a999270 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Add req.host to targetURL when redirecting to https (#668)

* Add req.host to targetURL when redirecting to https The req.URL.Host might not be present when redirecting to https if the given req.URL is something like "/". In such scenario, the req.Host is still present and valid. This commit adds the original req.Host to the targetURL before returning the 308 status, to avoid having a `Location: https:///` in the response. * Bring back empty line * Wrap the setting of targetURL.Host in a condition * Add a comment to the test explaining why the redirectURL includes example.com * Add changelog entry

commita999270cf3b4dc808fd22307bcab182965ba030e authorMariano Vallés <zucaritas@gmail.com> dateTue 7 Jul 2020, 10:55 (6 years ago) parentd297666

3 files changed+16

compare with master

unifiedsplit

CHANGELOG.md+1 pkg/middleware/redirect_to_https.go+5 pkg/middleware/redirect_to_https_test.go+10

CHANGELOG.md+1

@@ -8,6 +8,7 @@

99## Changes since v6.0.0

1010

11+- [#668](https://github.com/oauth2-proxy/oauth2-proxy/pull/668) Use req.Host in --force-https when req.URL.Host is empty (@zucaritask)

1112- [#660](https://github.com/oauth2-proxy/oauth2-proxy/pull/660) Use builder pattern to simplify requests to external endpoints (@JoelSpeed)

1213- [#591](https://github.com/oauth2-proxy/oauth2-proxy/pull/591) Introduce upstream package with new reverse proxy implementation (@JoelSpeed)

1314- [#576](https://github.com/oauth2-proxy/oauth2-proxy/pull/576) Separate Cookie validation out of main options validation (@JoelSpeed)

pkg/middleware/redirect_to_https.go+5

@@ -38,6 +38,11 @@ func redirectToHTTPS(httpsPort string, next http.Handler) http.Handler {

3838 // Set the scheme to HTTPS

3939 targetURL.Scheme = httpsScheme

4040

41+ // Set the req.Host when the targetURL still does not have one

42+ if targetURL.Host == "" {

43+ targetURL.Host = req.Host

44+ }

45+

4146 // Overwrite the port if the original request was to a non-standard port

4247 if targetURL.Port() != "" {

4348 // If Port was not empty, this should be fine to ignore the error

pkg/middleware/redirect_to_https_test.go+10

@@ -154,5 +154,15 @@ var _ = Describe("RedirectToHTTPS suite", func() {

154154 expectedStatus: 200,

155155 expectedBody: "test",

156156 }),

157+ // By using newRequest from httptest we get example.com as a Host

158+ // when the target is just a path.

159+ // For details: https://golang.org/pkg/net/http/httptest/#NewRequest

160+ Entry("without TLS with a path as request", &requestTableInput{

161+ requestString: "/",

162+ useTLS: false,

163+ expectedStatus: 308,

164+ expectedBody: permanentRedirectBody("https://example.com/"),

165+ expectedLocation: "https://example.com/",

166+ }),

157167 )

158168})