git.iko.soy/typeable/oauth2-proxy
on master help sign in
always set httponly (there is no good reason not to); simplify httponly and expire flags
commitbc26835076df2602eae41483c01b1422e23b32e5 authorJehiah Czebotar <jehiah@gmail.com> dateSat 8 Nov 2014, 13:26 (12 years ago) parent6cdf05e
3 files changed+13−22
compare with master
unifiedsplit
README.md+7−4 main.go+3−2 oauthproxy.go+3−16
README.md+7−4
@@ -50,8 +50,10 @@ Usage of ./google_auth_proxy:
5050 -client-id="": the Google OAuth Client ID: ie: "123456.apps.googleusercontent.com"
5151 -client-secret="": the OAuth Client Secret
5252 -cookie-domain="": an optional cookie domain to force cookies to
53+ -cookie-expire=168h: expire timeframe for cookie
54+ -cookie-https-only=false: set HTTPS only cookie
5355 -cookie-secret="": the seed string for secure cookies
54− -google-apps-domain="": authenticate against the given google apps domain
56+ -google-apps-domain=[]: authenticate against the given google apps domain (may be given multiple times)
5557 -htpasswd-file="": additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
5658 -http-address="127.0.0.1:4180": <addr>:<port> to listen on for HTTP clients
5759 -pass-basic-auth=true: pass HTTP Basic Auth information to upstream
@@ -98,6 +100,7 @@ The command line to run `google_auth_proxy` would look like this:
98100 --google-apps-domain="yourcompany.com" \
99101 --upstream=http://127.0.0.1:8080/ \
100102 --cookie-secret=... \
103+ --cookie-secure=true \
101104 --client-id=... \
102105 --client-secret=...
103106```
@@ -108,9 +111,9 @@ The environment variables `google_auth_client_id`, `google_auth_secret` and `goo
108111
109112## Endpoint Documentation
110113
111−Google auth proxy responds directly to the following endpoints. All other endpoints will be authenticated.
114+Google Auth Proxy responds directly to the following endpoints. All other endpoints will be authenticated.
112115
113116* /ping - returns an 200 OK response
114117* /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
115−* /oauth2/start - a URL that will redirect to start the oauth cycle
116−* /oauth2/callback - the URL used at the end of the oauth cycle
118+* /oauth2/start - a URL that will redirect to start the OAuth cycle
119+* /oauth2/callback - the URL used at the end of the OAuth cycle
main.go+3−2
@@ -9,6 +9,7 @@ import (
99 "net/url"
1010 "os"
1111 "strings"
12+ "time"
1213)
1314
1415const VERSION = "0.1.0"
@@ -23,8 +24,8 @@ var (
2324 htpasswdFile = flag.String("htpasswd-file", "", "additionally authenticate against a htpasswd file. Entries must be created with \"htpasswd -s\" for SHA encryption")
2425 cookieSecret = flag.String("cookie-secret", "", "the seed string for secure cookies")
2526 cookieDomain = flag.String("cookie-domain", "", "an optional cookie domain to force cookies to")
26− cookieExpire = flag.Int("cookie-expire", 168 * 60, "expire time for cookie")
27− cookieSecure = flag.Bool("cookie-secure", false, "HTTPS only cookie")
27+ cookieExpire = flag.Duration("cookie-expire", time.Duration(168)*time.Hour, "expire timeframe for cookie")
28+ cookieHttpsOnly = flag.Bool("cookie-https-only", false, "set HTTPS only cookie")
2829 authenticatedEmailsFile = flag.String("authenticated-emails-file", "", "authenticate against emails via file (one per line)")
2930 googleAppsDomains = StringArray{}
3031 upstreams = StringArray{}
oauthproxy.go+3−16
@@ -184,27 +184,14 @@ func (p *OauthProxy) SetCookie(rw http.ResponseWriter, req *http.Request, val st
184184 if *cookieDomain != "" && strings.HasSuffix(domain, *cookieDomain) {
185185 domain = *cookieDomain
186186 }
187− need_expire := true
188− expire := time.Now().Add(time.Duration(*cookieExpire))
189− if *cookieExpire == 0 {
190− need_expire = false
191− }
192− http_only := true
193− secure := false
194− if *cookieSecure {
195− http_only = false
196− secure = true
197− }
198187 cookie := &http.Cookie{
199188 Name: p.CookieKey,
200189 Value: signedCookieValue(p.CookieSeed, p.CookieKey, val),
201190 Path: "/",
202191 Domain: domain,
203− HttpOnly: http_only,
204− Secure: secure,
205− }
206− if need_expire {
207− cookie.Expires = expire
192+ HttpOnly: true,
193+ Secure: *cookieHttpsOnly,
194+ Expires: time.Now().Add(*cookieExpire),
208195 }
209196 http.SetCookie(rw, cookie)
210197}