@@ -23,7 +23,7 @@ import (
23 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"
23 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"
24 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
24 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
25 "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"
25 "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"
26− "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/cookie"
26+ sessionscookie "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/cookie"
27 "github.com/oauth2-proxy/oauth2-proxy/pkg/validation"
27 "github.com/oauth2-proxy/oauth2-proxy/pkg/validation"
28 "github.com/oauth2-proxy/oauth2-proxy/providers"
28 "github.com/oauth2-proxy/oauth2-proxy/providers"
29 "github.com/stretchr/testify/assert"
29 "github.com/stretchr/testify/assert"
@@ -36,11 +36,12 @@ const (
36 // encoded version of this.
36 // encoded version of this.
37 rawCookieSecret = "secretthirtytwobytes+abcdefghijk"
37 rawCookieSecret = "secretthirtytwobytes+abcdefghijk"
38 base64CookieSecret = "c2VjcmV0dGhpcnR5dHdvYnl0ZXMrYWJjZGVmZ2hpams"
38 base64CookieSecret = "c2VjcmV0dGhpcnR5dHdvYnl0ZXMrYWJjZGVmZ2hpams"
39+ clientID = "3984n253984d7348dm8234yf982t"
40+ clientSecret = "gv3498mfc9t23y23974dm2394dm9"
41func init() {
43func init() {
42 logger.SetFlags(logger.Lshortfile)
44 logger.SetFlags(logger.Lshortfile)
46type WebSocketOrRestHandler struct {
47type WebSocketOrRestHandler struct {
@@ -61,24 +62,30 @@ func TestWebSocketProxy(t *testing.T) {
61 restHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
62 restHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
62 w.WriteHeader(200)
63 w.WriteHeader(200)
63 hostname, _, _ := net.SplitHostPort(r.Host)
64 hostname, _, _ := net.SplitHostPort(r.Host)
64− w.Write([]byte(hostname))
65+ _, err := w.Write([]byte(hostname))
66 wsHandler: websocket.Handler(func(ws *websocket.Conn) {
70 wsHandler: websocket.Handler(func(ws *websocket.Conn) {
71+ defer func(t *testing.T) {
67− defer ws.Close()
72+ if err := ws.Close(); err != nil {
68 var data []byte
76 var data []byte
69 err := websocket.Message.Receive(ws, &data)
77 err := websocket.Message.Receive(ws, &data)
70 if err != nil {
78 if err != nil {
71− t.Fatalf("err %s", err)
79+ t.Fatal(err)
74 err = websocket.Message.Send(ws, data)
81 err = websocket.Message.Send(ws, data)
75 if err != nil {
82 if err != nil {
76− t.Fatalf("err %s", err)
83+ t.Fatal(err)
80 backend := httptest.NewServer(&handler)
87 backend := httptest.NewServer(&handler)
81− defer backend.Close()
88+ t.Cleanup(backend.Close)
83 backendURL, _ := url.Parse(backend.URL)
90 backendURL, _ := url.Parse(backend.URL)
@@ -87,24 +94,24 @@ func TestWebSocketProxy(t *testing.T) {
87 opts.PassHostHeader = true
94 opts.PassHostHeader = true
88 proxyHandler := NewWebSocketOrRestReverseProxy(backendURL, opts, auth)
95 proxyHandler := NewWebSocketOrRestReverseProxy(backendURL, opts, auth)
89 frontend := httptest.NewServer(proxyHandler)
96 frontend := httptest.NewServer(proxyHandler)
90− defer frontend.Close()
97+ t.Cleanup(frontend.Close)
92 frontendURL, _ := url.Parse(frontend.URL)
99 frontendURL, _ := url.Parse(frontend.URL)
93 frontendWSURL := "ws://" + frontendURL.Host + "/"
100 frontendWSURL := "ws://" + frontendURL.Host + "/"
95 ws, err := websocket.Dial(frontendWSURL, "", "http://localhost/")
102 ws, err := websocket.Dial(frontendWSURL, "", "http://localhost/")
96 if err != nil {
103 if err != nil {
97− t.Fatalf("err %s", err)
104+ t.Fatal(err)
99 request := []byte("hello, world!")
106 request := []byte("hello, world!")
100 err = websocket.Message.Send(ws, request)
107 err = websocket.Message.Send(ws, request)
101 if err != nil {
108 if err != nil {
102− t.Fatalf("err %s", err)
109+ t.Fatal(err)
104 var response = make([]byte, 1024)
111 var response = make([]byte, 1024)
105− websocket.Message.Receive(ws, &response)
112+ err = websocket.Message.Receive(ws, &response)
106 if err != nil {
113 if err != nil {
107− t.Fatalf("err %s", err)
114+ t.Fatal(err)
109 if g, e := string(request), string(response); g != e {
116 if g, e := string(request), string(response); g != e {
110 t.Errorf("got body %q; expected %q", g, e)
117 t.Errorf("got body %q; expected %q", g, e)
@@ -123,9 +130,12 @@ func TestNewReverseProxy(t *testing.T) {
123 backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
130 backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
124 w.WriteHeader(200)
131 w.WriteHeader(200)
125 hostname, _, _ := net.SplitHostPort(r.Host)
132 hostname, _, _ := net.SplitHostPort(r.Host)
126− w.Write([]byte(hostname))
133+ _, err := w.Write([]byte(hostname))
128− defer backend.Close()
138+ t.Cleanup(backend.Close)
130 backendURL, _ := url.Parse(backend.URL)
140 backendURL, _ := url.Parse(backend.URL)
131 backendHostname, backendPort, _ := net.SplitHostPort(backendURL.Host)
141 backendHostname, backendPort, _ := net.SplitHostPort(backendURL.Host)
@@ -135,7 +145,7 @@ func TestNewReverseProxy(t *testing.T) {
135 proxyHandler := NewReverseProxy(proxyURL, &options.Options{FlushInterval: time.Second})
145 proxyHandler := NewReverseProxy(proxyURL, &options.Options{FlushInterval: time.Second})
136 setProxyUpstreamHostHeader(proxyHandler, proxyURL)
146 setProxyUpstreamHostHeader(proxyHandler, proxyURL)
137 frontend := httptest.NewServer(proxyHandler)
147 frontend := httptest.NewServer(proxyHandler)
138− defer frontend.Close()
148+ t.Cleanup(frontend.Close)
140 getReq, _ := http.NewRequest("GET", frontend.URL, nil)
150 getReq, _ := http.NewRequest("GET", frontend.URL, nil)
141 res, _ := http.DefaultClient.Do(getReq)
151 res, _ := http.DefaultClient.Do(getReq)
@@ -151,20 +161,20 @@ func TestEncodedSlashes(t *testing.T) {
151 w.WriteHeader(200)
161 w.WriteHeader(200)
152 seen = r.RequestURI
162 seen = r.RequestURI
154− defer backend.Close()
164+ t.Cleanup(backend.Close)
156 b, _ := url.Parse(backend.URL)
166 b, _ := url.Parse(backend.URL)
157 proxyHandler := NewReverseProxy(b, &options.Options{FlushInterval: time.Second})
167 proxyHandler := NewReverseProxy(b, &options.Options{FlushInterval: time.Second})
158 setProxyDirector(proxyHandler)
168 setProxyDirector(proxyHandler)
159 frontend := httptest.NewServer(proxyHandler)
169 frontend := httptest.NewServer(proxyHandler)
160− defer frontend.Close()
170+ t.Cleanup(frontend.Close)
162 f, _ := url.Parse(frontend.URL)
172 f, _ := url.Parse(frontend.URL)
163 encodedPath := "/a%2Fb/?c=1"
173 encodedPath := "/a%2Fb/?c=1"
164 getReq := &http.Request{URL: &url.URL{Scheme: "http", Host: f.Host, Opaque: encodedPath}}
174 getReq := &http.Request{URL: &url.URL{Scheme: "http", Host: f.Host, Opaque: encodedPath}}
165 _, err := http.DefaultClient.Do(getReq)
175 _, err := http.DefaultClient.Do(getReq)
166 if err != nil {
176 if err != nil {
167− t.Fatalf("err %s", err)
177+ t.Fatal(err)
169 if seen != encodedPath {
179 if seen != encodedPath {
170 t.Errorf("got bad request %q expected %q", seen, encodedPath)
