git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #68 from jehiah/upstream_host_header_68

Proxied requests use the upstream Host as Host Header

commitb2dfbd8564800170450aec5f1ba69b1dfaf6f4e8 authorJehiah Czebotar <jehiah@gmail.com> dateTue 17 Mar 2015, 16:03 (12 years ago) parentade9502a162ee8
8 files changed+84−22
compare with master
unifiedsplit
.travis.yml+1−1 README.md+1 contrib/google_auth_proxy.cfg.example+3 main.go+1 oauthproxy.go+16−1 oauthproxy_test.go+37 options.go+22−17 options_test.go+3−3
.travis.yml+1−1
@@ -1,7 +1,7 @@
11language: go
22go:
3− - 1.2.2
43 - 1.3.3
4+ - 1.4.2
55script:
66 - curl -s https://raw.githubusercontent.com/pote/gpm/v1.3.1/bin/gpm > gpm
77 - chmod +x gpm
README.md+1
@@ -72,6 +72,7 @@ Usage of google_auth_proxy:
7272 -htpasswd-file="": additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
7373 -http-address="127.0.0.1:4180": [http://]<addr>:<port> or unix://<path> to listen on for HTTP clients
7474 -pass-basic-auth=true: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
75+ -pass-host-header=true: pass the request Host Header to upstream
7576 -redirect-url="": the OAuth Redirect URL. ie: "https://internalapp.yourcompany.com/oauth2/callback"
7677 -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times)
7778 -upstream=: the http url(s) of the upstream endpoint. If multiple, routing is based on path
contrib/google_auth_proxy.cfg.example+3
@@ -14,6 +14,9 @@
1414
1515## pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
1616# pass_basic_auth = true
17+## pass the request Host Header to upstream
18+## when disabled the upstream Host is used as the Host Header
19+# pass_host_header = true
1720
1821## Google Apps Domains to allow authentication for
1922# google_apps_domains = [
main.go+1
@@ -29,6 +29,7 @@ func main() {
2929 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")
3030 flagSet.Var(&upstreams, "upstream", "the http url(s) of the upstream endpoint. If multiple, routing is based on path")
3131 flagSet.Bool("pass-basic-auth", true, "pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream")
32+ flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream")
3233 flagSet.Var(&skipAuthRegex, "skip-auth-regex", "bypass authentication for requests path's that match (may be given multiple times)")
3334
3435 flagSet.Var(&googleAppsDomains, "google-apps-domain", "authenticate against the given Google apps domain (may be given multiple times)")
oauthproxy.go+16−1
@@ -46,6 +46,17 @@ type OauthProxy struct {
4646 compiledRegex []*regexp.Regexp
4747}
4848
49+func NewReverseProxy(target *url.URL) (proxy *httputil.ReverseProxy) {
50+ return httputil.NewSingleHostReverseProxy(target)
51+}
52+func setProxyUpstreamHostHeader(proxy *httputil.ReverseProxy, target *url.URL) {
53+ director := proxy.Director
54+ proxy.Director = func(req *http.Request) {
55+ director(req)
56+ req.Host = target.Host
57+ }
58+}
59+
4960func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
5061 login, _ := url.Parse("https://accounts.google.com/o/oauth2/auth")
5162 redeem, _ := url.Parse("https://accounts.google.com/o/oauth2/token")
@@ -54,7 +65,11 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
5465 path := u.Path
5566 u.Path = ""
5667 log.Printf("mapping path %q => upstream %q", path, u)
57− serveMux.Handle(path, httputil.NewSingleHostReverseProxy(u))
68+ proxy := NewReverseProxy(u)
69+ if !opts.PassHostHeader {
70+ setProxyUpstreamHostHeader(proxy, u)
71+ }
72+ serveMux.Handle(path, proxy)
5873 }
5974 for _, u := range opts.CompiledRegex {
6075 log.Printf("compiled skip-auth-regex => %q", u)
oauthproxy_test.gonew file+37
@@ -0,0 +1,37 @@
1+package main
2+
3+import (
4+ "io/ioutil"
5+ "net"
6+ "net/http"
7+ "net/http/httptest"
8+ "net/url"
9+ "testing"
10+)
11+
12+func TestNewReverseProxy(t *testing.T) {
13+ backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
14+ w.WriteHeader(200)
15+ hostname, _, _ := net.SplitHostPort(r.Host)
16+ w.Write([]byte(hostname))
17+ }))
18+ defer backend.Close()
19+
20+ backendURL, _ := url.Parse(backend.URL)
21+ backendHostname := "upstream.127.0.0.1.xip.io"
22+ _, backendPort, _ := net.SplitHostPort(backendURL.Host)
23+ backendHost := net.JoinHostPort(backendHostname, backendPort)
24+ proxyURL, _ := url.Parse(backendURL.Scheme + "://" + backendHost + "/")
