzzyplughxyzzyplughxp"
746− t.opts.ClientID = "slgkj"
747− t.opts.ClientSecret = "gfjgojl"
748− t.opts.Cookie.Secure = false
749− t.opts.PassAccessToken = opts.PassAccessToken
750− validation.Validate(t.opts)
751−
752− providerURL, _ := url.Parse(t.providerServer.URL)
762+ patt.opts.Upstreams = append(patt.opts.Upstreams, opts.ProxyUpstream)
763+ }
764+ patt.opts.Cookie.Secure = false
765+ patt.opts.PassAccessToken = opts.PassAccessToken
766+ err := validation.Validate(patt.opts)
767+ if err != nil {
768+ return nil, err
769+ }
770+
771+ providerURL, _ := url.Parse(patt.providerServer.URL)
753772 const emailAddress = "michael.bland@gsa.gov"
754773
755− t.opts.SetProvider(NewTestProvider(providerURL, emailAddress))
756− var err error
757− t.proxy, err = NewOAuthProxy(t.opts, func(email string) bool {
774+ patt.opts.SetProvider(NewTestProvider(providerURL, emailAddress))
775+ patt.proxy, err = NewOAuthProxy(patt.opts, func(email string) bool {
758776 return email == emailAddress
759777 })
760778 if err != nil {
761− panic(err)
779+ return nil, err
762780 }
763− return t
781+ return patt, nil
764782}
765783
766784func (patTest *PassAccessTokenTest) Close() {
@@ -817,17 +835,20 @@ func (patTest *PassAccessTokenTest) getEndpointWithCookie(cookie string, endpoin
817835}
818836
819837func TestForwardAccessTokenUpstream(t *testing.T) {
820− patTest := NewPassAccessTokenTest(PassAccessTokenTestOptions{
838+ patTest, err := NewPassAccessTokenTest(PassAccessTokenTestOptions{
821839 PassAccessToken: true,
822840 })
823− defer patTest.Close()
841+ if err != nil {
842+ t.Fatal(err)
843+ }
844+ t.Cleanup(patTest.Close)
824845
825846 // A successful validation will redirect and set the auth cookie.
826847 code, cookie := patTest.getCallbackEndpoint()
827848 if code != 302 {
828849 t.Fatalf("expected 302; got %d", code)
829850 }
830− assert.NotEqual(t, nil, cookie)
851+ assert.NotNil(t, cookie)
831852
832853 // Now we make a regular request; the access_token from the cookie is
833854 // forwarded as the "X-Forwarded-Access-Token" header. The token is
@@ -840,12 +861,14 @@ func TestForwardAccessTokenUpstream(t *testing.T) {
840861}
841862
842863func TestStaticProxyUpstream(t *testing.T) {
843− patTest := NewPassAccessTokenTest(PassAccessTokenTestOptions{
864+ patTest, err := NewPassAccessTokenTest(PassAccessTokenTestOptions{
844865 PassAccessToken: true,
845866 ProxyUpstream: "static://200/static-proxy",
846867 })
847−
848− defer patTest.Close()
868+ if err != nil {
869+ t.Fatal(err)
870+ }
871+ t.Cleanup(patTest.Close)
849872
850873 // A successful validation will redirect and set the auth cookie.
851874 code, cookie := patTest.getCallbackEndpoint()
@@ -864,10 +887,13 @@ func TestStaticProxyUpstream(t *testing.T) {
864887}
865888
866889func TestDoNotForwardAccessTokenUpstream(t *testing.T) {
867− patTest := NewPassAccessTokenTest(PassAccessTokenTestOptions{
890+ patTest, err := NewPassAccessTokenTest(PassAccessTokenTestOptions{
868891 PassAccessToken: false,
869892 })
870− defer patTest.Close()
893+ if err != nil {
894+ t.Fatal(err)
895+ }
896+ t.Cleanup(patTest.Close)
871897
872898 // A successful validation will redirect and set the auth cookie.