180 t.Errorf("got bad request %q expected %q", seen, encodedPath)
@@ -173,13 +183,13 @@ func TestEncodedSlashes(t *testing.T) {
174func TestRobotsTxt(t *testing.T) {
184func TestRobotsTxt(t *testing.T) {
175 opts := baseTestOptions()
185 opts := baseTestOptions()
176− opts.ClientID = "asdlkjx"
177− opts.ClientSecret = "alkgks"
178− opts.Cookie.Secret = rawCookieSecret
179− validation.Validate(opts)
186+ err := validation.Validate(opts)
187+ assert.NoError(t, err)
181 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
189 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
182− assert.NoError(t, err)
190+ if err != nil {
183 rw := httptest.NewRecorder()
193 rw := httptest.NewRecorder()
184 req, _ := http.NewRequest("GET", "/robots.txt", nil)
194 req, _ := http.NewRequest("GET", "/robots.txt", nil)
185 proxy.ServeHTTP(rw, req)
195 proxy.ServeHTTP(rw, req)
@@ -189,9 +199,6 @@ func TestRobotsTxt(t *testing.T) {
190func TestIsValidRedirect(t *testing.T) {
200func TestIsValidRedirect(t *testing.T) {
191 opts := baseTestOptions()
201 opts := baseTestOptions()
192− opts.ClientID = "skdlfj"
193− opts.ClientSecret = "fgkdsgj"
194− opts.Cookie.Secret = base64CookieSecret
195 // Should match domains that are exactly foo.bar and any subdomain of bar.foo
202 // Should match domains that are exactly foo.bar and any subdomain of bar.foo
196 opts.WhitelistDomains = []string{
203 opts.WhitelistDomains = []string{
197 "foo.bar",
204 "foo.bar",
@@ -201,10 +208,13 @@ func TestIsValidRedirect(t *testing.T) {
201 "anyport.bar:*",
208 "anyport.bar:*",
202 ".sub.anyport.bar:*",
209 ".sub.anyport.bar:*",
204− validation.Validate(opts)
211+ err := validation.Validate(opts)
212+ assert.NoError(t, err)
206 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
214 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
207− assert.NoError(t, err)
215+ if err != nil {
209 testCases := []struct {
219 testCases := []struct {
210 Desc, Redirect string
220 Desc, Redirect string
@@ -439,11 +449,7 @@ func TestIsValidRedirect(t *testing.T) {
441func TestOpenRedirects(t *testing.T) {
451func TestOpenRedirects(t *testing.T) {
442− opts := options.NewOptions()
452+ opts := baseTestOptions()
443− opts.ClientID = "skdlfj"
444− opts.ClientSecret = "fgkdsgj"
445− opts.Cookie.Secret = rawCookieSecret
446− opts.EmailDomains = []string{"*"}
447 // Should match domains that are exactly foo.bar and any subdomain of bar.foo
453 // Should match domains that are exactly foo.bar and any subdomain of bar.foo
448 opts.WhitelistDomains = []string{
454 opts.WhitelistDomains = []string{
449 "foo.bar",
455 "foo.bar",
@@ -458,13 +464,19 @@ func TestOpenRedirects(t *testing.T) {
458 assert.NoError(t, err)
464 assert.NoError(t, err)
460 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
466 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
461− assert.NoError(t, err)
467+ if err != nil {
463 file, err := os.Open("./test/openredirects.txt")
471 file, err := os.Open("./test/openredirects.txt")
464 if err != nil {
472 if err != nil {
465 t.Fatal(err)
473 t.Fatal(err)
475+ defer func(t *testing.T) {
467− defer file.Close()
476+ if err := file.Close(); err != nil {
469 scanner := bufio.NewScanner(file)
481 scanner := bufio.NewScanner(file)
470 for scanner.Scan() {
482 for scanner.Scan() {
@@ -544,22 +556,21 @@ func TestBasicAuthPassword(t *testing.T) {
546 w.WriteHeader(200)
558 w.WriteHeader(200)
547− w.Write([]byte(payload))
559+ _, err := w.Write([]byte(payload))
549 opts := baseTestOptions()
564 opts := baseTestOptions()
550 opts.Upstreams = append(opts.Upstreams, providerServer.URL)
565 opts.Upstreams = append(opts.Upstreams, providerServer.URL)
551− // The CookieSecret must be 32 bytes in order to create the AES
553− opts.Cookie.Secret = "xyzzyplughxyzzyplughxyzzyplughxp"
554− opts.ClientID = "dlgkj"
555− opts.ClientSecret = "alkgret"
556 opts.Cookie.Secure = false
566 opts.Cookie.Secure = false
557 opts.PassBasicAuth = true
567 opts.PassBasicAuth = true
558 opts.SetBasicAuth = true
568 opts.SetBasicAuth = true
559 opts.PassUserHeaders = true
569 opts.PassUserHeaders = true
560 opts.PreferEmailToUser = true
570 opts.PreferEmailToUser = true
561 opts.BasicAuthPassword = "This is a secure password"
571 opts.BasicAuthPassword = "This is a secure password"
562− validation.Validate(opts)
572+ err := validation.Validate(opts)
573+ assert.NoError(t, err)
564 providerURL, _ := url.Parse(providerServer.URL)
575 providerURL, _ := url.Parse(providerServer.URL)
565 const emailAddress = "john.doe@example.com"
576 const emailAddress = "john.doe@example.com"
@@ -568,7 +579,9 @@ func TestBasicAuthPassword(t *testing.T) {
568 proxy, err := NewOAuthProxy(opts, func(email string) bool {
579 proxy, err := NewOAuthProxy(opts, func(email string) bool {
569 return email == emailAddress
580 return email == emailAddress
571− assert.NoError(t, err)
582+ if err != nil {
573 rw := httptest.NewRecorder()
586 rw := httptest.NewRecorder()
574 req, _ := http.NewRequest("GET", "/oauth2/callback?code=callback_code&state=nonce:", strings.NewReader(""))
587 req, _ := http.NewRequest("GET", "/oauth2/callback?code=callback_code&state=nonce:", strings.NewReader(""))
@@ -618,8 +631,8 @@ func TestBasicAuthWithEmail(t *testing.T) {
618 opts.PassUserHeaders = false
631 opts.PassUserHeaders = false
619 opts.PreferEmailToUser = false
632 opts.PreferEmailToUser = false
620 opts.BasicAuthPassword = "This is a secure password"
633 opts.BasicAuthPassword = "This is a secure password"
621− opts.Cookie.Secret = rawCookieSecret
622− validation.Validate(opts)
634+ err := validation.Validate(opts)
635+ assert.NoError(t, err)
624 const emailAddress = "john.doe@example.com"
637 const emailAddress = "john.doe@example.com"
625 const userName = "9fcab5c9b889a557"
638 const userName = "9fcab5c9b889a557"
@@ -641,7 +654,9 @@ func TestBasicAuthWithEmail(t *testing.T) {
641 proxy, err := NewOAuthProxy(opts, func(email string) bool {
654 proxy, err := NewOAuthProxy(opts, func(email string) bool {
642 return email == emailAddress
655 return email == emailAddress
644− assert.NoError(t, err)
657+ if err != nil {
645 proxy.addHeadersForProxying(rw, req, session)
660 proxy.addHeadersForProxying(rw, req, session)
646 assert.Equal(t, expectedUserHeader, req.Header["Authorization"][0])
661 assert.Equal(t, expectedUserHeader, req.Header["Authorization"][0])
647 assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
662 assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
@@ -655,7 +670,9 @@ func TestBasicAuthWithEmail(t *testing.T) {
655 proxy, err := NewOAuthProxy(opts, func(email string) bool {
670 proxy, err := NewOAuthProxy(opts, func(email string) bool {
656 return email == emailAddress
671 return email == emailAddress
658− assert.NoError(t, err)
673+ if err != nil {
659 proxy.addHeadersForProxying(rw, req, session)
676 proxy.addHeadersForProxying(rw, req, session)
660 assert.Equal(t, expectedEmailHeader, req.Header["Authorization"][0])