25+
26+ proxyHandler := NewReverseProxy(proxyURL)
27+ setProxyUpstreamHostHeader(proxyHandler, proxyURL)
28+ frontend := httptest.NewServer(proxyHandler)
29+ defer frontend.Close()
30+
31+ getReq, _ := http.NewRequest("GET", frontend.URL, nil)
32+ res, _ := http.DefaultClient.Do(getReq)
33+ bodyBytes, _ := ioutil.ReadAll(res.Body)
34+ if g, e := string(bodyBytes), backendHostname; g != e {
35+ t.Errorf("got body %q; expected %q", g, e)
36+ }
37+}
options.go+22−17
@@ -10,22 +10,26 @@ import (
1010
1111// Configuration Options that can be set by Command Line Flag, or Config File
1212type Options struct {
13− HttpAddress string `flag:"http-address" cfg:"http_address"`
14− RedirectUrl string `flag:"redirect-url" cfg:"redirect_url"`
15− ClientID string `flag:"client-id" cfg:"client_id" env:"GOOGLE_AUTH_PROXY_CLIENT_ID"`
16− ClientSecret string `flag:"client-secret" cfg:"client_secret" env:"GOOGLE_AUTH_PROXY_CLIENT_SECRET"`
17− PassBasicAuth bool `flag:"pass-basic-auth" cfg:"pass_basic_auth"`
18− HtpasswdFile string `flag:"htpasswd-file" cfg:"htpasswd_file"`
19− DisplayHtpasswdForm bool `flag:"display-htpasswd-form" cfg:"display_htpasswd_form"`
20− CookieSecret string `flag:"cookie-secret" cfg:"cookie_secret" env:"GOOGLE_AUTH_PROXY_COOKIE_SECRET"`
21− CookieDomain string `flag:"cookie-domain" cfg:"cookie_domain" env:"GOOGLE_AUTH_PROXY_COOKIE_DOMAIN"`
22− CookieExpire time.Duration `flag:"cookie-expire" cfg:"cookie_expire" env:"GOOGLE_AUTH_PROXY_COOKIE_EXPIRE"`
23− CookieHttpsOnly bool `flag:"cookie-https-only" cfg:"cookie_https_only"`
24− CookieHttpOnly bool `flag:"cookie-httponly" cfg:"cookie_httponly"`
25− AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file"`
26− GoogleAppsDomains []string `flag:"google-apps-domain" cfg:"google_apps_domains"`
27− Upstreams []string `flag:"upstream" cfg:"upstreams"`
28− SkipAuthRegex []string `flag:"skip-auth-regex" cfg:"skip_auth_regex"`
13+ HttpAddress string `flag:"http-address" cfg:"http_address"`
14+ RedirectUrl string `flag:"redirect-url" cfg:"redirect_url"`
15+ ClientID string `flag:"client-id" cfg:"client_id" env:"GOOGLE_AUTH_PROXY_CLIENT_ID"`
16+ ClientSecret string `flag:"client-secret" cfg:"client_secret" env:"GOOGLE_AUTH_PROXY_CLIENT_SECRET"`
17+
18+ AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file"`
19+ GoogleAppsDomains []string `flag:"google-apps-domain" cfg:"google_apps_domains"`
20+ HtpasswdFile string `flag:"htpasswd-file" cfg:"htpasswd_file"`
21+ DisplayHtpasswdForm bool `flag:"display-htpasswd-form" cfg:"display_htpasswd_form"`
22+
23+ CookieSecret string `flag:"cookie-secret" cfg:"cookie_secret" env:"GOOGLE_AUTH_PROXY_COOKIE_SECRET"`
24+ CookieDomain string `flag:"cookie-domain" cfg:"cookie_domain" env:"GOOGLE_AUTH_PROXY_COOKIE_DOMAIN"`
25+ CookieExpire time.Duration `flag:"cookie-expire" cfg:"cookie_expire" env:"GOOGLE_AUTH_PROXY_COOKIE_EXPIRE"`
26+ CookieHttpsOnly bool `flag:"cookie-https-only" cfg:"cookie_https_only"`
27+ CookieHttpOnly bool `flag:"cookie-httponly" cfg:"cookie_httponly"`
28+
29+ Upstreams []string `flag:"upstream" cfg:"upstreams"`
30+ SkipAuthRegex []string `flag:"skip-auth-regex" cfg:"skip_auth_regex"`
31+ PassBasicAuth bool `flag:"pass-basic-auth" cfg:"pass_basic_auth"`
32+ PassHostHeader bool `flag:"pass-host-header" cfg:"pass_host_header"`
2933
3034 // internal values that are set after config validation
3135 redirectUrl *url.URL
@@ -39,8 +43,9 @@ func NewOptions() *Options {
3943 DisplayHtpasswdForm: true,
4044 CookieHttpsOnly: true,
4145 CookieHttpOnly: true,
42− PassBasicAuth: true,
4346 CookieExpire: time.Duration(168) * time.Hour,
47+ PassBasicAuth: true,
48+ PassHostHeader: true,
4449 }
4550}
4651
options_test.go+3−3
@@ -1,14 +1,14 @@
11package main
22
33import (
4+ "net/url"
45 "strings"
56 "testing"
6− "net/url"
77
88 "github.com/bmizerany/assert"
99)
1010
11−func testOptions() (*Options) {
11+func testOptions() *Options {
1212 o := NewOptions()
1313 o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8080/")
1414 o.CookieSecret = "foobar"
@@ -17,7 +17,7 @@ func testOptions() (*Options) {
1717 return o
1818}
1919
20−func errorMsg(msgs []string)(string) {
20+func errorMsg(msgs []string) string {
2121 result := make([]string, 0)
2222 result = append(result, "Invalid configuration:")
2323 result = append(result, msgs...)