c4f20ff · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Add exclude logging path option

Useful for excluding /ping endpoint to reduce log volume. This is somewhat more verbose than a simple bool to disable logging of the `/ping` endpoint. Perhaps better to add `-silence-ping-logging` bool flag to `options.go` and pass in the `/ping` endpoint as part of `logger` declaration in `options.go`. Could be extended into a slice of paths similar to go-gin's `SkipPaths`: https://github.com/gin-gonic/gin/blob/master/logger.go#L46

commitc4f20fff3d961f186a041c3f00aab7de40492608 authorKarl Skewes <karl.skewes@gmail.com> dateSun 2 Jun 2019, 14:36 (7 years ago) parentec97000

5 files changed+30−45

compare with master

unifiedsplit

docs/configuration/configuration.md+2−2 logging_handler_test.go+9−9 main.go+1−1 options.go+9−9 pkg/logger/logger.go+9−24

docs/configuration/configuration.md+2−2

@@ -42,6 +42,7 @@ Usage of oauth2_proxy:

4242 -display-htpasswd-form: display username / password login form if an htpasswd file is provided (default true)

4343 -email-domain value: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email

4444 -extra-jwt-issuers: if -skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)

45+ -exclude-logging-path: don't log requests to this path, eg: /ping (default "" = no paths excluded)

4546 -flush-interval: period between flushing response buffers when streaming responses (default "1s")

4647 -banner string: custom banner string. Use "-" to disable default banner.

4748 -footer string: custom footer string. Use "-" to disable default footer.

@@ -90,7 +91,6 @@ Usage of oauth2_proxy:

9091 -set-xauthrequest: set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)

9192 -set-authorization-header: set Authorization Bearer response header (useful in Nginx auth_request mode)

9293 -signature-key string: GAP-Signature request signature key (algorithm:secretkey)

93− -silence-ping-logging bool: disable logging of requests to ping endpoint (default false)

9494 -skip-auth-preflight: will skip authentication for OPTIONS requests

9595 -skip-auth-regex value: bypass authentication for requests path's that match (may be given multiple times)

9696 -skip-jwt-bearer-tokens: will skip requests that have verified JWT bearer tokens

@@ -140,7 +140,7 @@ There are three different types of logging: standard, authentication, and HTTP r

140140

141141Each type of logging has their own configurable format and variables. By default these formats are similar to the Apache Combined Log.

142142

143−Logging of requests to the `/ping` endpoint can be disabled with `-silence-ping-logging` reducing log volume.

143+A specific path can be excluded from request logs by setting `-exclude-logging-path`. This is useful for disabling logging of requests to the `/ping` endpoint to reduce log volume when health checking `oauth2_proxy`.

144144

145145### Auth Log Format

146146Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:

logging_handler_test.go+9−9

@@ -19,15 +19,15 @@ func TestLoggingHandler_ServeHTTP(t *testing.T) {

1919 Format,

2020 ExpectedLogMessage,

2121 Path string

22− SilentPing bool

22+ ExcludePath string

2323 }{

24− {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", false},

25− {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", true},

26− {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/ping\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/ping", false},

27− {"{{.RequestMethod}}", "GET\n", "/foo/bar", false},

28− {"{{.RequestMethod}}", "GET\n", "/foo/bar", true},

29− {"{{.RequestMethod}}", "GET\n", "/ping", false},

30− {"{{.RequestMethod}}", "", "/ping", true},

24+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", ""},

25+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", "/ping"},

26+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/ping\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/ping", ""},

27+ {"{{.RequestMethod}}", "GET\n", "/foo/bar", ""},

28+ {"{{.RequestMethod}}", "GET\n", "/foo/bar", "/ping"},

29+ {"{{.RequestMethod}}", "GET\n", "/ping", ""},

30+ {"{{.RequestMethod}}", "", "/ping", "/ping"},

3131 }

3232

3333 for _, test := range tests {

@@ -43,7 +43,7 @@ func TestLoggingHandler_ServeHTTP(t *testing.T) {

4343

4444 logger.SetOutput(buf)

4545 logger.SetReqTemplate(test.Format)

46− logger.SetSilentPing(test.SilentPing)

46+ logger.SetExcludePath(test.ExcludePath)

4747 h := LoggingHandler(http.HandlerFunc(handler))

4848

4949 r, _ := http.NewRequest("GET", test.Path, nil)

main.go+1−1

@@ -98,7 +98,7 @@ func main() {

9898

9999 flagSet.Bool("request-logging", true, "Log HTTP requests")

100100 flagSet.String("request-logging-format", logger.DefaultRequestLoggingFormat, "Template for HTTP request log lines")

101− flagSet.Bool("silence-ping-logging", false, "Disable logging of requests to ping endpoint")

101+ flagSet.String("exclude-logging-path", "", "Exclude logging requests to path (eg: /ping)")

102102

103103 flagSet.Bool("auth-logging", true, "Log authentication attempts")

104104 flagSet.String("auth-logging-format", logger.DefaultAuthLoggingFormat, "Template for authentication log lines")

options.go+9−9

@@ -105,15 +105,15 @@ type Options struct {

105105 RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format" env:"OAUTH2_PROXY_REQUEST_LOGGING_FORMAT"`

106106 PingPath string `flag:"ping-path" cfg:"ping_path" env:"OAUTH2_PROXY_PING_PATH"`

107107 SilencePingLogging bool `flag:"silence-ping-logging" cfg:"silence_ping_logging" env:"OAUTH2_PROXY_SILENCE_PING_LOGGING"`

108+ ExcludeLoggingPath string `flag:"exclude-logging-path" cfg:"exclude_logging_path" env:"OAUTH2_PROXY_EXCLUDE_LOGGING_PATH"`