873899 code, cookie := patTest.getCallbackEndpoint()
@@ -895,27 +921,26 @@ type SignInPageTest struct {
895921const signInRedirectPattern = `<input type="hidden" name="rd" value="(.*)">`
896922const signInSkipProvider = `>Found<`
897923
898−func NewSignInPageTest(skipProvider bool) *SignInPageTest {
924+func NewSignInPageTest(skipProvider bool) (*SignInPageTest, error) {
899925 var sipTest SignInPageTest
900926
901927 sipTest.opts = baseTestOptions()
902− sipTest.opts.Cookie.Secret = rawCookieSecret
903− sipTest.opts.ClientID = "lkdgj"
904− sipTest.opts.ClientSecret = "sgiufgoi"
905928 sipTest.opts.SkipProviderButton = skipProvider
906− validation.Validate(sipTest.opts)
929+ err := validation.Validate(sipTest.opts)
930+ if err != nil {
931+ return nil, err
932+ }
907933
908− var err error
909934 sipTest.proxy, err = NewOAuthProxy(sipTest.opts, func(email string) bool {
910935 return true
911936 })
912937 if err != nil {
913− panic(err)
938+ return nil, err
914939 }
915940 sipTest.signInRegexp = regexp.MustCompile(signInRedirectPattern)
916941 sipTest.signInProviderRegexp = regexp.MustCompile(signInSkipProvider)
917942
918− return &sipTest
943+ return &sipTest, nil
919944}
920945
921946func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
@@ -926,7 +951,10 @@ func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
926951}
927952
928953func TestSignInPageIncludesTargetRedirect(t *testing.T) {
929− sipTest := NewSignInPageTest(false)
954+ sipTest, err := NewSignInPageTest(false)
955+ if err != nil {
956+ t.Fatal(err)
957+ }
930958 const endpoint = "/some/random/endpoint"
931959
932960 code, body := sipTest.GetEndpoint(endpoint)
@@ -944,7 +972,10 @@ func TestSignInPageIncludesTargetRedirect(t *testing.T) {
944972}
945973
946974func TestSignInPageDirectAccessRedirectsToRoot(t *testing.T) {
947− sipTest := NewSignInPageTest(false)
975+ sipTest, err := NewSignInPageTest(false)
976+ if err != nil {
977+ t.Fatal(err)
978+ }
948979 code, body := sipTest.GetEndpoint("/oauth2/sign_in")
949980 assert.Equal(t, 200, code)
950981
@@ -959,8 +990,12 @@ func TestSignInPageDirectAccessRedirectsToRoot(t *testing.T) {
959990}
960991
961992func TestSignInPageSkipProvider(t *testing.T) {
962− sipTest := NewSignInPageTest(true)
963− const endpoint = "/some/random/endpoint"
993+ sipTest, err := NewSignInPageTest(true)
994+ if err != nil {
995+ t.Fatal(err)
996+ }
997+
998+ endpoint := "/some/random/endpoint"
964999
9651000 code, body := sipTest.GetEndpoint(endpoint)
9661001 assert.Equal(t, 302, code)
@@ -973,8 +1008,12 @@ func TestSignInPageSkipProvider(t *testing.T) {
9731008}
9741009
9751010func TestSignInPageSkipProviderDirect(t *testing.T) {
976− sipTest := NewSignInPageTest(true)
977− const endpoint = "/sign_in"
1011+ sipTest, err := NewSignInPageTest(true)
1012+ if err != nil {
1013+ t.Fatal(err)
1014+ }
1015+
1016+ endpoint := "/sign_in"
9781017
9791018 code, body := sipTest.GetEndpoint(endpoint)
9801019 assert.Equal(t, 302, code)
@@ -1000,27 +1039,26 @@ type ProcessCookieTestOpts struct {
10001039
10011040type OptionsModifier func(*options.Options)
10021041
1003−func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifier) *ProcessCookieTest {
1042+func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifier) (*ProcessCookieTest, error) {
10041043 var pcTest ProcessCookieTest
10051044
10061045 pcTest.opts = baseTestOptions()
10071046 for _, modifier := range modifiers {
10081047 modifier(pcTest.opts)
10091048 }
1010− pcTest.opts.ClientID = "asdfljk"
1011− pcTest.opts.ClientSecret = "lkjfdsig"
1012− pcTest.opts.Cookie.Secret = "0123456789abcdef0123456789abcdef"
10131049 // First, set the CookieRefresh option so proxy.AesCipher is created,
10141050 // needed to encrypt the access_token.
10151051 pcTest.opts.Cookie.Refresh = time.Hour
1016− validation.Validate(pcTest.opts)
1052+ err := validation.Validate(pcTest.opts)
1053+ if err != nil {
1054+ return nil, err
1055+ }
10171056
1018− var err error
10191057 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
10201058 return pcTest.validateUser
10211059 })
10221060 if err != nil {
1023− panic(err)
1061+ return nil, err
10241062 }
10251063 pcTest.proxy.provider = &TestProvider{
10261064 ValidToken: opts.providerValidateCookieResponse,
@@ -1032,16 +1070,16 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifi
10321070 pcTest.rw = httptest.NewRecorder()
10331071 pcTest.req, _ = http.NewRequest("GET", "/", strings.NewReader(""))
10341072 pcTest.validateUser = true
1035− return &pcTest
1073+ return &pcTest, nil
10361074}
10371075
1038−func NewProcessCookieTestWithDefaults() *ProcessCookieTest {
1076+func NewProcessCookieTestWithDefaults() (*ProcessCookieTest, error) {
10391077 return NewProcessCookieTest(ProcessCookieTestOpts{
10401078 providerValidateCookieResponse: true,
10411079 })
10421080}
10431081
1044−func NewProcessCookieTestWithOptionsModifiers(modifiers ...OptionsModifier) *ProcessCookieTest {
1082+func NewProcessCookieTestWithOptionsModifiers(modifiers ...OptionsModifier) (*ProcessCookieTest, error) {
10451083 return NewProcessCookieTest(ProcessCookieTestOpts{
10461084 providerValidateCookieResponse: true,
10471085 }, modifiers...)
