git.iko.soy/typeable/oauth2-proxy
on master help sign in
better handling of default transport modification
bae168ftuunit
pkg/requests/http.go+7−7
compare with master
unifiedsplit
@@ -7,22 +7,22 @@ import (
7)
7)
8
8
9type userAgentTransport struct {
9type userAgentTransport struct {
10− Next http.RoundTripper
10+ next http.RoundTripper
11 userAgent string
11 userAgent string
12}
12}
13
13
14func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
14func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
15 r := req.Clone(req.Context())
15 r := req.Clone(req.Context())
16 setDefaultUserAgent(r.Header, t.userAgent)
16 setDefaultUserAgent(r.Header, t.userAgent)
17− return t.Next.RoundTrip(r)
17+ return t.next.RoundTrip(r)
18}
18}
19
19
20−var DefaultHTTPClient = &http.Client{Transport: &DefaultTransport}
20+var DefaultHTTPClient = &http.Client{Transport: &userAgentTransport{
21−
22−var DefaultTransport = userAgentTransport{
23− Next: http.DefaultTransport,
21+ next: DefaultTransport,
24 userAgent: "oauth2-proxy/" + version.VERSION,
22 userAgent: "oauth2-proxy/" + version.VERSION,
25−}
23+}}
24+
25+var DefaultTransport = http.DefaultTransport
26
26
27func setDefaultUserAgent(header http.Header, userAgent string) {
27func setDefaultUserAgent(header http.Header, userAgent string) {
28 if header != nil && len(header.Values("User-Agent")) == 0 {
28 if header != nil && len(header.Values("User-Agent")) == 0 {
pkg/validation/options.go+2−6
@@ -31,20 +31,16 @@ func Validate(o *options.Options) error {
31 msgs = parseSignatureKey(o, msgs)
31 msgs = parseSignatureKey(o, msgs)
32
32
33 if o.SSLInsecureSkipVerify {
33 if o.SSLInsecureSkipVerify {
34− transport := requests.DefaultTransport.Next.(*http.Transport).Clone()
34+ transport := requests.DefaultTransport.(*http.Transport)
35 transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
35 transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
36−
37− requests.DefaultHTTPClient = &http.Client{Transport: transport}
38 } else if len(o.Providers[0].CAFiles) > 0 {
36 } else if len(o.Providers[0].CAFiles) > 0 {
39 pool, err := util.GetCertPool(o.Providers[0].CAFiles, o.Providers[0].UseSystemTrustStore)
37 pool, err := util.GetCertPool(o.Providers[0].CAFiles, o.Providers[0].UseSystemTrustStore)
40 if err == nil {
38 if err == nil {
41− transport := requests.DefaultTransport.Next.(*http.Transport).Clone()
39+ transport := requests.DefaultTransport.(*http.Transport)
42 transport.TLSClientConfig = &tls.Config{
40 transport.TLSClientConfig = &tls.Config{
43 RootCAs: pool,
41 RootCAs: pool,
44 MinVersion: tls.VersionTLS12,
42 MinVersion: tls.VersionTLS12,
45 }
43 }
46−
47− requests.DefaultHTTPClient = &http.Client{Transport: transport}
48 } else {
44 } else {
49 msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err))
45 msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err))
50 }
46 }