677 assert.Equal(t, expectedEmailHeader, req.Header["Authorization"][0])
661 assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
678 assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
@@ -664,11 +681,8 @@ func TestBasicAuthWithEmail(t *testing.T) {
665func TestPassUserHeadersWithEmail(t *testing.T) {
682func TestPassUserHeadersWithEmail(t *testing.T) {
666 opts := baseTestOptions()
683 opts := baseTestOptions()
667− opts.PassBasicAuth = false
668− opts.PassUserHeaders = true
669− opts.PreferEmailToUser = false
670− opts.Cookie.Secret = base64CookieSecret
671− validation.Validate(opts)
684+ err := validation.Validate(opts)
685+ assert.NoError(t, err)
673 const emailAddress = "john.doe@example.com"
687 const emailAddress = "john.doe@example.com"
674 const userName = "9fcab5c9b889a557"
688 const userName = "9fcab5c9b889a557"
@@ -686,7 +700,9 @@ func TestPassUserHeadersWithEmail(t *testing.T) {
686 proxy, err := NewOAuthProxy(opts, func(email string) bool {
700 proxy, err := NewOAuthProxy(opts, func(email string) bool {
687 return email == emailAddress
701 return email == emailAddress
689− assert.NoError(t, err)
703+ if err != nil {
690 proxy.addHeadersForProxying(rw, req, session)
706 proxy.addHeadersForProxying(rw, req, session)
691 assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
707 assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
@@ -699,7 +715,9 @@ func TestPassUserHeadersWithEmail(t *testing.T) {
699 proxy, err := NewOAuthProxy(opts, func(email string) bool {
715 proxy, err := NewOAuthProxy(opts, func(email string) bool {
700 return email == emailAddress
716 return email == emailAddress
702− assert.NoError(t, err)
718+ if err != nil {
703 proxy.addHeadersForProxying(rw, req, session)
721 proxy.addHeadersForProxying(rw, req, session)
704 assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
722 assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
@@ -716,10 +734,10 @@ type PassAccessTokenTestOptions struct {
716 ProxyUpstream string
734 ProxyUpstream string
719−func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTest {
737+func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) (*PassAccessTokenTest, error) {
720− t := &PassAccessTokenTest{}
738+ patt := &PassAccessTokenTest{}
722− t.providerServer = httptest.NewServer(
740+ patt.providerServer = httptest.NewServer(
723 http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
741 http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
724 var payload string
742 var payload string
725 switch r.URL.Path {
743 switch r.URL.Path {
@@ -732,35 +750,35 @@ func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTes
734 w.WriteHeader(200)
752 w.WriteHeader(200)
735− w.Write([]byte(payload))
753+ _, err := w.Write([]byte(payload))
738− t.opts = baseTestOptions()
759+ patt.opts = baseTestOptions()
739− t.opts.Upstreams = append(t.opts.Upstreams, t.providerServer.URL)
760+ patt.opts.Upstreams = append(patt.opts.Upstreams, patt.providerServer.URL)
740 if opts.ProxyUpstream != "" {
761 if opts.ProxyUpstream != "" {
741− t.opts.Upstreams = append(t.opts.Upstreams, opts.ProxyUpstream)
762+ patt.opts.Upstreams = append(patt.opts.Upstreams, opts.ProxyUpstream)
743− // The CookieSecret must be 32 bytes in order to create the AES
745− t.opts.Cookie.Secret = "xyzzyplughxyzzyplughxyzzyplughxp"
746− t.opts.ClientID = "slgkj"
747− t.opts.ClientSecret = "gfjgojl"
748− t.opts.Cookie.Secure = false
764+ patt.opts.Cookie.Secure = false
749− t.opts.PassAccessToken = opts.PassAccessToken
765+ patt.opts.PassAccessToken = opts.PassAccessToken
750− validation.Validate(t.opts)
766+ err := validation.Validate(patt.opts)
752− providerURL, _ := url.Parse(t.providerServer.URL)
771+ providerURL, _ := url.Parse(patt.providerServer.URL)
753 const emailAddress = "michael.bland@gsa.gov"
772 const emailAddress = "michael.bland@gsa.gov"
755− t.opts.SetProvider(NewTestProvider(providerURL, emailAddress))
774+ patt.opts.SetProvider(NewTestProvider(providerURL, emailAddress))
757− t.proxy, err = NewOAuthProxy(t.opts, func(email string) bool {
775+ patt.proxy, err = NewOAuthProxy(patt.opts, func(email string) bool {
758 return email == emailAddress
776 return email == emailAddress
760 if err != nil {
778 if err != nil {
761− panic(err)
779+ return nil, err
763− return t
781+ return patt, nil
766func (patTest *PassAccessTokenTest) Close() {
784func (patTest *PassAccessTokenTest) Close() {
@@ -817,17 +835,20 @@ func (patTest *PassAccessTokenTest) getEndpointWithCookie(cookie string, endpoin
819func TestForwardAccessTokenUpstream(t *testing.T) {
837func TestForwardAccessTokenUpstream(t *testing.T) {
820− patTest := NewPassAccessTokenTest(PassAccessTokenTestOptions{
838+ patTest, err := NewPassAccessTokenTest(PassAccessTokenTestOptions{
821 PassAccessToken: true,
839 PassAccessToken: true,
823− defer patTest.Close()
844+ t.Cleanup(patTest.Close)
825 // A successful validation will redirect and set the auth cookie.
846 // A successful validation will redirect and set the auth cookie.
826 code, cookie := patTest.getCallbackEndpoint()
847 code, cookie := patTest.getCallbackEndpoint()
827 if code != 302 {
848 if code != 302 {
828 t.Fatalf("expected 302; got %d", code)
849 t.Fatalf("expected 302; got %d", code)
830− assert.NotEqual(t, nil, cookie)
851+ assert.NotNil(t, cookie)
832 // Now we make a regular request; the access_token from the cookie is
853 // Now we make a regular request; the access_token from the cookie is
833 // forwarded as the "X-Forwarded-Access-Token" header. The token is
854 // forwarded as the "X-Forwarded-Access-Token" header. The token is
@@ -840,12 +861,14 @@ func TestForwardAccessTokenUpstream(t *testing.T) {
842func TestStaticProxyUpstream(t *testing.T) {
863func TestStaticProxyUpstream(t *testing.T) {
843− patTest := NewPassAccessTokenTest(PassAccessTokenTestOptions{
864+ patTest, err := NewPassAccessTokenTest(PassAccessTokenTestOptions{
844 PassAccessToken: true,
865 PassAccessToken: true,
845 ProxyUpstream: "static://200/static-proxy",
866 ProxyUpstream: "static://200/static-proxy",
848− defer patTest.Close()
871+ t.Cleanup(patTest.Close)
850 // A successful validation will redirect and set the auth cookie.
873 // A successful validation will redirect and set the auth cookie.
851 code, cookie := patTest.getCallbackEndpoint()
874 code, cookie := patTest.getCallbackEndpoint()
@@ -864,10 +887,13 @@ func TestStaticProxyUpstream(t *testing.T) {
866func TestDoNotForwardAccessTokenUpstream(t *testing.T) {
889func TestDoNotForwardAccessTokenUpstream(t *testing.T) {
867− patTest := NewPassAccessTokenTest(PassAccessTokenTestOptions{
890+ patTest, err := NewPassAccessTokenTest(PassAccessTokenTestOptions{
868 PassAccessToken: false,
891 PassAccessToken: false,
870− defer patTest.Close()
896+ t.Cleanup(patTest.Close)
872 // A successful validation will redirect and set the auth cookie.
898 // A successful validation will redirect and set the auth cookie.
