git.iko.soy/typeable/oauth2-proxy
on master help sign in
Made setting of proxied headers deterministic based on configuration

alone Previously some headers that are normally set by the proxy (and may be replied upstream for authorization decisiions) were not being set depending on values in the users sesssion. This change ensure that if a given header is sometimes set, it will always be either set or removed. It might be worth considerating always deleting these headers if we didn't add them.

commitd5d4878a2934355f944eaf131d9fd8d12aba69b9 authorAdam Eijdenberg <adam@continusec.com> dateThu 20 Jun 2019, 14:17 (7 years ago) parentc4559ea
2 files changed+37−8
compare with master
unifiedsplit
CHANGELOG.md+1 oauthproxy.go+36−8
CHANGELOG.md+1
@@ -39,6 +39,7 @@
3939- [#234](https://github.com/pusher/oauth2_proxy/pull/234) Added option `-ssl-upstream-insecure-skip-validation` to skip validation of upstream SSL certificates (@jansinger)
4040- [#224](https://github.com/pusher/oauth2_proxy/pull/224) Check Google group membership using hasMember to support nested groups and external users (@jpalpant)
4141- [#231](https://github.com/pusher/oauth2_proxy/pull/231) Add optional group membership and email domain checks to the GitLab provider (@Overv)
42+- [#226](https://github.com/pusher/oauth2_proxy/pull/226) Made setting of proxied headers deterministic based on configuration alone (@aeijdenberg)
4243- [#178](https://github.com/pusher/oauth2_proxy/pull/178) Add Silence Ping Logging and Exclude Logging Paths flags (@kskewes)
4344- [#209](https://github.com/pusher/oauth2_proxy/pull/209) Improve docker build caching of layers (@dekimsey)
4445- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent (@JoelSpeed)
oauthproxy.go+36−8
@@ -820,32 +820,60 @@ func (p *OAuthProxy) addHeadersForProxying(rw http.ResponseWriter, req *http.Req
820820 req.Header["X-Forwarded-User"] = []string{session.User}
821821 if session.Email != "" {
822822 req.Header["X-Forwarded-Email"] = []string{session.Email}
823+ } else {
824+ req.Header.Del("X-Forwarded-Email")
823825 }
824826 }
827+
825828 if p.PassUserHeaders {
826829 req.Header["X-Forwarded-User"] = []string{session.User}
827830 if session.Email != "" {
828831 req.Header["X-Forwarded-Email"] = []string{session.Email}
832+ } else {
833+ req.Header.Del("X-Forwarded-Email")
829834 }
830835 }
836+
831837 if p.SetXAuthRequest {
832838 rw.Header().Set("X-Auth-Request-User", session.User)
833839 if session.Email != "" {
834840 rw.Header().Set("X-Auth-Request-Email", session.Email)
841+ } else {
842+ rw.Header().Del("X-Auth-Request-Email")
835843 }
836− if p.PassAccessToken && session.AccessToken != "" {
837− rw.Header().Set("X-Auth-Request-Access-Token", session.AccessToken)
844+
845+ if p.PassAccessToken {
846+ if session.AccessToken != "" {
847+ rw.Header().Set("X-Auth-Request-Access-Token", session.AccessToken)
848+ } else {
849+ rw.Header().Del("X-Auth-Request-Access-Token")
850+ }
838851 }
839852 }
840− if p.PassAccessToken && session.AccessToken != "" {
841− req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}
853+
854+ if p.PassAccessToken {
855+ if session.AccessToken != "" {
856+ req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}
857+ } else {
858+ req.Header.Del("X-Forwarded-Access-Token")
859+ }
842860 }
843− if p.PassAuthorization && session.IDToken != "" {
844− req.Header["Authorization"] = []string{fmt.Sprintf("Bearer %s", session.IDToken)}
861+
862+ if p.PassAuthorization {
863+ if session.IDToken != "" {
864+ req.Header["Authorization"] = []string{fmt.Sprintf("Bearer %s", session.IDToken)}
865+ } else {
866+ req.Header.Del("Authorization")
867+ }
845868 }
846− if p.SetAuthorization && session.IDToken != "" {
847− rw.Header().Set("Authorization", fmt.Sprintf("Bearer %s", session.IDToken))
869+ if p.SetAuthorization {
870+ if session.IDToken != "" {
871+ rw.Header().Set("Authorization", fmt.Sprintf("Bearer %s", session.IDToken))
872+ } else {
873+ rw.Header().Del("Authorization")
874+ }
848875 }
876+
849877 if session.Email == "" {
850878 rw.Header().Set("GAP-Auth", session.User)
851879 } else {