@@ -1063,37 +1101,51 @@ func (p *ProcessCookieTest) LoadCookiedSession() (*sessions.SessionState, error)
10631101}
10641102
10651103func TestLoadCookiedSession(t *testing.T) {
1066− pcTest := NewProcessCookieTestWithDefaults()
1104+ pcTest, err := NewProcessCookieTestWithDefaults()
1105+ if err != nil {
1106+ t.Fatal(err)
1107+ }
10671108
10681109 created := time.Now()
10691110 startSession := &sessions.SessionState{Email: "john.doe@example.com", AccessToken: "my_access_token", CreatedAt: &created}
1070− pcTest.SaveSession(startSession)
1111+ err = pcTest.SaveSession(startSession)
1112+ assert.NoError(t, err)
10711113
10721114 session, err := pcTest.LoadCookiedSession()
1073− assert.Equal(t, nil, err)
1115+ if err != nil {
1116+ t.Fatal(err)
1117+ }
10741118 assert.Equal(t, startSession.Email, session.Email)
10751119 assert.Equal(t, "", session.User)
10761120 assert.Equal(t, startSession.AccessToken, session.AccessToken)
10771121}
10781122
10791123func TestProcessCookieNoCookieError(t *testing.T) {
1080− pcTest := NewProcessCookieTestWithDefaults()
1124+ pcTest, err := NewProcessCookieTestWithDefaults()
1125+ if err != nil {
1126+ t.Fatal(err)
1127+ }
10811128
10821129 session, err := pcTest.LoadCookiedSession()
1083− assert.Equal(t, "cookie \"_oauth2_proxy\" not present", err.Error())
1130+ assert.Error(t, err, "cookie \"_oauth2_proxy\" not present")
10841131 if session != nil {
10851132 t.Errorf("expected nil session. got %#v", session)
10861133 }
10871134}
10881135
10891136func TestProcessCookieRefreshNotSet(t *testing.T) {
1090− pcTest := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
1137+ pcTest, err := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
10911138 opts.Cookie.Expire = time.Duration(23) * time.Hour
10921139 })
1140+ if err != nil {
1141+ t.Fatal(err)
1142+ }
1143+
10931144 reference := time.Now().Add(time.Duration(-2) * time.Hour)
10941145
10951146 startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1096− pcTest.SaveSession(startSession)
1147+ err = pcTest.SaveSession(startSession)
1148+ assert.NoError(t, err)
10971149
10981150 session, err := pcTest.LoadCookiedSession()
10991151 assert.Equal(t, nil, err)
@@ -1104,12 +1156,17 @@ func TestProcessCookieRefreshNotSet(t *testing.T) {
11041156}
11051157
11061158func TestProcessCookieFailIfCookieExpired(t *testing.T) {
1107− pcTest := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
1159+ pcTest, err := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
11081160 opts.Cookie.Expire = time.Duration(24) * time.Hour
11091161 })
1162+ if err != nil {
1163+ t.Fatal(err)
1164+ }
1165+
11101166 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
11111167 startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1112− pcTest.SaveSession(startSession)
1168+ err = pcTest.SaveSession(startSession)
1169+ assert.NoError(t, err)
11131170
11141171 session, err := pcTest.LoadCookiedSession()
11151172 assert.NotEqual(t, nil, err)
@@ -1119,12 +1176,17 @@ func TestProcessCookieFailIfCookieExpired(t *testing.T) {
11191176}
11201177
11211178func TestProcessCookieFailIfRefreshSetAndCookieExpired(t *testing.T) {
1122− pcTest := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
1179+ pcTest, err := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
11231180 opts.Cookie.Expire = time.Duration(24) * time.Hour
11241181 })
1182+ if err != nil {
1183+ t.Fatal(err)
1184+ }
1185+
11251186 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
11261187 startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1127− pcTest.SaveSession(startSession)
1188+ err = pcTest.SaveSession(startSession)
1189+ assert.NoError(t, err)
11281190
11291191 pcTest.proxy.CookieRefresh = time.Hour
11301192 session, err := pcTest.LoadCookiedSession()
@@ -1134,18 +1196,26 @@ func TestProcessCookieFailIfRefreshSetAndCookieExpired(t *testing.T) {
11341196 }
11351197}
11361198
1137−func NewUserInfoEndpointTest() *ProcessCookieTest {
1138− pcTest := NewProcessCookieTestWithDefaults()
1199+func NewUserInfoEndpointTest() (*ProcessCookieTest, error) {
1200+ pcTest, err := NewProcessCookieTestWithDefaults()
1201+ if err != nil {
1202+ return nil, err
1203+ }
11391204 pcTest.req, _ = http.NewRequest("GET",
11401205 pcTest.opts.ProxyPrefix+"/userinfo", nil)
1141− return pcTest
1206+ return pcTest, nil
11421207}
11431208
11441209func TestUserInfoEndpointAccepted(t *testing.T) {
1145− test := NewUserInfoEndpointTest()
1210+ test, err := NewUserInfoEndpointTest()
1211+ if err != nil {
1212+ t.Fatal(err)
1213+ }
1214+
11461215 startSession := &sessions.SessionState{
11471216 Email: "john.doe@example.com", AccessToken: "my_access_token"}
1148− test.SaveSession(startSession)
1217+ err = test.SaveSession(startSession)
1218+ assert.NoError(t, err)
11491219
11501220 test.proxy.ServeHTTP(test.rw, test.req)
11511221 assert.Equal(t, http.StatusOK, test.rw.Code)
@@ -1154,25 +1224,36 @@ func TestUserInfoEndpointAccepted(t *testing.T) {
11541224}
11551225
11561226func TestUserInfoEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
1157− test := NewUserInfoEndpointTest()
1227+ test, err := NewUserInfoEndpointTest()
1228+ if err != nil {
1229+ t.Fatal(err)
1230+ }
11581231
11591232 test.proxy.ServeHTTP(test.rw, test.req)
11601233 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
11611234}
11621235
1163−func NewAuthOnlyEndpointTest(modifiers ...OptionsModifier) *ProcessCookieTest {
1164− pcTest := NewProcessCookieTestWithOptionsModifiers(modifiers...)