873 code, cookie := patTest.getCallbackEndpoint()
899 code, cookie := patTest.getCallbackEndpoint()
@@ -895,27 +921,26 @@ type SignInPageTest struct {
895const signInRedirectPattern = `<input type="hidden" name="rd" value="(.*)">`
921const signInRedirectPattern = `<input type="hidden" name="rd" value="(.*)">`
896const signInSkipProvider = `>Found<`
922const signInSkipProvider = `>Found<`
898−func NewSignInPageTest(skipProvider bool) *SignInPageTest {
924+func NewSignInPageTest(skipProvider bool) (*SignInPageTest, error) {
899 var sipTest SignInPageTest
925 var sipTest SignInPageTest
901 sipTest.opts = baseTestOptions()
927 sipTest.opts = baseTestOptions()
902− sipTest.opts.Cookie.Secret = rawCookieSecret
903− sipTest.opts.ClientID = "lkdgj"
904− sipTest.opts.ClientSecret = "sgiufgoi"
905 sipTest.opts.SkipProviderButton = skipProvider
928 sipTest.opts.SkipProviderButton = skipProvider
906− validation.Validate(sipTest.opts)
929+ err := validation.Validate(sipTest.opts)
909 sipTest.proxy, err = NewOAuthProxy(sipTest.opts, func(email string) bool {
934 sipTest.proxy, err = NewOAuthProxy(sipTest.opts, func(email string) bool {
910 return true
935 return true
912 if err != nil {
937 if err != nil {
913− panic(err)
938+ return nil, err
915 sipTest.signInRegexp = regexp.MustCompile(signInRedirectPattern)
940 sipTest.signInRegexp = regexp.MustCompile(signInRedirectPattern)
916 sipTest.signInProviderRegexp = regexp.MustCompile(signInSkipProvider)
941 sipTest.signInProviderRegexp = regexp.MustCompile(signInSkipProvider)
918− return &sipTest
943+ return &sipTest, nil
921func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
946func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
@@ -926,7 +951,10 @@ func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
928func TestSignInPageIncludesTargetRedirect(t *testing.T) {
953func TestSignInPageIncludesTargetRedirect(t *testing.T) {
929− sipTest := NewSignInPageTest(false)
954+ sipTest, err := NewSignInPageTest(false)
930 const endpoint = "/some/random/endpoint"
958 const endpoint = "/some/random/endpoint"
932 code, body := sipTest.GetEndpoint(endpoint)
960 code, body := sipTest.GetEndpoint(endpoint)
@@ -944,7 +972,10 @@ func TestSignInPageIncludesTargetRedirect(t *testing.T) {
946func TestSignInPageDirectAccessRedirectsToRoot(t *testing.T) {
974func TestSignInPageDirectAccessRedirectsToRoot(t *testing.T) {
947− sipTest := NewSignInPageTest(false)
975+ sipTest, err := NewSignInPageTest(false)
948 code, body := sipTest.GetEndpoint("/oauth2/sign_in")
979 code, body := sipTest.GetEndpoint("/oauth2/sign_in")
949 assert.Equal(t, 200, code)
980 assert.Equal(t, 200, code)
@@ -959,8 +990,12 @@ func TestSignInPageDirectAccessRedirectsToRoot(t *testing.T) {
961func TestSignInPageSkipProvider(t *testing.T) {
992func TestSignInPageSkipProvider(t *testing.T) {
962− sipTest := NewSignInPageTest(true)
993+ sipTest, err := NewSignInPageTest(true)
963− const endpoint = "/some/random/endpoint"
998+ endpoint := "/some/random/endpoint"
965 code, body := sipTest.GetEndpoint(endpoint)
1000 code, body := sipTest.GetEndpoint(endpoint)
966 assert.Equal(t, 302, code)
1001 assert.Equal(t, 302, code)
@@ -973,8 +1008,12 @@ func TestSignInPageSkipProvider(t *testing.T) {
975func TestSignInPageSkipProviderDirect(t *testing.T) {
1010func TestSignInPageSkipProviderDirect(t *testing.T) {
976− sipTest := NewSignInPageTest(true)
1011+ sipTest, err := NewSignInPageTest(true)
977− const endpoint = "/sign_in"
1016+ endpoint := "/sign_in"
979 code, body := sipTest.GetEndpoint(endpoint)
1018 code, body := sipTest.GetEndpoint(endpoint)
980 assert.Equal(t, 302, code)
1019 assert.Equal(t, 302, code)
@@ -1000,27 +1039,26 @@ type ProcessCookieTestOpts struct {
1001type OptionsModifier func(*options.Options)
1040type OptionsModifier func(*options.Options)
1003−func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifier) *ProcessCookieTest {
1042+func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifier) (*ProcessCookieTest, error) {
1004 var pcTest ProcessCookieTest
1043 var pcTest ProcessCookieTest
1006 pcTest.opts = baseTestOptions()
1045 pcTest.opts = baseTestOptions()
1007 for _, modifier := range modifiers {
1046 for _, modifier := range modifiers {
1008 modifier(pcTest.opts)
1047 modifier(pcTest.opts)
1010− pcTest.opts.ClientID = "asdfljk"
1011− pcTest.opts.ClientSecret = "lkjfdsig"
1012− pcTest.opts.Cookie.Secret = "0123456789abcdef0123456789abcdef"
1013 // First, set the CookieRefresh option so proxy.AesCipher is created,
1049 // First, set the CookieRefresh option so proxy.AesCipher is created,
1014 // needed to encrypt the access_token.
1050 // needed to encrypt the access_token.
1015 pcTest.opts.Cookie.Refresh = time.Hour
1051 pcTest.opts.Cookie.Refresh = time.Hour
1016− validation.Validate(pcTest.opts)
1052+ err := validation.Validate(pcTest.opts)
1019 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
1057 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
1020 return pcTest.validateUser
1058 return pcTest.validateUser
1022 if err != nil {
1060 if err != nil {
1023− panic(err)
1061+ return nil, err
1025 pcTest.proxy.provider = &TestProvider{
1063 pcTest.proxy.provider = &TestProvider{
1026 ValidToken: opts.providerValidateCookieResponse,
1064 ValidToken: opts.providerValidateCookieResponse,
@@ -1032,16 +1070,16 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifi
1032 pcTest.rw = httptest.NewRecorder()
1070 pcTest.rw = httptest.NewRecorder()
1033 pcTest.req, _ = http.NewRequest("GET", "/", strings.NewReader(""))
1071 pcTest.req, _ = http.NewRequest("GET", "/", strings.NewReader(""))
1034 pcTest.validateUser = true
1072 pcTest.validateUser = true
1035− return &pcTest
1073+ return &pcTest, nil
1038−func NewProcessCookieTestWithDefaults() *ProcessCookieTest {
1076+func NewProcessCookieTestWithDefaults() (*ProcessCookieTest, error) {
1039 return NewProcessCookieTest(ProcessCookieTestOpts{
1077 return NewProcessCookieTest(ProcessCookieTestOpts{
1040 providerValidateCookieResponse: true,
1078 providerValidateCookieResponse: true,
1044−func NewProcessCookieTestWithOptionsModifiers(modifiers ...OptionsModifier) *ProcessCookieTest {
1082+func NewProcessCookieTestWithOptionsModifiers(modifiers ...OptionsModifier) (*ProcessCookieTest, error) {
1045 return NewProcessCookieTest(ProcessCookieTestOpts{
1083 return NewProcessCookieTest(ProcessCookieTestOpts{
1046 providerValidateCookieResponse: true,
1084 providerValidateCookieResponse: true,
1047 }, modifiers...)
1085 }, modifiers...)
@@ -1063,37 +1101,51 @@ func (p *ProcessCookieTest) LoadCookiedSession() (*sessions.SessionState, error)
1065func TestLoadCookiedSession(t *testing.T) {
1103func TestLoadCookiedSession(t *testing.T) {
1066− pcTest := NewProcessCookieTestWithDefaults()
1104+ pcTest, err := NewProcessCookieTestWithDefaults()
1068 created := time.Now()
1109 created := time.Now()
1069 startSession := &sessions.SessionState{Email: "john.doe@example.com", AccessToken: "my_access_token", CreatedAt: &created}
1110 startSession := &sessions.SessionState{Email: "john.doe@example.com", AccessToken: "my_access_token", CreatedAt: &created}
1070− pcTest.SaveSession(startSession)
1111+ err = pcTest.SaveSession(startSession)
1112+ assert.NoError(t, err)
1072 session, err := pcTest.LoadCookiedSession()
1114 session, err := pcTest.LoadCookiedSession()
1073− assert.Equal(t, nil, err)
1115+ if err != nil {
1074 assert.Equal(t, startSession.Email, session.Email)
1118 assert.Equal(t, startSession.Email, session.Email)
1075 assert.Equal(t, "", session.User)
1119 assert.Equal(t, "", session.User)
1076 assert.Equal(t, startSession.AccessToken, session.AccessToken)
1120 assert.Equal(t, startSession.AccessToken, session.AccessToken)
1079func TestProcessCookieNoCookieError(t *testing.T) {
1123func TestProcessCookieNoCookieError(t *testing.T) {
1080− pcTest := NewProcessCookieTestWithDefaults()
1124+ pcTest, err := NewProcessCookieTestWithDefaults()
1082 session, err := pcTest.LoadCookiedSession()
1129 session, err := pcTest.LoadCookiedSession()
