@@ -723,6 +723,142 @@ func TestPassUserHeadersWithEmail(t *testing.T) {
723723 }
724724}
725725
726+func TestStripAuthHeaders(t *testing.T) {
727+ testCases := map[string]struct {
728+ SkipAuthStripHeaders bool
729+ PassBasicAuth bool
730+ PassUserHeaders bool
731+ PassAccessToken bool
732+ PassAuthorization bool
733+ StrippedHeaders map[string]bool
734+ }{
735+ "Default options": {
736+ SkipAuthStripHeaders: true,
737+ PassBasicAuth: true,
738+ PassUserHeaders: true,
739+ PassAccessToken: false,
740+ PassAuthorization: false,
741+ StrippedHeaders: map[string]bool{
742+ "X-Forwarded-User": true,
743+ "X-Forwarded-Email": true,
744+ "X-Forwarded-Preferred-Username": true,
745+ "X-Forwarded-Access-Token": false,
746+ "Authorization": true,
747+ },
748+ },
749+ "Pass access token": {
750+ SkipAuthStripHeaders: true,
751+ PassBasicAuth: true,
752+ PassUserHeaders: true,
753+ PassAccessToken: true,
754+ PassAuthorization: false,
755+ StrippedHeaders: map[string]bool{
756+ "X-Forwarded-User": true,
757+ "X-Forwarded-Email": true,
758+ "X-Forwarded-Preferred-Username": true,
759+ "X-Forwarded-Access-Token": true,
760+ "Authorization": true,
761+ },
762+ },
763+ "Nothing setting Authorization": {
764+ SkipAuthStripHeaders: true,
765+ PassBasicAuth: false,
766+ PassUserHeaders: true,
767+ PassAccessToken: true,
768+ PassAuthorization: false,
769+ StrippedHeaders: map[string]bool{
770+ "X-Forwarded-User": true,
771+ "X-Forwarded-Email": true,
772+ "X-Forwarded-Preferred-Username": true,
773+ "X-Forwarded-Access-Token": true,
774+ "Authorization": false,
775+ },
776+ },
777+ "Only Authorization header modified": {
778+ SkipAuthStripHeaders: true,
779+ PassBasicAuth: false,
780+ PassUserHeaders: false,
781+ PassAccessToken: false,
782+ PassAuthorization: true,
783+ StrippedHeaders: map[string]bool{
784+ "X-Forwarded-User": false,
785+ "X-Forwarded-Email": false,
786+ "X-Forwarded-Preferred-Username": false,
787+ "X-Forwarded-Access-Token": false,
788+ "Authorization": true,
789+ },
790+ },
791+ "Don't strip any headers (default options)": {
792+ SkipAuthStripHeaders: false,
793+ PassBasicAuth: true,
794+ PassUserHeaders: true,
795+ PassAccessToken: false,
796+ PassAuthorization: false,
797+ StrippedHeaders: map[string]bool{
798+ "X-Forwarded-User": false,
799+ "X-Forwarded-Email": false,
800+ "X-Forwarded-Preferred-Username": false,
801+ "X-Forwarded-Access-Token": false,
802+ "Authorization": false,
803+ },
804+ },
805+ "Don't strip any headers (custom options)": {
806+ SkipAuthStripHeaders: false,
807+ PassBasicAuth: true,
808+ PassUserHeaders: true,
809+ PassAccessToken: true,
810+ PassAuthorization: false,
811+ StrippedHeaders: map[string]bool{
812+ "X-Forwarded-User": false,
813+ "X-Forwarded-Email": false,
814+ "X-Forwarded-Preferred-Username": false,
815+ "X-Forwarded-Access-Token": false,
816+ "Authorization": false,
817+ },
818+ },
819+ }
820+
821+ initialHeaders := map[string]string{
822+ "X-Forwarded-User": "9fcab5c9b889a557",
823+ "X-Forwarded-Email": "john.doe@example.com",
824+ "X-Forwarded-Preferred-Username": "john.doe",
825+ "X-Forwarded-Access-Token": "AccessToken",
826+ "Authorization": "bearer IDToken",
827+ }
828+
829+ for name, tc := range testCases {
830+ t.Run(name, func(t *testing.T) {
831+ opts := baseTestOptions()
832+ opts.SkipAuthStripHeaders = tc.SkipAuthStripHeaders
833+ opts.PassBasicAuth = tc.PassBasicAuth
834+ opts.PassUserHeaders = tc.PassUserHeaders
835+ opts.PassAccessToken = tc.PassAccessToken
836+ opts.PassAuthorization = tc.PassAuthorization
837+ err := validation.Validate(opts)
838+ assert.NoError(t, err)
839+
840+ req, _ := http.NewRequest("GET", fmt.Sprintf("%s/testCase", opts.ProxyPrefix), nil)
841+ for header, val := range initialHeaders {
842+ req.Header.Set(header, val)
843+ }
844+
845+ proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })
846+ assert.NoError(t, err)
847+ if proxy.skipAuthStripHeaders {
848+ proxy.stripAuthHeaders(req)
849+ }
850+
851+ for header, stripped := range tc.StrippedHeaders {
852+ if stripped {
853+ assert.Equal(t, req.Header.Get(header), "")
854+ } else {
855+ assert.Equal(t, req.Header.Get(header), initialHeaders[header])
856+ }
857+ }
858+ })
859+ }
860+}
861+
726862type PassAccessTokenTest struct {
727863 providerServer *httptest.Server
728864 proxy *OAuthProxy