@@ -42,6 +42,9 @@ var (
4242 // ErrNeedsLogin means the user should be redirected to the login page
4343 ErrNeedsLogin = errors.New("redirect to login page")
4444
45+ // ErrAccessDenied means the user should receive a 401 Unauthorized response
46+ ErrAccessDenied = errors.New("access denied")
47+
4548 // Used to check final redirects are not susceptible to open redirects.
4649 // Matches //, /\ and both of these with whitespace in between (eg / / or / \).
4750 invalidRedirectRegex = regexp.MustCompile(`[/\\](?:[\s\v]*|\.{1,2})[/\\]`)
@@ -969,6 +972,9 @@ func (p *OAuthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
969972 p.SignInPage(rw, req, http.StatusForbidden)
970973 }
971974
975+ case ErrAccessDenied:
976+ p.ErrorPage(rw, http.StatusUnauthorized, "Permission Denied", "Unauthorized")
977+
972978 default:
973979 // unknown error
974980 logger.Errorf("Unexpected internal error: %v", err)
@@ -979,7 +985,9 @@ func (p *OAuthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
979985}
980986
981987// getAuthenticatedSession checks whether a user is authenticated and returns a session object and nil error if so
982−// Returns nil, ErrNeedsLogin if user needs to login.
988+// Returns:
989+// - `nil, ErrNeedsLogin` if user needs to login.
990+// - `nil, ErrAccessDenied` if the authenticated user is not authorized
983991// Set-Cookie headers may be set on the response as a side-effect of calling this method.
984992func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.Request) (*sessionsapi.SessionState, error) {
985993 var session *sessionsapi.SessionState
@@ -1000,13 +1008,13 @@ func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.R
10001008 }
10011009
10021010 if invalidEmail || !authorized {
1003− logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via session: removing session %s", session)
1011+ logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authorization via session: removing session %s", session)
10041012 // Invalid session, clear it
10051013 err := p.ClearSessionCookie(rw, req)
10061014 if err != nil {
10071015 logger.Errorf("Error clearing session cookie: %v", err)
10081016 }
1009− return nil, ErrNeedsLogin
1017+ return nil, ErrAccessDenied
10101018 }
10111019
10121020 return session, nil