1083− assert.Equal(t, "cookie \"_oauth2_proxy\" not present", err.Error())
1130+ assert.Error(t, err, "cookie \"_oauth2_proxy\" not present")
1084 if session != nil {
1131 if session != nil {
1085 t.Errorf("expected nil session. got %#v", session)
1132 t.Errorf("expected nil session. got %#v", session)
1089func TestProcessCookieRefreshNotSet(t *testing.T) {
1136func TestProcessCookieRefreshNotSet(t *testing.T) {
1090− pcTest := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
1137+ pcTest, err := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
1091 opts.Cookie.Expire = time.Duration(23) * time.Hour
1138 opts.Cookie.Expire = time.Duration(23) * time.Hour
1093 reference := time.Now().Add(time.Duration(-2) * time.Hour)
1144 reference := time.Now().Add(time.Duration(-2) * time.Hour)
1095 startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1146 startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1096− pcTest.SaveSession(startSession)
1147+ err = pcTest.SaveSession(startSession)
1148+ assert.NoError(t, err)
1098 session, err := pcTest.LoadCookiedSession()
1150 session, err := pcTest.LoadCookiedSession()
1099 assert.Equal(t, nil, err)
1151 assert.Equal(t, nil, err)
@@ -1104,12 +1156,17 @@ func TestProcessCookieRefreshNotSet(t *testing.T) {
1106func TestProcessCookieFailIfCookieExpired(t *testing.T) {
1158func TestProcessCookieFailIfCookieExpired(t *testing.T) {
1107− pcTest := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
1159+ pcTest, err := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
1108 opts.Cookie.Expire = time.Duration(24) * time.Hour
1160 opts.Cookie.Expire = time.Duration(24) * time.Hour
1110 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
1166 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
1111 startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1167 startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1112− pcTest.SaveSession(startSession)
1168+ err = pcTest.SaveSession(startSession)
1169+ assert.NoError(t, err)
1114 session, err := pcTest.LoadCookiedSession()
1171 session, err := pcTest.LoadCookiedSession()
1115 assert.NotEqual(t, nil, err)
1172 assert.NotEqual(t, nil, err)
@@ -1119,12 +1176,17 @@ func TestProcessCookieFailIfCookieExpired(t *testing.T) {
1121func TestProcessCookieFailIfRefreshSetAndCookieExpired(t *testing.T) {
1178func TestProcessCookieFailIfRefreshSetAndCookieExpired(t *testing.T) {
1122− pcTest := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
1179+ pcTest, err := NewProcessCookieTestWithOptionsModifiers(func(opts *options.Options) {
1123 opts.Cookie.Expire = time.Duration(24) * time.Hour
1180 opts.Cookie.Expire = time.Duration(24) * time.Hour
1125 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
1186 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
1126 startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1187 startSession := &sessions.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1127− pcTest.SaveSession(startSession)
1188+ err = pcTest.SaveSession(startSession)
1189+ assert.NoError(t, err)
1129 pcTest.proxy.CookieRefresh = time.Hour
1191 pcTest.proxy.CookieRefresh = time.Hour
1130 session, err := pcTest.LoadCookiedSession()
1192 session, err := pcTest.LoadCookiedSession()
@@ -1134,18 +1196,26 @@ func TestProcessCookieFailIfRefreshSetAndCookieExpired(t *testing.T) {
1137−func NewUserInfoEndpointTest() *ProcessCookieTest {
1199+func NewUserInfoEndpointTest() (*ProcessCookieTest, error) {
1138− pcTest := NewProcessCookieTestWithDefaults()
1200+ pcTest, err := NewProcessCookieTestWithDefaults()
1139 pcTest.req, _ = http.NewRequest("GET",
1204 pcTest.req, _ = http.NewRequest("GET",
1140 pcTest.opts.ProxyPrefix+"/userinfo", nil)
1205 pcTest.opts.ProxyPrefix+"/userinfo", nil)
1141− return pcTest
1206+ return pcTest, nil
1144func TestUserInfoEndpointAccepted(t *testing.T) {
1209func TestUserInfoEndpointAccepted(t *testing.T) {
1145− test := NewUserInfoEndpointTest()
1210+ test, err := NewUserInfoEndpointTest()
1146 startSession := &sessions.SessionState{
1215 startSession := &sessions.SessionState{
1147 Email: "john.doe@example.com", AccessToken: "my_access_token"}
1216 Email: "john.doe@example.com", AccessToken: "my_access_token"}
1148− test.SaveSession(startSession)
1217+ err = test.SaveSession(startSession)
1218+ assert.NoError(t, err)
1150 test.proxy.ServeHTTP(test.rw, test.req)
1220 test.proxy.ServeHTTP(test.rw, test.req)
1151 assert.Equal(t, http.StatusOK, test.rw.Code)
1221 assert.Equal(t, http.StatusOK, test.rw.Code)
@@ -1154,25 +1224,36 @@ func TestUserInfoEndpointAccepted(t *testing.T) {
1156func TestUserInfoEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
1226func TestUserInfoEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
1157− test := NewUserInfoEndpointTest()
1227+ test, err := NewUserInfoEndpointTest()
1159 test.proxy.ServeHTTP(test.rw, test.req)
1232 test.proxy.ServeHTTP(test.rw, test.req)
1160 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
1233 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
1163−func NewAuthOnlyEndpointTest(modifiers ...OptionsModifier) *ProcessCookieTest {
1236+func NewAuthOnlyEndpointTest(modifiers ...OptionsModifier) (*ProcessCookieTest, error) {
1164− pcTest := NewProcessCookieTestWithOptionsModifiers(modifiers...)
1237+ pcTest, err := NewProcessCookieTestWithOptionsModifiers(modifiers...)
1165 pcTest.req, _ = http.NewRequest("GET",
1241 pcTest.req, _ = http.NewRequest("GET",
1166 pcTest.opts.ProxyPrefix+"/auth", nil)
1242 pcTest.opts.ProxyPrefix+"/auth", nil)
1167− return pcTest
1243+ return pcTest, nil
1170func TestAuthOnlyEndpointAccepted(t *testing.T) {
1246func TestAuthOnlyEndpointAccepted(t *testing.T) {
1171− test := NewAuthOnlyEndpointTest()
1247+ test, err := NewAuthOnlyEndpointTest()
1172 created := time.Now()
1252 created := time.Now()
1173 startSession := &sessions.SessionState{
1253 startSession := &sessions.SessionState{
1174 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}
1254 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}
1175− test.SaveSession(startSession)
1255+ err = test.SaveSession(startSession)
1256+ assert.NoError(t, err)
1177 test.proxy.ServeHTTP(test.rw, test.req)
1258 test.proxy.ServeHTTP(test.rw, test.req)
1178 assert.Equal(t, http.StatusAccepted, test.rw.Code)
1259 assert.Equal(t, http.StatusAccepted, test.rw.Code)
@@ -1181,7 +1262,10 @@ func TestAuthOnlyEndpointAccepted(t *testing.T) {
1183func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
1264func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
1184− test := NewAuthOnlyEndpointTest()
1265+ test, err := NewAuthOnlyEndpointTest()
1186 test.proxy.ServeHTTP(test.rw, test.req)
1270 test.proxy.ServeHTTP(test.rw, test.req)
1187 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
1271 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
@@ -1190,13 +1274,18 @@ func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
1192func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {
1276func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {
1193− test := NewAuthOnlyEndpointTest(func(opts *options.Options) {
1277+ test, err := NewAuthOnlyEndpointTest(func(opts *options.Options) {
1194 opts.Cookie.Expire = time.Duration(24) * time.Hour
1278 opts.Cookie.Expire = time.Duration(24) * time.Hour
1196 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
1284 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
1197 startSession := &sessions.SessionState{
1285 startSession := &sessions.SessionState{
1198 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1286 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &reference}
1199− test.SaveSession(startSession)
1287+ err = test.SaveSession(startSession)
1288+ assert.NoError(t, err)
1201 test.proxy.ServeHTTP(test.rw, test.req)
1290 test.proxy.ServeHTTP(test.rw, test.req)
1202 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
1291 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
@@ -1205,11 +1294,16 @@ func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {
1207func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {
1296func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {
1208− test := NewAuthOnlyEndpointTest()
1297+ test, err := NewAuthOnlyEndpointTest()
1209 created := time.Now()
1302 created := time.Now()
1210 startSession := &sessions.SessionState{
1303 startSession := &sessions.SessionState{
1211 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}
1304 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token", CreatedAt: &created}
1212− test.SaveSession(startSession)
1305+ err = test.SaveSession(startSession)
1306+ assert.NoError(t, err)
1213 test.validateUser = false
1307 test.validateUser = false
1215 test.proxy.ServeHTTP(test.rw, test.req)
1309 test.proxy.ServeHTTP(test.rw, test.req)
@@ -1224,15 +1318,13 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
1224 pcTest.opts = baseTestOptions()
1318 pcTest.opts = baseTestOptions()
1225 pcTest.opts.SetXAuthRequest = true
1319 pcTest.opts.SetXAuthRequest = true
1226 err := validation.Validate(pcTest.opts)
1320 err := validation.Validate(pcTest.opts)
1227− if err != nil {
1321+ assert.NoError(t, err)
1231 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
1323 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
1232 return pcTest.validateUser
1324 return pcTest.validateUser
1234 if err != nil {
1326 if err != nil {
1235− panic(err)
1327+ t.Fatal(err)
1237 pcTest.proxy.provider = &TestProvider{
1329 pcTest.proxy.provider = &TestProvider{
1238 ValidToken: true,
1330 ValidToken: true,
@@ -1247,7 +1339,8 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
1247 created := time.Now()
1339 created := time.Now()
1248 startSession := &sessions.SessionState{
1340 startSession := &sessions.SessionState{
1249 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}
1341 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}
1250− pcTest.SaveSession(startSession)
1342+ err = pcTest.SaveSession(startSession)
1343+ assert.NoError(t, err)
1252 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)
1345 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)
1253 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)
1346 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)
@@ -1261,14 +1354,14 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
1261 pcTest.opts = baseTestOptions()
1354 pcTest.opts = baseTestOptions()
1262 pcTest.opts.SetXAuthRequest = true
1355 pcTest.opts.SetXAuthRequest = true
1263 pcTest.opts.SetBasicAuth = true
1356 pcTest.opts.SetBasicAuth = true
1264− validation.Validate(pcTest.opts)
1357+ err := validation.Validate(pcTest.opts)
1358+ assert.NoError(t, err)
1267 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
1360 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
1268 return pcTest.validateUser
1361 return pcTest.validateUser
1270 if err != nil {
1363 if err != nil {
1271− panic(err)
1364+ t.Fatal(err)
1273 pcTest.proxy.provider = &TestProvider{
1366 pcTest.proxy.provider = &TestProvider{
1274 ValidToken: true,
1367 ValidToken: true,
@@ -1283,7 +1376,8 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
1283 created := time.Now()
1376 created := time.Now()
1284 startSession := &sessions.SessionState{
1377 startSession := &sessions.SessionState{
1285 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}
1378 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}
1286− pcTest.SaveSession(startSession)
1379+ err = pcTest.SaveSession(startSession)
1380+ assert.NoError(t, err)
1288 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)
1382 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)
1289 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)
1383 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)
@@ -1299,14 +1393,14 @@ func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
1299 pcTest.opts = baseTestOptions()
1393 pcTest.opts = baseTestOptions()
1300 pcTest.opts.SetXAuthRequest = true
1394 pcTest.opts.SetXAuthRequest = true
1301 pcTest.opts.SetBasicAuth = false
1395 pcTest.opts.SetBasicAuth = false
1302− validation.Validate(pcTest.opts)
1396+ err := validation.Validate(pcTest.opts)
1397+ assert.NoError(t, err)
1305 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
1399 pcTest.proxy, err = NewOAuthProxy(pcTest.opts, func(email string) bool {
1306 return pcTest.validateUser
1400 return pcTest.validateUser
1308 if err != nil {
1402 if err != nil {
1309− panic(err)
1403+ t.Fatal(err)
1311 pcTest.proxy.provider = &TestProvider{
1405 pcTest.proxy.provider = &TestProvider{
1312 ValidToken: true,
1406 ValidToken: true,
@@ -1321,7 +1415,8 @@ func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
1321 created := time.Now()
1415 created := time.Now()
1322 startSession := &sessions.SessionState{
1416 startSession := &sessions.SessionState{
1323 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}
1417 User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token", CreatedAt: &created}
1324− pcTest.SaveSession(startSession)
1418+ err = pcTest.SaveSession(startSession)
1419+ assert.NoError(t, err)
1326 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)
1421 pcTest.proxy.ServeHTTP(pcTest.rw, pcTest.req)
1327 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)
1422 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)
@@ -1333,20 +1428,26 @@ func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
1333func TestAuthSkippedForPreflightRequests(t *testing.T) {
1428func TestAuthSkippedForPreflightRequests(t *testing.T) {
1334 upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
1429 upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
1335 w.WriteHeader(200)
1430 w.WriteHeader(200)
1336− w.Write([]byte("response"))
1431+ _, err := w.Write([]byte("response"))
1338− defer upstream.Close()
1436+ t.Cleanup(upstream.Close)
1340 opts := baseTestOptions()
1438 opts := baseTestOptions()
1341 opts.Upstreams = append(opts.Upstreams, upstream.URL)
1439 opts.Upstreams = append(opts.Upstreams, upstream.URL)
1342 opts.SkipAuthPreflight = true
1440 opts.SkipAuthPreflight = true
1343− validation.Validate(opts)
1441+ err := validation.Validate(opts)
1442+ assert.NoError(t, err)
1345 upstreamURL, _ := url.Parse(upstream.URL)
1444 upstreamURL, _ := url.Parse(upstream.URL)
1346 opts.SetProvider(NewTestProvider(upstreamURL, ""))
1445 opts.SetProvider(NewTestProvider(upstreamURL, ""))
1348 proxy, err := NewOAuthProxy(opts, func(string) bool { return false })
1447 proxy, err := NewOAuthProxy(opts, func(string) bool { return false })
1349− assert.NoError(t, err)
1448+ if err != nil {
1350 rw := httptest.NewRecorder()
1451 rw := httptest.NewRecorder()
1351 req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)
1452 req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)
1352 proxy.ServeHTTP(rw, req)
1453 proxy.ServeHTTP(rw, req)
@@ -1361,16 +1462,25 @@ type SignatureAuthenticator struct {
1362func (v *SignatureAuthenticator) Authenticate(w http.ResponseWriter, r *http.Request) {
1463func (v *SignatureAuthenticator) Authenticate(w http.ResponseWriter, r *http.Request) {
1363 result, headerSig, computedSig := v.auth.AuthenticateRequest(r)
1464 result, headerSig, computedSig := v.auth.AuthenticateRequest(r)
1364− if result == hmacauth.ResultNoSignature {
1468+ case hmacauth.ResultNoSignature:
1365− w.Write([]byte("no signature received"))
1469+ msg = "no signature received"
1366− } else if result == hmacauth.ResultMatch {
1470+ case hmacauth.ResultMatch:
1367− w.Write([]byte("signatures match"))
1471+ msg = "signatures match"
1368− } else if result == hmacauth.ResultMismatch {
1472+ case hmacauth.ResultMismatch:
1369− w.Write([]byte("signatures do not match:" +
1474+ "signatures do not match:\n received: %s\n computed: %s",
1370− "\n received: " + headerSig +
1475+ headerSig,
1371− "\n computed: " + computedSig))
1476+ computedSig)
1372− } else {
1477+ default:
1373− panic("Unknown result value: " + result.String())
1478+ panic("unknown result value: " + result.String())
1481+ _, err := w.Write([]byte(msg))