108109 AuthLogging bool `flag:"auth-logging" cfg:"auth_logging" env:"OAUTH2_PROXY_LOGGING_AUTH_LOGGING"`

109110 AuthLoggingFormat string `flag:"auth-logging-format" cfg:"auth_logging_format" env:"OAUTH2_PROXY_AUTH_LOGGING_FORMAT"`

110−

111− SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`

112− AcrValues string `flag:"acr-values" cfg:"acr_values" env:"OAUTH2_PROXY_ACR_VALUES"`

113− JWTKey string `flag:"jwt-key" cfg:"jwt_key" env:"OAUTH2_PROXY_JWT_KEY"`

114− JWTKeyFile string `flag:"jwt-key-file" cfg:"jwt_key_file" env:"OAUTH2_PROXY_JWT_KEY_FILE"`

115− PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url" env:"OAUTH2_PROXY_PUBJWK_URL"`

116− GCPHealthChecks bool `flag:"gcp-healthchecks" cfg:"gcp_healthchecks" env:"OAUTH2_PROXY_GCP_HEALTHCHECKS"`

111+ SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`

112+ AcrValues string `flag:"acr-values" cfg:"acr_values" env:"OAUTH2_PROXY_ACR_VALUES"`

113+ JWTKey string `flag:"jwt-key" cfg:"jwt_key" env:"OAUTH2_PROXY_JWT_KEY"`

114+ JWTKeyFile string `flag:"jwt-key-file" cfg:"jwt_key_file" env:"OAUTH2_PROXY_JWT_KEY_FILE"`

115+ PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url" env:"OAUTH2_PROXY_PUBJWK_URL"`

116+ GCPHealthChecks bool `flag:"gcp-healthchecks" cfg:"gcp_healthchecks" env:"OAUTH2_PROXY_GCP_HEALTHCHECKS"`

117117

118118 // internal values that are set after config validation

119119 redirectURL *url.URL

@@ -167,6 +167,7 @@ func NewOptions() *Options {

167167 LoggingMaxBackups: 0,

168168 LoggingLocalTime: true,

169169 LoggingCompress: false,

170+ ExcludeLoggingPath: "",

170171 PingPath: "/ping",

171172 SilencePingLogging: false,

172173 StandardLogging: true,

@@ -571,8 +572,7 @@ func setupLogger(o *Options, msgs []string) []string {

571572 logger.SetStandardEnabled(o.StandardLogging)

572573 logger.SetAuthEnabled(o.AuthLogging)

573574 logger.SetReqEnabled(o.RequestLogging)

574− logger.SetSilentPing(o.SilencePingLogging)

575− logger.SetPingPath(o.PingPath)

575+ logger.SetExcludePath(o.ExcludeLoggingPath)

576576 logger.SetStandardTemplate(o.StandardLoggingFormat)

577577 logger.SetAuthTemplate(o.AuthLoggingFormat)

578578 logger.SetReqTemplate(o.RequestLoggingFormat)

pkg/logger/logger.go+9−24

@@ -88,8 +88,7 @@ type Logger struct {

8888 stdEnabled bool

8989 authEnabled bool

9090 reqEnabled bool

91− silentPing bool

92− pingPath string

91+ excludePath string

9392 stdLogTemplate *template.Template

9493 authTemplate *template.Template

9594 reqTemplate *template.Template

@@ -103,8 +102,7 @@ func New(flag int) *Logger {

103102 stdEnabled: true,

104103 authEnabled: true,

105104 reqEnabled: true,

106− silentPing: false,

107− pingPath: "/ping",

105+ excludePath: "",

108106 stdLogTemplate: template.Must(template.New("std-log").Parse(DefaultStandardLoggingFormat)),

109107 authTemplate: template.Must(template.New("auth-log").Parse(DefaultAuthLoggingFormat)),

110108 reqTemplate: template.Must(template.New("req-log").Parse(DefaultRequestLoggingFormat)),

@@ -181,7 +179,7 @@ func (l *Logger) PrintReq(username, upstream string, req *http.Request, url url.

181179 return

182180 }

183181

184− if url.Path == l.pingPath && l.silentPing {

182+ if url.Path == l.excludePath {

185183 return

186184 }

187185 duration := float64(time.Now().Sub(ts)) / float64(time.Second)

@@ -309,18 +307,11 @@ func (l *Logger) SetReqEnabled(e bool) {

309307 l.reqEnabled = e

310308}

311309

312−// SetPingPath sets the ping path.

313−func (l *Logger) SetPingPath(s string) {

310+// SetExcludePath sets the path to exclude from logging.

311+func (l *Logger) SetExcludePath(s string) {

314312 l.mu.Lock()

315313 defer l.mu.Unlock()

316− l.pingPath = s

317−}

318−

319−// SetSilentPing disables ping request logging.

320−func (l *Logger) SetSilentPing(e bool) {

321− l.mu.Lock()

322− defer l.mu.Unlock()

323− l.silentPing = e

314+ l.excludePath = s

324315}

325316

326317// SetStandardTemplate sets the template for standard logging.

@@ -386,15 +377,9 @@ func SetReqEnabled(e bool) {

386377 std.SetReqEnabled(e)

387378}

388379

389−// SetPingPath sets the healthcheck endpoint path.

390−// FIXME: Seems wrong to define this

391−func SetPingPath(s string) {

392− std.SetPingPath(s)

393−}

394−

395−// SetSilentPing disables request logging for the ping endpoint.

396−func SetSilentPing(e bool) {

397− std.SetSilentPing(e)

380+// SetExcludePath sets the path to exclude from logging, eg: health checks

381+func SetExcludePath(s string) {

382+ std.SetExcludePath(s)

398383}

399384

400385// SetStandardTemplate sets the template for standard logging for