1236+func NewAuthOnlyEndpointTest(modifiers ...OptionsModifier) (*ProcessCookieTest, error) {
1237+ pcTest, err := NewProcessCookieTestWithOptionsModifiers(modifiers...)
1238+ if err != nil {
1239+ return nil, err
1240+ }
11651241 pcTest.req, _ = http.NewRequest("GET",
11661242 pcTest.opts.ProxyPrefix+"/auth", nil)
1167− return pcTest
1243+ return pcTest, nil
11681244}
11691245
11701246func TestAuthOnlyEndpointAccepted(t *testing.T) {
1171− test := NewAuthOnlyEndpointTest()
1247+ test, err := NewAuthOnlyEndpointTest()
1248+ if err != nil {
1249+ t.Fatal(err)
1250+ }
1251+
11721252 created := time.Now()
11731253 startSession := &sessions.SessionState{
11741254 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}
1175− test.SaveSession(startSession)
1255+ err = test.SaveSession(startSession)
1256+ assert.NoError(t, err)
11761257
11771258 test.proxy.ServeHTTP(test.rw, test.req)
11781259 assert.Equal(t, http.StatusAccepted, test.rw.Code)
@@ -1181,7 +1262,10 @@ func TestAuthOnlyEndpointAccepted(t *testing.T) {
11811262}
11821263
11831264func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
1184− test := NewAuthOnlyEndpointTest()
1265+ test, err := NewAuthOnlyEndpointTest()
1266+ if err != nil {
1267+ t.Fatal(err)
1268+ }
11851269
11861270 test.proxy.ServeHTTP(test.rw, test.req)
11871271 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
@@ -1190,13 +1274,18 @@ func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
11901274}
11911275
11921276func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {
1193− test := NewAuthOnlyEndpointTest(func(opts *options.Options) {
1277+ test, err := NewAuthOnlyEndpointTest(func(opts *options.Options) {
11941278 opts.Cookie.Expire = time.Duration(24) * time.Hour
11951279 })
1280+ if err != nil {
1281+ t.Fatal(err)
1282+ }
1283+
11961284 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
11971285 startSession := &sessions.SessionState{
11981286 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1199− test.SaveSession(startSession)
1287+ err = test.SaveSession(startSession)
1288+ assert.NoError(t, err)
12001289
12011290 test.proxy.ServeHTTP(test.rw, test.req)
12021291 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
@@ -1205,11 +1294,16 @@ func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {
12051294}
12061295
12071296func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {
1208− test := NewAuthOnlyEndpointTest()
1297+ test, err := NewAuthOnlyEndpointTest()
1298+ if err != nil {
1299+ t.Fatal(err)
1300+ }
1301+
12091302 created := time.Now()
12101303 startSession := &sessions.SessionState{
12111304 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}
1212− test.SaveSession(startSession)
1305+ err = test.SaveSession(startSession)
1306+ assert.NoError(t, err)
12131307 test.validateUser = false
12141308
12151309 test.proxy.ServeHTTP(test.rw, test.req)
@@ -1224,15 +1318,13 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
12241318 pcTest.opts = baseTestOptions()
12251319 pcTest.opts.SetXAuthRequest = true
12261320 err := validation.Validate(pcTest.opts)
1227− if err != nil {
1228− panic(err)
1229− }
1321+ assert.NoError(t, err)
12301322
12311323 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
12321324 return pcTest.validateUser
12331325 })
12341326 if err != nil {
1235− panic(err)
1327+ t.Fatal(err)
12361328 }
12371329 pcTest.proxy.provider = &TestProvider{
12381330 ValidToken: true,
@@ -1247,7 +1339,8 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
12471339 created := time.Now()
12481340 startSession := &sessions.SessionState{
12491341 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}
1250− pcTest.SaveSession(startSession)
1342+ err = pcTest.SaveSession(startSession)
1343+ assert.NoError(t, err)
12511344
12521345 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)
12531346 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)
@@ -1261,14 +1354,14 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
12611354 pcTest.opts = baseTestOptions()
12621355 pcTest.opts.SetXAuthRequest = true
12631356 pcTest.opts.SetBasicAuth = true
1264− validation.Validate(pcTest.opts)
1357+ err := validation.Validate(pcTest.opts)
1358+ assert.NoError(t, err)
12651359
1266− var err error
12671360 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
12681361 return pcTest.validateUser
