git.iko.soy/typeable/oauth2-proxy
on master help sign in
Return 401 Unauthorized if Authorize fails
b9661cbNick Meves
oauthproxy.go+11−3
compare with master
unifiedsplit
@@ -42,6 +42,9 @@ var (
42 // ErrNeedsLogin means the user should be redirected to the login page
42 // ErrNeedsLogin means the user should be redirected to the login page
43 ErrNeedsLogin = errors.New("redirect to login page")
43 ErrNeedsLogin = errors.New("redirect to login page")
44
44
45+ // ErrAccessDenied means the user should receive a 401 Unauthorized response
46+ ErrAccessDenied = errors.New("access denied")
47+
45 // Used to check final redirects are not susceptible to open redirects.
48 // Used to check final redirects are not susceptible to open redirects.
46 // Matches //, /\ and both of these with whitespace in between (eg / / or / \).
49 // Matches //, /\ and both of these with whitespace in between (eg / / or / \).
47 invalidRedirectRegex = regexp.MustCompile(`[/\\](?:[\s\v]*|\.{1,2})[/\\]`)
50 invalidRedirectRegex = regexp.MustCompile(`[/\\](?:[\s\v]*|\.{1,2})[/\\]`)
@@ -969,6 +972,9 @@ func (p *OAuthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
969 p.SignInPage(rw, req, http.StatusForbidden)
972 p.SignInPage(rw, req, http.StatusForbidden)
970 }
973 }
971
974
975+ case ErrAccessDenied:
976+ p.ErrorPage(rw, http.StatusUnauthorized, "Permission Denied", "Unauthorized")
977+
972 default:
978 default:
973 // unknown error
979 // unknown error
974 logger.Errorf("Unexpected internal error: %v", err)
980 logger.Errorf("Unexpected internal error: %v", err)
@@ -979,7 +985,9 @@ func (p *OAuthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
979}
985}
980
986
981// getAuthenticatedSession checks whether a user is authenticated and returns a session object and nil error if so
987// getAuthenticatedSession checks whether a user is authenticated and returns a session object and nil error if so
988+// Returns:
982−// Returns nil, ErrNeedsLogin if user needs to login.
989+// - `nil, ErrNeedsLogin` if user needs to login.
990+// - `nil, ErrAccessDenied` if the authenticated user is not authorized
983// Set-Cookie headers may be set on the response as a side-effect of calling this method.
991// Set-Cookie headers may be set on the response as a side-effect of calling this method.
984func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.Request) (*sessionsapi.SessionState, error) {
992func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.Request) (*sessionsapi.SessionState, error) {
985 var session *sessionsapi.SessionState
993 var session *sessionsapi.SessionState
@@ -1000,13 +1008,13 @@ func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.R
1000 }
1008 }
1001
1009
1002 if invalidEmail || !authorized {
1010 if invalidEmail || !authorized {
1003− logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via session: removing session %s", session)
1011+ logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authorization via session: removing session %s", session)
1004 // Invalid session, clear it
1012 // Invalid session, clear it
1005 err := p.ClearSessionCookie(rw, req)
1013 err := p.ClearSessionCookie(rw, req)
1006 if err != nil {
1014 if err != nil {
1007 logger.Errorf("Error clearing session cookie: %v", err)
1015 logger.Errorf("Error clearing session cookie: %v", err)
1008 }
1016 }
1009− return nil, ErrNeedsLogin
1017+ return nil, ErrAccessDenied
1010 }
1018 }
1011
1019
1012 return session, nil
1020 return session, nil