git.iko.soy/typeable/oauth2-proxy
on master help sign in
Track the ReverseProxy option in the request Scope

This allows for proper handling of reverse proxy based headers throughout the lifecycle of a request.

commitb625de94904f33130714d92b3a650bd0cef569bf authorNick Meves <nick.meves@greenhouse.io> dateWed 23 Dec 2020, 17:42 (6 years ago) parent8e02fac
4 files changed+29−17
oauthproxy.go+1−1 pkg/apis/middleware/scope.go+4 pkg/middleware/scope.go+13−13 pkg/util/util.go+11−3
oauthproxy.go+1−1
@@ -231,7 +231,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr
231231// the OAuth2 Proxy authentication logic kicks in.
232232// For example forcing HTTPS or health checks.
233233func buildPreAuthChain(opts *options.Options) (alice.Chain, error) {
234− chain := alice.New(middleware.NewScope())
234+ chain := alice.New(middleware.NewScope(opts))
235235
236236 if opts.ForceHTTPS {
237237 _, httpsPort, err := net.SplitHostPort(opts.HTTPSAddress)
pkg/apis/middleware/scope.go+4
@@ -8,6 +8,10 @@ import (
88// The RequestScope is used to pass information between different middlewares
99// within the chain.
1010type RequestScope struct {
11+ // ReverseProxy tracks whether OAuth2-Proxy is operating in reverse proxy
12+ // mode and if request `X-Forwarded-*` headers should be trusted
13+ ReverseProxy bool
14+
1115 // Session details the authenticated users information (if it exists).
1216 Session *sessions.SessionState
1317
pkg/middleware/scope.go+13−13
@@ -6,26 +6,26 @@ import (
66
77 "github.com/justinas/alice"
88 middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
9+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
910)
1011
1112type scopeKey string
1213
13−// requestScopeKey uses a typed string to reduce likelihood of clasing
14+// requestScopeKey uses a typed string to reduce likelihood of clashing
1415// with other context keys
1516const requestScopeKey scopeKey = "request-scope"
1617
17−func NewScope() alice.Constructor {
18− return addScope
19−}
20−
21−// addScope injects a new request scope into the request context.
22−func addScope(next http.Handler) http.Handler {
23− return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
24− scope := &middlewareapi.RequestScope{}
25− contextWithScope := context.WithValue(req.Context(), requestScopeKey, scope)
26− requestWithScope := req.WithContext(contextWithScope)
27− next.ServeHTTP(rw, requestWithScope)
28− })
18+func NewScope(opts *options.Options) alice.Constructor {
19+ return func(next http.Handler) http.Handler {
20+ return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
21+ scope := &middlewareapi.RequestScope{
22+ ReverseProxy: opts.ReverseProxy,
23+ }
24+ contextWithScope := context.WithValue(req.Context(), requestScopeKey, scope)
25+ requestWithScope := req.WithContext(contextWithScope)
26+ next.ServeHTTP(rw, requestWithScope)
27+ })
28+ }
2929}
3030
3131// GetRequestScope returns the current request scope from the given request
pkg/util/util.go+11−3
@@ -5,6 +5,8 @@ import (
55 "fmt"
66 "io/ioutil"
77 "net/http"
8+
9+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/middleware"
810)
911
1012func GetCertPool(paths []string) (*x509.CertPool, error) {
@@ -28,16 +30,17 @@ func GetCertPool(paths []string) (*x509.CertPool, error) {
2830// GetRequestProto return the request host header or X-Forwarded-Proto if present
2931func GetRequestProto(req *http.Request) string {
3032 proto := req.Header.Get("X-Forwarded-Proto")
31− if proto == "" {
33+ if !isProxied(req) || proto == "" {
3234 proto = req.URL.Scheme
3335 }
3436 return proto
3537}
3638
3739// GetRequestHost return the request host header or X-Forwarded-Host if present
40+// and reverse proxy mode is enabled.
3841func GetRequestHost(req *http.Request) string {
3942 host := req.Header.Get("X-Forwarded-Host")
40− if host == "" {
43+ if !isProxied(req) || host == "" {
4144 host = req.Host
4245 }
4346 return host
@@ -46,9 +49,14 @@ func GetRequestHost(req *http.Request) string {
4649// GetRequestURI return the request host header or X-Forwarded-Uri if present
4750func GetRequestURI(req *http.Request) string {
4851 uri := req.Header.Get("X-Forwarded-Uri")
49− if uri == "" {
52+ if !isProxied(req) || uri == "" {
5053 // Use RequestURI to preserve ?query
5154 uri = req.URL.RequestURI()
5255 }
5356 return uri
5457}
58+
59+func isProxied(req *http.Request) bool {
60+ scope := middleware.GetRequestScope(req)
61+ return scope.ReverseProxy
62+}