12691362 })
12701363 if err != nil {
1271− panic(err)
1364+ t.Fatal(err)
12721365 }
12731366 pcTest.proxy.provider = &TestProvider{
12741367 ValidToken: true,
@@ -1283,7 +1376,8 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
12831376 created := time.Now()
12841377 startSession := &sessions.SessionState{
12851378 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}
1286− pcTest.SaveSession(startSession)
1379+ err = pcTest.SaveSession(startSession)
1380+ assert.NoError(t, err)
12871381
12881382 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)
12891383 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)
@@ -1299,14 +1393,14 @@ func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
12991393 pcTest.opts = baseTestOptions()
13001394 pcTest.opts.SetXAuthRequest = true
13011395 pcTest.opts.SetBasicAuth = false
1302− validation.Validate(pcTest.opts)
1396+ err := validation.Validate(pcTest.opts)
1397+ assert.NoError(t, err)
13031398
1304− var err error
13051399 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
13061400 return pcTest.validateUser
13071401 })
13081402 if err != nil {
1309− panic(err)
1403+ t.Fatal(err)
13101404 }
13111405 pcTest.proxy.provider = &TestProvider{
13121406 ValidToken: true,
@@ -1321,7 +1415,8 @@ func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
13211415 created := time.Now()
13221416 startSession := &sessions.SessionState{
13231417 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}
1324− pcTest.SaveSession(startSession)
1418+ err = pcTest.SaveSession(startSession)
1419+ assert.NoError(t, err)
13251420
13261421 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)
13271422 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)
@@ -1333,20 +1428,26 @@ func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
13331428func TestAuthSkippedForPreflightRequests(t *testing.T) {
13341429 upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
13351430 w.WriteHeader(200)
1336− w.Write([]byte("response"))
1431+ _, err := w.Write([]byte("response"))
1432+ if err != nil {
1433+ t.Fatal(err)
1434+ }
13371435 }))
1338− defer upstream.Close()
1436+ t.Cleanup(upstream.Close)
13391437
13401438 opts := baseTestOptions()
13411439 opts.Upstreams = append(opts.Upstreams, upstream.URL)
13421440 opts.SkipAuthPreflight = true
1343− validation.Validate(opts)
1441+ err := validation.Validate(opts)
1442+ assert.NoError(t, err)
13441443
13451444 upstreamURL, _ := url.Parse(upstream.URL)
13461445 opts.SetProvider(NewTestProvider(upstreamURL, ""))
13471446
13481447 proxy, err := NewOAuthProxy(opts, func(string) bool { return false })
1349− assert.NoError(t, err)
1448+ if err != nil {
1449+ t.Fatal(err)
1450+ }
13501451 rw := httptest.NewRecorder()
13511452 req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)
13521453 proxy.ServeHTTP(rw, req)
@@ -1361,16 +1462,25 @@ type SignatureAuthenticator struct {
13611462
13621463func (v *SignatureAuthenticator) Authenticate(w http.ResponseWriter, r *http.Request) {
13631464 result, headerSig, computedSig := v.auth.AuthenticateRequest(r)
1364− if result == hmacauth.ResultNoSignature {
1365− w.Write([]byte("no signature received"))
1366− } else if result == hmacauth.ResultMatch {
1367− w.Write([]byte("signatures match"))
1368− } else if result == hmacauth.ResultMismatch {
1369− w.Write([]byte("signatures do not match:" +
1370− "\n received: " + headerSig +
1371− "\n computed: " + computedSig))
1372− } else {
1373− panic("Unknown result value: " + result.String())
1465+
1466+ var msg string
1467+ switch result {
1468+ case hmacauth.ResultNoSignature:
1469+ msg = "no signature received"
1470+ case hmacauth.ResultMatch:
1471+ msg = "signatures match"
1472+ case hmacauth.ResultMismatch:
1473+ msg = fmt.Sprintf(
1474+ "signatures do not match:\n received: %s\n computed: %s",
1475+ headerSig,
1476+ computedSig)
1477+ default:
1478+ panic("unknown result value: " + result.String())
1479+ }
1480+
1481+ _, err := w.Write([]byte(msg))
1482+ if err != nil {
1483+ panic(err)
13741484 }
13751485}
13761486
@@ -1384,24 +1494,30 @@ type SignatureTest struct {
13841494 authenticator *SignatureAuthenticator
13851495}
13861496
1387−func NewSignatureTest() *SignatureTest {
1497+func NewSignatureTest() (*SignatureTest, error) {
13881498 opts := baseTestOptions()
1389− opts.Cookie.Secret = rawCookieSecret
