git.iko.soy/typeable/oauth2-proxy
on master help sign in
Refactor pass_access_token+cookie_secret check

Moves the check from NewOauthProxy() to Options.Validate() and adds a test.

commitcf79fd9e4c3ced4f4d201e101be6885b875908d4 authorMike Bland <michael.bland@gsa.gov> dateSun 5 Apr 2015, 09:43 (12 years ago) parentca32394
3 files changed+38−17
compare with master
unifiedsplit
oauthproxy.go+2−17 options.go+17 options_test.go+19
oauthproxy.go+2−17
@@ -47,7 +47,6 @@ type OauthProxy struct {
4747 DisplayHtpasswdForm bool
4848 serveMux http.Handler
4949 PassBasicAuth bool
50− PassAccessToken bool
5150 AesCipher cipher.Block
5251 skipAuthRegex []string
5352 compiledRegex []*regexp.Regexp
@@ -121,20 +120,7 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
121120 log.Printf("Cookie settings: secure (https):%v httponly:%v expiry:%s domain:%s", opts.CookieSecure, opts.CookieHttpOnly, opts.CookieExpire, domain)
122121
123122 var aes_cipher cipher.Block
124−
125− if opts.PassAccessToken == true {
126− valid_cookie_secret_size := false
127− for _, i := range []int{16, 24, 32} {
128− if len(opts.CookieSecret) == i {
129− valid_cookie_secret_size = true
130− }
131− }
132− if valid_cookie_secret_size == false {
133− log.Fatal("cookie_secret must be 16, 24, or 32 bytes " +
134− "to create an AES cipher when " +
135− "pass_access_token == true")
136− }
137−
123+ if opts.PassAccessToken {
138124 var err error
139125 aes_cipher, err = aes.NewCipher([]byte(opts.CookieSecret))
140126 if err != nil {
@@ -163,7 +149,6 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
163149 skipAuthRegex: opts.SkipAuthRegex,
164150 compiledRegex: opts.CompiledRegex,
165151 PassBasicAuth: opts.PassBasicAuth,
166− PassAccessToken: opts.PassAccessToken,
167152 AesCipher: aes_cipher,
168153 templates: loadTemplates(opts.CustomTemplatesDir),
169154 }
@@ -441,7 +426,7 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
441426 if p.Validator(email) {
442427 log.Printf("%s authenticating %s completed", remoteAddr, email)
443428 encoded_token := ""
444− if p.PassAccessToken {
429+ if p.AesCipher != nil {
445430 encoded_token, err = encodeAccessToken(p.AesCipher, access_token)
446431 if err != nil {
447432 log.Printf("error encoding access token: %s", err)
options.go+17
@@ -117,6 +117,23 @@ func (o *Options) Validate() error {
117117 }
118118 msgs = parseProviderInfo(o, msgs)
119119
120+ if o.PassAccessToken {
121+ valid_cookie_secret_size := false
122+ for _, i := range []int{16, 24, 32} {
123+ if len(o.CookieSecret) == i {
124+ valid_cookie_secret_size = true
125+ }
126+ }
127+ if valid_cookie_secret_size == false {
128+ msgs = append(msgs, fmt.Sprintf(
129+ "cookie_secret must be 16, 24, or 32 bytes "+
130+ "to create an AES cipher when "+
131+ "pass_access_token == true, "+
132+ "but is %d bytes",
133+ len(o.CookieSecret)))
134+ }
135+ }
136+
120137 if len(msgs) != 0 {
121138 return fmt.Errorf("Invalid configuration:\n %s",
122139 strings.Join(msgs, "\n "))
options_test.go+19
@@ -102,3 +102,22 @@ func TestDefaultProviderApiSettings(t *testing.T) {
102102 assert.Equal(t, "", p.ProfileUrl.String())
103103 assert.Equal(t, "profile email", p.Scope)
104104}
105+
106+func TestPassAccessTokenRequiresSpecificCookieSecretLengths(t *testing.T) {
107+ o := testOptions()
108+ assert.Equal(t, nil, o.Validate())
109+
110+ assert.Equal(t, false, o.PassAccessToken)
111+ o.PassAccessToken = true
112+ o.CookieSecret = "cookie of invalid length-"
113+ assert.NotEqual(t, nil, o.Validate())
114+
115+ o.CookieSecret = "16 bytes AES-128"
116+ assert.Equal(t, nil, o.Validate())
117+
118+ o.CookieSecret = "24 byte secret AES-192--"
119+ assert.Equal(t, nil, o.Validate())
120+
121+ o.CookieSecret = "32 byte secret for AES-256------"
122+ assert.Equal(t, nil, o.Validate())
123+}