git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #226 from continusec/makeheadersettingdeterministic

Made setting of proxied headers deterministic based on configuration alone

commita1659284586676b452b02d5c29d58e479aca096b authorJoel Speed <Joel.speed@hotmail.co.uk> dateFri 16 Aug 2019, 14:41 (7 years ago) parentc4559ead5d4878
2 files changed+37−8
compare with master
unifiedsplit
CHANGELOG.md+1 oauthproxy.go+36−8
CHANGELOG.md+1
@@ -39,6 +39,7 @@
3939- [#234](https://github.com/pusher/oauth2_proxy/pull/234) Added option `-ssl-upstream-insecure-skip-validation` to skip validation of upstream SSL certificates (@jansinger)
4040- [#224](https://github.com/pusher/oauth2_proxy/pull/224) Check Google group membership using hasMember to support nested groups and external users (@jpalpant)
4141- [#231](https://github.com/pusher/oauth2_proxy/pull/231) Add optional group membership and email domain checks to the GitLab provider (@Overv)
42+- [#226](https://github.com/pusher/oauth2_proxy/pull/226) Made setting of proxied headers deterministic based on configuration alone (@aeijdenberg)
4243- [#178](https://github.com/pusher/oauth2_proxy/pull/178) Add Silence Ping Logging and Exclude Logging Paths flags (@kskewes)
4344- [#209](https://github.com/pusher/oauth2_proxy/pull/209) Improve docker build caching of layers (@dekimsey)
4445- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent (@JoelSpeed)
oauthproxy.go+36−8
@@ -820,32 +820,60 @@ func (p *OAuthProxy) addHeadersForProxying(rw http.ResponseWriter, req *http.Req
820820 req.Header["X-Forwarded-User"] = []string{session.User}
821821 if session.Email != "" {
822822 req.Header["X-Forwarded-Email"] = []string{session.Email}
823+ } else {
824+ req.Header.Del("X-Forwarded-Email")
823825 }
824826 }
827+
825828 if p.PassUserHeaders {
826829 req.Header["X-Forwarded-User"] = []string{session.User}
827830 if session.Email != "" {
828831 req.Header["X-Forwarded-Email"] = []string{session.Email}
832+ } else {
833+ req.Header.Del("X-Forwarded-Email")
829834 }
830835 }
836+
831837 if p.SetXAuthRequest {
832838 rw.Header().Set("X-Auth-Request-User", session.User)
833839 if session.Email != "" {
834840 rw.Header().Set("X-Auth-Request-Email", session.Email)
841+ } else {
842+ rw.Header().Del("X-Auth-Request-Email")
835843 }
836− if p.PassAccessToken && session.AccessToken != "" {
837− rw.Header().Set("X-Auth-Request-Access-Token", session.AccessToken)
844+
845+ if p.PassAccessToken {
846+ if session.AccessToken != "" {
847+ rw.Header().Set("X-Auth-Request-Access-Token", session.AccessToken)
848+ } else {
849+ rw.Header().Del("X-Auth-Request-Access-Token")
850+ }
838851 }
839852 }
840− if p.PassAccessToken && session.AccessToken != "" {
841− req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}
853+
854+ if p.PassAccessToken {
855+ if session.AccessToken != "" {
856+ req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}
857+ } else {
858+ req.Header.Del("X-Forwarded-Access-Token")
859+ }
842860 }
843− if p.PassAuthorization && session.IDToken != "" {
844− req.Header["Authorization"] = []string{fmt.Sprintf("Bearer %s", session.IDToken)}
861+
862+ if p.PassAuthorization {
863+ if session.IDToken != "" {
864+ req.Header["Authorization"] = []string{fmt.Sprintf("Bearer %s", session.IDToken)}
865+ } else {
866+ req.Header.Del("Authorization")
867+ }
845868 }
846− if p.SetAuthorization && session.IDToken != "" {
847− rw.Header().Set("Authorization", fmt.Sprintf("Bearer %s", session.IDToken))
869+ if p.SetAuthorization {
870+ if session.IDToken != "" {
871+ rw.Header().Set("Authorization", fmt.Sprintf("Bearer %s", session.IDToken))
872+ } else {
873+ rw.Header().Del("Authorization")
874+ }
848875 }
876+
849877 if session.Email == "" {
850878 rw.Header().Set("GAP-Auth", session.User)
851879 } else {