@@ -1384,24 +1494,30 @@ type SignatureTest struct {
1384 authenticator *SignatureAuthenticator
1494 authenticator *SignatureAuthenticator
1387−func NewSignatureTest() *SignatureTest {
1497+func NewSignatureTest() (*SignatureTest, error) {
1388 opts := baseTestOptions()
1498 opts := baseTestOptions()
1389− opts.Cookie.Secret = rawCookieSecret
1390− opts.ClientID = "client ID"
1391− opts.ClientSecret = "client secret"
1392 opts.EmailDomains = []string{"acm.org"}
1499 opts.EmailDomains = []string{"acm.org"}
1394 authenticator := &SignatureAuthenticator{}
1501 authenticator := &SignatureAuthenticator{}
1395 upstream := httptest.NewServer(
1502 upstream := httptest.NewServer(
1396 http.HandlerFunc(authenticator.Authenticate))
1503 http.HandlerFunc(authenticator.Authenticate))
1397− upstreamURL, _ := url.Parse(upstream.URL)
1504+ upstreamURL, err := url.Parse(upstream.URL)
1398 opts.Upstreams = append(opts.Upstreams, upstream.URL)
1508 opts.Upstreams = append(opts.Upstreams, upstream.URL)
1400 providerHandler := func(w http.ResponseWriter, r *http.Request) {
1510 providerHandler := func(w http.ResponseWriter, r *http.Request) {
1401− w.Write([]byte(`{"access_token": "my_auth_token"}`))
1511+ _, err := w.Write([]byte(`{"access_token": "my_auth_token"}`))
1403 provider := httptest.NewServer(http.HandlerFunc(providerHandler))
1516 provider := httptest.NewServer(http.HandlerFunc(providerHandler))
1404− providerURL, _ := url.Parse(provider.URL)
1517+ providerURL, err := url.Parse(provider.URL)
1405 opts.SetProvider(NewTestProvider(providerURL, "mbland@acm.org"))
1521 opts.SetProvider(NewTestProvider(providerURL, "mbland@acm.org"))
1407 return &SignatureTest{
1523 return &SignatureTest{
@@ -1412,7 +1528,7 @@ func NewSignatureTest() *SignatureTest {
1412 make(http.Header),
1528 make(http.Header),
1413 httptest.NewRecorder(),
1529 httptest.NewRecorder(),
1414 authenticator,
1530 authenticator,
1418func (st *SignatureTest) Close() {
1534func (st *SignatureTest) Close() {
@@ -1436,14 +1552,14 @@ func (fnc *fakeNetConn) Read(p []byte) (n int, err error) {
1436 return 0, io.EOF
1552 return 0, io.EOF
1439−func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) {
1555+func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) error {
1440 err := validation.Validate(st.opts)
1556 err := validation.Validate(st.opts)
1441 if err != nil {
1557 if err != nil {
1442− panic(err)
1558+ return err
1444 proxy, err := NewOAuthProxy(st.opts, func(email string) bool { return true })
1560 proxy, err := NewOAuthProxy(st.opts, func(email string) bool { return true })
1445 if err != nil {
1561 if err != nil {
1446− panic(err)
1562+ return err
1449 var bodyBuf io.ReadCloser
1565 var bodyBuf io.ReadCloser
@@ -1457,7 +1573,7 @@ func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) {
1457 Email: "mbland@acm.org", AccessToken: "my_access_token"}
1573 Email: "mbland@acm.org", AccessToken: "my_access_token"}
1458 err = proxy.SaveSession(st.rw, req, state)
1574 err = proxy.SaveSession(st.rw, req, state)
1459 if err != nil {
1575 if err != nil {
1460− panic(err)
1576+ return err
1462 for _, c := range st.rw.Result().Cookies() {
1578 for _, c := range st.rw.Result().Cookies() {
1463 req.AddCookie(c)
1579 req.AddCookie(c)
@@ -1466,33 +1582,52 @@ func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) {
1466 st.authenticator.auth = hmacauth.NewHmacAuth(
1582 st.authenticator.auth = hmacauth.NewHmacAuth(
1467 crypto.SHA1, []byte(key), SignatureHeader, SignatureHeaders)
1583 crypto.SHA1, []byte(key), SignatureHeader, SignatureHeaders)
1468 proxy.ServeHTTP(st.rw, req)
1584 proxy.ServeHTTP(st.rw, req)
1471−func TestNoRequestSignature(t *testing.T) {
1472− st := NewSignatureTest()
1474− st.MakeRequestWithExpectedKey("GET", "", "")
1475− assert.Equal(t, 200, st.rw.Code)
1476− assert.Equal(t, st.rw.Body.String(), "no signature received")
1479−func TestRequestSignatureGetRequest(t *testing.T) {
1586+ return nil
1480− st := NewSignatureTest()
1482− st.opts.SignatureKey = "sha1:7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d"
1483− st.MakeRequestWithExpectedKey("GET", "", "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d")
1484− assert.Equal(t, 200, st.rw.Code)
1485− assert.Equal(t, st.rw.Body.String(), "signatures match")
1488−func TestRequestSignaturePostRequest(t *testing.T) {
1589+func TestRequestSignature(t *testing.T) {
1590+ testCases := map[string]struct {
1596+ "No request signature": {
1600+ resp: "no signature received",
1605+ key: "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d",
1606+ resp: "signatures match",
1610+ body: `{ "hello": "world!" }`,
1611+ key: "d90df39e2d19282840252612dd7c81421a372f61",
1612+ resp: "signatures match",
1615+ for name, tc := range testCases {
1616+ t.Run(name, func(t *testing.T) {
1489− st := NewSignatureTest()
1617+ st, err := NewSignatureTest()
1490− defer st.Close()
1621+ t.Cleanup(st.Close)
1491− st.opts.SignatureKey = "sha1:d90df39e2d19282840252612dd7c81421a372f61"
1623+ st.opts.SignatureKey = fmt.Sprintf("sha1:%s", tc.key)
1492− payload := `{ "hello": "world!" }`
1624+ }
1493− st.MakeRequestWithExpectedKey("POST", payload, "d90df39e2d19282840252612dd7c81421a372f61")
1625+ err = st.MakeRequestWithExpectedKey(tc.method, tc.body, tc.key)
1626+ assert.NoError(t, err)
1494− assert.Equal(t, 200, st.rw.Code)
1627+ assert.Equal(t, 200, st.rw.Code)
1495− assert.Equal(t, st.rw.Body.String(), "signatures match")
1628+ assert.Equal(t, tc.resp, st.rw.Body.String())
1498func TestGetRedirect(t *testing.T) {
1633func TestGetRedirect(t *testing.T) {
@@ -1501,7 +1636,9 @@ func TestGetRedirect(t *testing.T) {
1501 assert.NoError(t, err)
1636 assert.NoError(t, err)
1502 require.NotEmpty(t, opts.ProxyPrefix)
1637 require.NotEmpty(t, opts.ProxyPrefix)
1503 proxy, err := NewOAuthProxy(opts, func(s string) bool { return false })
1638 proxy, err := NewOAuthProxy(opts, func(s string) bool { return false })
1504− assert.NoError(t, err)
1639+ if err != nil {
1506 tests := []struct {
1643 tests := []struct {
1507 name string
1644 name string
@@ -1535,22 +1672,21 @@ type ajaxRequestTest struct {
1535 proxy *OAuthProxy
1672 proxy *OAuthProxy
1538−func newAjaxRequestTest() *ajaxRequestTest {
1675+func newAjaxRequestTest() (*ajaxRequestTest, error) {
1539 test := &ajaxRequestTest{}
1676 test := &ajaxRequestTest{}
1540 test.opts = baseTestOptions()
1677 test.opts = baseTestOptions()
1541− test.opts.Cookie.Secret = base64CookieSecret
1542− test.opts.ClientID = "gkljfdl"
1543− test.opts.ClientSecret = "sdflkjs"
1544− validation.Validate(test.opts)
1678+ err := validation.Validate(test.opts)
1547 test.proxy, err = NewOAuthProxy(test.opts, func(email string) bool {
1683 test.proxy, err = NewOAuthProxy(test.opts, func(email string) bool {
1548 return true
1684 return true
1550 if err != nil {
1686 if err != nil {
1551− panic(err)
1687+ return nil, err
1553− return test
1689+ return test, nil
1556func (test *ajaxRequestTest) getEndpoint(endpoint string, header http.Header) (int, http.Header, error) {
1692func (test *ajaxRequestTest) getEndpoint(endpoint string, header http.Header) (int, http.Header, error) {
@@ -1565,7 +1701,10 @@ func (test *ajaxRequestTest) getEndpoint(endpoint string, header http.Header) (i
1567func testAjaxUnauthorizedRequest(t *testing.T, header http.Header) {
1703func testAjaxUnauthorizedRequest(t *testing.T, header http.Header) {
1568− test := newAjaxRequestTest()
1704+ test, err := newAjaxRequestTest()
1569 endpoint := "/test"
1708 endpoint := "/test"
1571 code, rh, err := test.getEndpoint(endpoint, header)
1710 code, rh, err := test.getEndpoint(endpoint, header)
@@ -1589,7 +1728,10 @@ func TestAjaxUnauthorizedRequest2(t *testing.T) {
1591func TestAjaxForbiddendRequest(t *testing.T) {
1730func TestAjaxForbiddendRequest(t *testing.T) {
1592− test := newAjaxRequestTest()
1731+ test, err := newAjaxRequestTest()
1593 endpoint := "/test"
1735 endpoint := "/test"
1594 header := make(http.Header)
1736 header := make(http.Header)
1595 code, rh, err := test.getEndpoint(endpoint, header)