1390− opts.ClientID = "client ID"
1391− opts.ClientSecret = "client secret"
13921499 opts.EmailDomains = []string{"acm.org"}
13931500
13941501 authenticator := &SignatureAuthenticator{}
13951502 upstream := httptest.NewServer(
13961503 http.HandlerFunc(authenticator.Authenticate))
1397− upstreamURL, _ := url.Parse(upstream.URL)
1504+ upstreamURL, err := url.Parse(upstream.URL)
1505+ if err != nil {
1506+ return nil, err
1507+ }
13981508 opts.Upstreams = append(opts.Upstreams, upstream.URL)
13991509
14001510 providerHandler := func(w http.ResponseWriter, r *http.Request) {
1401− w.Write([]byte(`{"access_token": "my_auth_token"}`))
1511+ _, err := w.Write([]byte(`{"access_token": "my_auth_token"}`))
1512+ if err != nil {
1513+ panic(err)
1514+ }
14021515 }
14031516 provider := httptest.NewServer(http.HandlerFunc(providerHandler))
1404− providerURL, _ := url.Parse(provider.URL)
1517+ providerURL, err := url.Parse(provider.URL)
1518+ if err != nil {
1519+ return nil, err
1520+ }
14051521 opts.SetProvider(NewTestProvider(providerURL, "mbland@acm.org"))
14061522
14071523 return &SignatureTest{
@@ -1412,7 +1528,7 @@ func NewSignatureTest() *SignatureTest {
14121528 make(http.Header),
14131529 httptest.NewRecorder(),
14141530 authenticator,
1415− }
1531+ }, nil
14161532}
14171533
14181534func (st *SignatureTest) Close() {
@@ -1436,14 +1552,14 @@ func (fnc *fakeNetConn) Read(p []byte) (n int, err error) {
14361552 return 0, io.EOF
14371553}
14381554
1439−func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) {
1555+func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) error {
14401556 err := validation.Validate(st.opts)
14411557 if err != nil {
1442− panic(err)
1558+ return err
14431559 }
14441560 proxy, err := NewOAuthProxy(st.opts, func(email string) bool { return true })
14451561 if err != nil {
1446− panic(err)
1562+ return err
14471563 }
14481564
14491565 var bodyBuf io.ReadCloser
@@ -1457,7 +1573,7 @@ func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) {
14571573 Email: "mbland@acm.org", AccessToken: "my_access_token"}
14581574 err = proxy.SaveSession(st.rw, req, state)
14591575 if err != nil {
1460− panic(err)
1576+ return err
14611577 }
14621578 for _, c := range st.rw.Result().Cookies() {
14631579 req.AddCookie(c)
@@ -1466,33 +1582,52 @@ func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) {
14661582 st.authenticator.auth = hmacauth.NewHmacAuth(
14671583 crypto.SHA1, []byte(key), SignatureHeader, SignatureHeaders)
14681584 proxy.ServeHTTP(st.rw, req)
1469−}
1470−
1471−func TestNoRequestSignature(t *testing.T) {
1472− st := NewSignatureTest()
1473− defer st.Close()
1474− st.MakeRequestWithExpectedKey("GET", "", "")
1475− assert.Equal(t, 200, st.rw.Code)
1476− assert.Equal(t, st.rw.Body.String(), "no signature received")
1477−}
14781585
1479−func TestRequestSignatureGetRequest(t *testing.T) {
1480− st := NewSignatureTest()
1481− defer st.Close()
1482− st.opts.SignatureKey = "sha1:7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d"
1483− st.MakeRequestWithExpectedKey("GET", "", "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d")
1484− assert.Equal(t, 200, st.rw.Code)
1485− assert.Equal(t, st.rw.Body.String(), "signatures match")
1586+ return nil
14861587}
14871588
1488−func TestRequestSignaturePostRequest(t *testing.T) {
1489− st := NewSignatureTest()
1490− defer st.Close()
1491− st.opts.SignatureKey = "sha1:d90df39e2d19282840252612dd7c81421a372f61"
1492− payload := `{ "hello": "world!" }`
1493− st.MakeRequestWithExpectedKey("POST", payload, "d90df39e2d19282840252612dd7c81421a372f61")
1494− assert.Equal(t, 200, st.rw.Code)
1495− assert.Equal(t, st.rw.Body.String(), "signatures match")
1589+func TestRequestSignature(t *testing.T) {
1590+ testCases := map[string]struct {
1591+ method string
1592+ body string
1593+ key string
1594+ resp string
1595+ }{
1596+ "No request signature": {
1597+ method: "GET",
1598+ body: "",
1599+ key: "",
1600+ resp: "no signature received",
1601+ },
1602+ "Get request": {
1603+ method: "GET",
1604+ body: "",
1605+ key: "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d",
1606+ resp: "signatures match",
1607+ },
1608+ "Post request": {
1609+ method: "POST",
1610+ body: `{ "hello": "world!" }`,
1611+ key: "d90df39e2d19282840252612dd7c81421a372f61",
1612+ resp: "signatures match",
