git.iko.soy/typeable/oauth2-proxy
on master help sign in
Create Cookie FlagSet and Defaults
commitb3ba2594c696b338fcb5ad1a0bd4aa86f84eb7ce authorJoel Speed <joel.speed@hotmail.co.uk> dateSat 23 May 2020, 17:04 (6 years ago) parent016f4aa
2 files changed+38−20
compare with master
unifiedsplit
pkg/apis/options/cookie.go+36−1 pkg/apis/options/options.go+2−19
pkg/apis/options/cookie.go+36−1
@@ -1,6 +1,10 @@
11package options
22
3−import "time"
3+import (
4+ "time"
5+
6+ "github.com/spf13/pflag"
7+)
48
59// CookieOptions contains configuration options relating to Cookie configuration
610type CookieOptions struct {
@@ -14,3 +18,34 @@ type CookieOptions struct {
1418 HTTPOnly bool `flag:"cookie-httponly" cfg:"cookie_httponly"`
1519 SameSite string `flag:"cookie-samesite" cfg:"cookie_samesite"`
1620}
21+
22+func cookieFlagSet() *pflag.FlagSet {
23+ flagSet := pflag.NewFlagSet("cookie", pflag.ExitOnError)
24+
25+ flagSet.String("cookie-name", "_oauth2_proxy", "the name of the cookie that the oauth_proxy creates")
26+ flagSet.String("cookie-secret", "", "the seed string for secure cookies (optionally base64 encoded)")
27+ flagSet.StringSlice("cookie-domain", []string{}, "Optional cookie domains to force cookies to (ie: `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match).")
28+ flagSet.String("cookie-path", "/", "an optional cookie path to force cookies to (ie: /poc/)*")
29+ flagSet.Duration("cookie-expire", time.Duration(168)*time.Hour, "expire timeframe for cookie")
30+ flagSet.Duration("cookie-refresh", time.Duration(0), "refresh the cookie after this duration; 0 to disable")
31+ flagSet.Bool("cookie-secure", true, "set secure (HTTPS) cookie flag")
32+ flagSet.Bool("cookie-httponly", true, "set HttpOnly cookie flag")
33+ flagSet.String("cookie-samesite", "", "set SameSite cookie attribute (ie: \"lax\", \"strict\", \"none\", or \"\"). ")
34+
35+ return flagSet
36+}
37+
38+// defaultCookieOptions creates a CookieOptions populating each field with its default value
39+func defaultCookieOptions() CookieOptions {
40+ return CookieOptions{
41+ Name: "_oauth2_proxy",
42+ Secret: "",
43+ Domains: nil,
44+ Path: "/",
45+ Expire: time.Duration(168) * time.Hour,
46+ Refresh: time.Duration(0),
47+ Secure: true,
48+ HTTPOnly: true,
49+ SameSite: "",
50+ }
51+}
pkg/apis/options/options.go+2−19
@@ -153,14 +153,7 @@ func NewOptions() *Options {
153153 RealClientIPHeader: "X-Real-IP",
154154 ForceHTTPS: false,
155155 DisplayHtpasswdForm: true,
156− Cookie: CookieOptions{
157− Name: "_oauth2_proxy",
158− Secure: true,
159− HTTPOnly: true,
160− Expire: time.Duration(168) * time.Hour,
161− Refresh: time.Duration(0),
162− Path: "/",
163− },
156+ Cookie: defaultCookieOptions(),
164157 Session: SessionOptions{
165158 Type: "cookie",
166159 },
@@ -245,17 +238,6 @@ func NewFlagSet() *pflag.FlagSet {
245238 flagSet.String("ping-path", "/ping", "the ping endpoint that can be used for basic health checks")
246239 flagSet.String("ping-user-agent", "", "special User-Agent that will be used for basic health checks")
247240 flagSet.Bool("proxy-websockets", true, "enables WebSocket proxying")
248−
249− flagSet.String("cookie-name", "_oauth2_proxy", "the name of the cookie that the oauth_proxy creates")
250− flagSet.String("cookie-secret", "", "the seed string for secure cookies (optionally base64 encoded)")
251− flagSet.StringSlice("cookie-domain", []string{}, "Optional cookie domains to force cookies to (ie: `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match).")
252− flagSet.String("cookie-path", "/", "an optional cookie path to force cookies to (ie: /poc/)*")
253− flagSet.Duration("cookie-expire", time.Duration(168)*time.Hour, "expire timeframe for cookie")
254− flagSet.Duration("cookie-refresh", time.Duration(0), "refresh the cookie after this duration; 0 to disable")
255− flagSet.Bool("cookie-secure", true, "set secure (HTTPS) cookie flag")
256− flagSet.Bool("cookie-httponly", true, "set HttpOnly cookie flag")
257− flagSet.String("cookie-samesite", "", "set SameSite cookie attribute (ie: \"lax\", \"strict\", \"none\", or \"\"). ")
258−
259241 flagSet.String("session-store-type", "cookie", "the session storage provider to use")
260242 flagSet.String("redis-connection-url", "", "URL of redis server for redis session storage (eg: redis://HOST[:PORT])")
261243 flagSet.Bool("redis-use-sentinel", false, "Connect to redis via sentinels. Must set --redis-sentinel-master-name and --redis-sentinel-connection-urls to use this feature")
@@ -292,6 +274,7 @@ func NewFlagSet() *pflag.FlagSet {
292274
293275 flagSet.String("user-id-claim", "email", "which claim contains the user ID")
294276
277+ flagSet.AddFlagSet(cookieFlagSet())
295278 flagSet.AddFlagSet(loggingFlagSet())
296279
297280 return flagSet