1737 code, rh, err := test.getEndpoint(endpoint, header)
@@ -1604,8 +1746,14 @@ func TestClearSplitCookie(t *testing.T) {
1604 opts.Cookie.Secret = base64CookieSecret
1746 opts.Cookie.Secret = base64CookieSecret
1605 opts.Cookie.Name = "oauth2"
1747 opts.Cookie.Name = "oauth2"
1606 opts.Cookie.Domains = []string{"abc"}
1748 opts.Cookie.Domains = []string{"abc"}
1749+ err := validation.Validate(opts)
1750+ assert.NoError(t, err)
1607− store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
1752+ store, err := sessionscookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
1608− assert.Equal(t, nil, err)
1753+ if err != nil {
1609 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}
1757 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}
1610 var rw = httptest.NewRecorder()
1758 var rw = httptest.NewRecorder()
1611 req := httptest.NewRequest("get", "/", nil)
1759 req := httptest.NewRequest("get", "/", nil)
@@ -1623,7 +1771,8 @@ func TestClearSplitCookie(t *testing.T) {
1623 Value: "oauth2_1",
1771 Value: "oauth2_1",
1626− p.ClearSessionCookie(rw, req)
1774+ err = p.ClearSessionCookie(rw, req)
1775+ assert.NoError(t, err)
1627 header := rw.Header()
1776 header := rw.Header()
1629 assert.Equal(t, 2, len(header["Set-Cookie"]), "should have 3 set-cookie header entries")
1778 assert.Equal(t, 2, len(header["Set-Cookie"]), "should have 3 set-cookie header entries")
@@ -1633,8 +1782,11 @@ func TestClearSingleCookie(t *testing.T) {
1633 opts := baseTestOptions()
1782 opts := baseTestOptions()
1634 opts.Cookie.Name = "oauth2"
1783 opts.Cookie.Name = "oauth2"
1635 opts.Cookie.Domains = []string{"abc"}
1784 opts.Cookie.Domains = []string{"abc"}
1636− store, err := cookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
1785+ store, err := sessionscookie.NewCookieSessionStore(&opts.Session, &opts.Cookie)
1637− assert.Equal(t, nil, err)
1786+ if err != nil {
1638 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}
1790 p := OAuthProxy{CookieName: opts.Cookie.Name, CookieDomains: opts.Cookie.Domains, sessionStore: store}
1639 var rw = httptest.NewRecorder()
1791 var rw = httptest.NewRecorder()
1640 req := httptest.NewRequest("get", "/", nil)
1792 req := httptest.NewRequest("get", "/", nil)
@@ -1648,7 +1800,8 @@ func TestClearSingleCookie(t *testing.T) {
1648 Value: "oauth2",
1800 Value: "oauth2",
1651− p.ClearSessionCookie(rw, req)
1803+ err = p.ClearSessionCookie(rw, req)
1804+ assert.NoError(t, err)
1652 header := rw.Header()
1805 header := rw.Header()
1654 assert.Equal(t, 1, len(header["Set-Cookie"]), "should have 1 set-cookie header entries")
1807 assert.Equal(t, 1, len(header["Set-Cookie"]), "should have 1 set-cookie header entries")
@@ -1686,13 +1839,16 @@ func TestGetJwtSession(t *testing.T) {
1686 verifier := oidc.NewVerifier("https://issuer.example.com", keyset,
1839 verifier := oidc.NewVerifier("https://issuer.example.com", keyset,
1687 &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})
1840 &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})
1689− test := NewAuthOnlyEndpointTest(func(opts *options.Options) {
1842+ test, err := NewAuthOnlyEndpointTest(func(opts *options.Options) {
1690 opts.PassAuthorization = true
1843 opts.PassAuthorization = true
1691 opts.SetAuthorization = true
1844 opts.SetAuthorization = true
1692 opts.SetXAuthRequest = true
1845 opts.SetXAuthRequest = true
1693 opts.SkipJwtBearerTokens = true
1846 opts.SkipJwtBearerTokens = true
1694 opts.SetJWTBearerVerifiers(append(opts.GetJWTBearerVerifiers(), verifier))
1847 opts.SetJWTBearerVerifiers(append(opts.GetJWTBearerVerifiers(), verifier))
1696 tp, _ := test.proxy.provider.(*TestProvider)
1852 tp, _ := test.proxy.provider.(*TestProvider)
1697 tp.GroupValidator = func(s string) bool {
1853 tp.GroupValidator = func(s string) bool {
1698 return true
1854 return true
@@ -1705,7 +1861,8 @@ func TestGetJwtSession(t *testing.T) {
1706 // Bearer
1862 // Bearer
1707 expires := time.Unix(1912151821, 0)
1863 expires := time.Unix(1912151821, 0)
1708− session, _ := test.proxy.GetJwtSession(test.req)
1864+ session, err := test.proxy.GetJwtSession(test.req)
1865+ assert.NoError(t, err)
1709 assert.Equal(t, session.User, "1234567890")
1866 assert.Equal(t, session.User, "1234567890")
1710 assert.Equal(t, session.Email, "john@example.com")
1867 assert.Equal(t, session.Email, "john@example.com")
1711 assert.Equal(t, session.ExpiresOn, &expires)
1868 assert.Equal(t, session.ExpiresOn, &expires)
@@ -1739,22 +1896,26 @@ func TestFindJwtBearerToken(t *testing.T) {
1739 "Authorization": {fmt.Sprintf("Bearer %s", validToken)},
1896 "Authorization": {fmt.Sprintf("Bearer %s", validToken)},
1742− token, _ = p.findBearerToken(getReq)
1899+ token, err := p.findBearerToken(getReq)
1900+ assert.NoError(t, err)
1743 assert.Equal(t, validToken, token)
1901 assert.Equal(t, validToken, token)
1745 // Basic - no password
1903 // Basic - no password
1746 getReq.SetBasicAuth(token, "")
1904 getReq.SetBasicAuth(token, "")
1747− token, _ = p.findBearerToken(getReq)
1905+ token, err = p.findBearerToken(getReq)
1906+ assert.NoError(t, err)
1748 assert.Equal(t, validToken, token)
1907 assert.Equal(t, validToken, token)
1750 // Basic - sentinel password
1909 // Basic - sentinel password
1751 getReq.SetBasicAuth(token, "x-oauth-basic")
1910 getReq.SetBasicAuth(token, "x-oauth-basic")
1752− token, _ = p.findBearerToken(getReq)
1911+ token, err = p.findBearerToken(getReq)
1912+ assert.NoError(t, err)
1753 assert.Equal(t, validToken, token)
1913 assert.Equal(t, validToken, token)
1755 // Basic - any username, password matching jwt pattern
1915 // Basic - any username, password matching jwt pattern
1756 getReq.SetBasicAuth("any-username-you-could-wish-for", token)
1916 getReq.SetBasicAuth("any-username-you-could-wish-for", token)
1757− token, _ = p.findBearerToken(getReq)
1917+ token, err = p.findBearerToken(getReq)
1918+ assert.NoError(t, err)
1758 assert.Equal(t, validToken, token)
1919 assert.Equal(t, validToken, token)
1760 failures := []string{
1921 failures := []string{
@@ -1785,8 +1946,6 @@ func TestFindJwtBearerToken(t *testing.T) {
1785 _, err := p.findBearerToken(getReq)
1946 _, err := p.findBearerToken(getReq)
1786 assert.Error(t, err)
1947 assert.Error(t, err)
1789− fmt.Printf("%s", token)
1792func Test_prepareNoCache(t *testing.T) {
1951func Test_prepareNoCache(t *testing.T) {
@@ -1807,18 +1966,22 @@ func Test_prepareNoCache(t *testing.T) {
1808func Test_noCacheHeaders(t *testing.T) {
1967func Test_noCacheHeaders(t *testing.T) {
1809 upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
1968 upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
1810− w.Write([]byte("upstream"))
1969+ _, err := w.Write([]byte("upstream"))
1812 t.Cleanup(upstream.Close)
1974 t.Cleanup(upstream.Close)
1814 opts := baseTestOptions()
1976 opts := baseTestOptions()
1815 opts.Upstreams = []string{upstream.URL}
1977 opts.Upstreams = []string{upstream.URL}
1816 opts.SkipAuthRegex = []string{".*"}
1978 opts.SkipAuthRegex = []string{".*"}
1817− _ = validation.Validate(opts)
1979+ err := validation.Validate(opts)
1818− proxy, err := NewOAuthProxy(opts, func(email string) bool {
1821 assert.NoError(t, err)
1980 assert.NoError(t, err)
1981+ proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })
1823 t.Run("not exist in response from upstream", func(t *testing.T) {
1986 t.Run("not exist in response from upstream", func(t *testing.T) {
1824 rec := httptest.NewRecorder()
1987 rec := httptest.NewRecorder()
@@ -1887,8 +2050,8 @@ func Test_noCacheHeaders(t *testing.T) {
1887func baseTestOptions() *options.Options {
2050func baseTestOptions() *options.Options {
1888 opts := options.NewOptions()
2051 opts := options.NewOptions()
1889 opts.Cookie.Secret = rawCookieSecret
2052 opts.Cookie.Secret = rawCookieSecret
1890− opts.ClientID = "cliend-id"
2053+ opts.ClientID = clientID
1891− opts.ClientSecret = "client-secret"
2054+ opts.ClientSecret = clientSecret
1892 opts.EmailDomains = []string{"*"}
2055 opts.EmailDomains = []string{"*"}
1893 return opts
2056 return opts