1613+ },
1614+ }
1615+ for name, tc := range testCases {
1616+ t.Run(name, func(t *testing.T) {
1617+ st, err := NewSignatureTest()
1618+ if err != nil {
1619+ t.Fatal(err)
1620+ }
1621+ t.Cleanup(st.Close)
1622+ if tc.key != "" {
1623+ st.opts.SignatureKey = fmt.Sprintf("sha1:%s", tc.key)
1624+ }
1625+ err = st.MakeRequestWithExpectedKey(tc.method, tc.body, tc.key)
1626+ assert.NoError(t, err)
1627+ assert.Equal(t, 200, st.rw.Code)
1628+ assert.Equal(t, tc.resp, st.rw.Body.String())
1629+ })
1630+ }
14961631}
14971632
14981633func TestGetRedirect(t *testing.T) {
@@ -1501,7 +1636,9 @@ func TestGetRedirect(t *testing.T) {
15011636 assert.NoError(t, err)
15021637 require.NotEmpty(t, opts.ProxyPrefix)
15031638 proxy, err := NewOAuthProxy(opts, func(s string) bool { return false })
1504− assert.NoError(t, err)
1639+ if err != nil {
1640+ t.Fatal(err)
1641+ }
15051642
15061643 tests := []struct {
15071644 name string
@@ -1535,22 +1672,21 @@ type ajaxRequestTest struct {
15351672 proxy *OAuthProxy
15361673}
15371674
1538−func newAjaxRequestTest() *ajaxRequestTest {
1675+func newAjaxRequestTest() (*ajaxRequestTest, error) {
15391676 test := &ajaxRequestTest{}
15401677 test.opts = baseTestOptions()
1541− test.opts.Cookie.Secret = base64CookieSecret
1542− test.opts.ClientID = "gkljfdl"
1543− test.opts.ClientSecret = "sdflkjs"
1544− validation.Validate(test.opts)
1678+ err := validation.Validate(test.opts)
1679+ if err != nil {
1680+ return nil, err
1681+ }
15451682
1546− var err error
15471683 test.proxy, err = NewOAuthProxy(test.opts, func(email string) bool {
15481684 return true
15491685 })
15501686 if err != nil {
1551− panic(err)
1687+ return nil, err
15521688 }
1553− return test
1689+ return test, nil
15541690}
15551691
15561692func (test *ajaxRequestTest) getEndpoint(endpoint string, header http.Header) (int, http.Header, error) {
@@ -1565,7 +1701,10 @@ func (test *ajaxRequestTest) getEndpoint(endpoint string, header http.Header) (i
15651701}
15661702
15671703func testAjaxUnauthorizedRequest(t *testing.T, header http.Header) {
1568− test := newAjaxRequestTest()
1704+ test, err := newAjaxRequestTest()
1705+ if err != nil {
1706+ t.Fatal(err)
1707+ }
15691708 endpoint := "/test"
15701709
15711710 code, rh, err := test.getEndpoint(endpoint, header)
@@ -1589,7 +1728,10 @@ func TestAjaxUnauthorizedRequest2(t *testing.T) {
15891728}
15901729
15911730func TestAjaxForbiddendRequest(t *testing.T) {
1592− test := newAjaxRequestTest()
1731+ test, err := newAjaxRequestTest()
1732+ if err != nil {
1733+ t.Fatal(err)
1734+ }
15931735 endpoint := "/test"
15941736 header := make(http.Header)
15951737 code, rh, err := test.getEndpoint(endpoint, header)
@@ -1604,8 +1746,14 @@ func TestClearSplitCookie(t *testing.T) {
16041746 opts.Cookie.Secret = base64CookieSecret
16051747 opts.Cookie.Name = "oauth2"
16061748 opts.Cookie.Domains = []string{"abc"}
1607− store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
1608− assert.Equal(t, nil, err)
1749+ err := validation.Validate(opts)
1750+ assert.NoError(t, err)
1751+
1752+ store, err := sessionscookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
1753+ if err != nil {
1754+ t.Fatal(err)
1755+ }
1756+
16091757 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}
16101758 var rw = httptest.NewRecorder()
16111759 req := httptest.NewRequest("get", "/", nil)
@@ -1623,7 +1771,8 @@ func TestClearSplitCookie(t *testing.T) {
16231771 Value: "oauth2_1",
16241772 })
16251773
1626− p.ClearSessionCookie(rw, req)
1774+ err = p.ClearSessionCookie(rw, req)
1775+ assert.NoError(t, err)
16271776 header := rw.Header()
16281777
16291778 assert.Equal(t, 2, len(header["Set-Cookie"]), "should have 3 set-cookie header entries")
@@ -1633,8 +1782,11 @@ func TestClearSingleCookie(t *testing.T) {
16331782 opts := baseTestOptions()
16341783 opts.Cookie.Name = "oauth2"
16351784 opts.Cookie.Domains = []string{"abc"}
1636− store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
1637− assert.Equal(t, nil, err)
1785+ store, err := sessionscookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
1786+ if err != nil {
1787+ t.Fatal(err)
1788+ }
1789+
16381790 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}
16391791 var rw = httptest.NewRecorder()
16401792 req := httptest.NewRequest("get", "/", nil)
@@ -1648,7 +1800,8 @@ func TestClearSingleCookie(t *testing.T) {
16481800 Value: "oauth2",
16491801 })
16501802
1651− p.ClearSessionCookie(rw, req)
1803+ err = p.ClearSessionCookie(rw, req)
1804+ assert.NoError(t, err)
16521805 header := rw.Header()
16531806
16541807 assert.Equal(t, 1, len(header["Set-Cookie"]), "should have 1 set-cookie header entries")
@@ -1686,13 +1839,16 @@ func TestGetJwtSession(t *testing.T) {
16861839 verifier := oidc.NewVerifier("https://issuer.example.com", keyset,
16871840 &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})
16881841
1689− test := NewAuthOnlyEndpointTest(func(opts *options.Options) {
1842+ test, err := NewAuthOnlyEndpointTest(func(opts *options.Options) {
16901843 opts.PassAuthorization = true
16911844 opts.SetAuthorization = true
16921845 opts.SetXAuthRequest = true
16931846 opts.SkipJwtBearerTokens = true
16941847 opts.SetJWTBearerVerifiers(append(opts.GetJWTBearerVerifiers(), verifier))
16951848 })
1849+ if err != nil {
1850+ t.Fatal(err)
1851+ }
16961852 tp, _ := test.proxy.provider.(*TestProvider)
16971853 tp.GroupValidator = func(s string) bool {
16981854 return true
@@ -1705,7 +1861,8 @@ func TestGetJwtSession(t *testing.T) {
17051861
17061862 // Bearer
17071863 expires := time.Unix(1912151821, 0)
1708− session, _ := test.proxy.GetJwtSession(test.req)
1864+ session, err := test.proxy.GetJwtSession(test.req)
1865+ assert.NoError(t, err)
17091866 assert.Equal(t, session.User, "1234567890")
17101867 assert.Equal(t, session.Email, "john@example.com")
17111868 assert.Equal(t, session.ExpiresOn, &expires)
@@ -1739,22 +1896,26 @@ func TestFindJwtBearerToken(t *testing.T) {
17391896 "Authorization": {fmt.Sprintf("Bearer %s", validToken)},
17401897 }
17411898
1742− token, _ = p.findBearerToken(getReq)
1899+ token, err := p.findBearerToken(getReq)
1900+ assert.NoError(t, err)
17431901 assert.Equal(t, validToken, token)
17441902
17451903 // Basic - no password
17461904 getReq.SetBasicAuth(token, "")
1747− token, _ = p.findBearerToken(getReq)
1905+ token, err = p.findBearerToken(getReq)
1906+ assert.NoError(t, err)
17481907 assert.Equal(t, validToken, token)
17491908
17501909 // Basic - sentinel password
17511910 getReq.SetBasicAuth(token, "x-oauth-basic")
1752− token, _ = p.findBearerToken(getReq)
1911+ token, err = p.findBearerToken(getReq)
1912+ assert.NoError(t, err)
17531913 assert.Equal(t, validToken, token)
17541914
17551915 // Basic - any username, password matching jwt pattern
17561916 getReq.SetBasicAuth("any-username-you-could-wish-for", token)
1757− token, _ = p.findBearerToken(getReq)
1917+ token, err = p.findBearerToken(getReq)
1918+ assert.NoError(t, err)
17581919 assert.Equal(t, validToken, token)
17591920
17601921 failures := []string{
@@ -1785,8 +1946,6 @@ func TestFindJwtBearerToken(t *testing.T) {
17851946 _, err := p.findBearerToken(getReq)
17861947 assert.Error(t, err)
17871948 }
1788−
1789− fmt.Printf("%s", token)
17901949}
17911950
17921951func Test_prepareNoCache(t *testing.T) {
@@ -1807,18 +1966,22 @@ func Test_prepareNoCache(t *testing.T) {
18071966
18081967func Test_noCacheHeaders(t *testing.T) {
18091968 upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
1810− w.Write([]byte("upstream"))
1969+ _, err := w.Write([]byte("upstream"))
1970+ if err != nil {
1971+ t.Error(err)
1972+ }
18111973 }))
18121974 t.Cleanup(upstream.Close)
18131975
18141976 opts := baseTestOptions()
18151977 opts.Upstreams = []string{upstream.URL}
18161978 opts.SkipAuthRegex = []string{".*"}
1817− _ = validation.Validate(opts)
1818− proxy, err := NewOAuthProxy(opts, func(email string) bool {
1819− return true
1820− })
1979+ err := validation.Validate(opts)
18211980 assert.NoError(t, err)
1981+ proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })
1982+ if err != nil {
1983+ t.Fatal(err)
1984+ }
18221985
18231986 t.Run("not exist in response from upstream", func(t *testing.T) {
18241987 rec := httptest.NewRecorder()
@@ -1887,8 +2050,8 @@ func Test_noCacheHeaders(t *testing.T) {
18872050func baseTestOptions() *options.Options {
18882051 opts := options.NewOptions()
18892052 opts.Cookie.Secret = rawCookieSecret
1890− opts.ClientID = "cliend-id"
1891− opts.ClientSecret = "client-secret"
2053+ opts.ClientID = clientID
2054+ opts.ClientSecret = clientSecret
18922055 opts.EmailDomains = []string{"*"}
18932056 return opts
18942057}