d5d4878 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Made setting of proxied headers deterministic based on configuration

d5d4878Adam Eijdenberg7 years ago

CHANGELOG.md+1

@@ -39,6 +39,7 @@

39- [#234](https://github.com/pusher/oauth2_proxy/pull/234) Added option `-ssl-upstream-insecure-skip-validation` to skip validation of upstream SSL certificates (@jansinger)

40- [#224](https://github.com/pusher/oauth2_proxy/pull/224) Check Google group membership using hasMember to support nested groups and external users (@jpalpant)

41- [#231](https://github.com/pusher/oauth2_proxy/pull/231) Add optional group membership and email domain checks to the GitLab provider (@Overv)

42+- [#226](https://github.com/pusher/oauth2_proxy/pull/226) Made setting of proxied headers deterministic based on configuration alone (@aeijdenberg)

42- [#178](https://github.com/pusher/oauth2_proxy/pull/178) Add Silence Ping Logging and Exclude Logging Paths flags (@kskewes)

43- [#178](https://github.com/pusher/oauth2_proxy/pull/178) Add Silence Ping Logging and Exclude Logging Paths flags (@kskewes)

43- [#209](https://github.com/pusher/oauth2_proxy/pull/209) Improve docker build caching of layers (@dekimsey)

44- [#209](https://github.com/pusher/oauth2_proxy/pull/209) Improve docker build caching of layers (@dekimsey)

44- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent (@JoelSpeed)

45- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent (@JoelSpeed)

oauthproxy.go+36−8

@@ -820,32 +820,60 @@ func (p *OAuthProxy) addHeadersForProxying(rw http.ResponseWriter, req *http.Req

820 req.Header["X-Forwarded-User"] = []string{session.User}

821 if session.Email != "" {

822 req.Header["X-Forwarded-Email"] = []string{session.Email}

823+ } else {

824+ req.Header.Del("X-Forwarded-Email")

823 }

825 }

824 }

826 }

827+

825 if p.PassUserHeaders {

828 if p.PassUserHeaders {

826 req.Header["X-Forwarded-User"] = []string{session.User}

829 req.Header["X-Forwarded-User"] = []string{session.User}

827 if session.Email != "" {

830 if session.Email != "" {

828 req.Header["X-Forwarded-Email"] = []string{session.Email}

831 req.Header["X-Forwarded-Email"] = []string{session.Email}

832+ } else {

833+ req.Header.Del("X-Forwarded-Email")

829 }

834 }

830 }

835 }

836+

831 if p.SetXAuthRequest {

837 if p.SetXAuthRequest {

832 rw.Header().Set("X-Auth-Request-User", session.User)

838 rw.Header().Set("X-Auth-Request-User", session.User)

833 if session.Email != "" {

839 if session.Email != "" {

834 rw.Header().Set("X-Auth-Request-Email", session.Email)

840 rw.Header().Set("X-Auth-Request-Email", session.Email)

841+ } else {

842+ rw.Header().Del("X-Auth-Request-Email")

835 }

843 }

844+

836− if p.PassAccessToken && session.AccessToken != "" {

845+ if p.PassAccessToken {

846+ if session.AccessToken != "" {

837− rw.Header().Set("X-Auth-Request-Access-Token", session.AccessToken)

847+ rw.Header().Set("X-Auth-Request-Access-Token", session.AccessToken)

848+ } else {

849+ rw.Header().Del("X-Auth-Request-Access-Token")

850+ }

838 }

851 }

839 }

852 }

853+

840− if p.PassAccessToken && session.AccessToken != "" {

854+ if p.PassAccessToken {

855+ if session.AccessToken != "" {

841− req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}

856+ req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}

857+ } else {

858+ req.Header.Del("X-Forwarded-Access-Token")

859+ }

842 }

860 }

861+

843− if p.PassAuthorization && session.IDToken != "" {

862+ if p.PassAuthorization {

863+ if session.IDToken != "" {

844− req.Header["Authorization"] = []string{fmt.Sprintf("Bearer %s", session.IDToken)}

864+ req.Header["Authorization"] = []string{fmt.Sprintf("Bearer %s", session.IDToken)}

865+ } else {

866+ req.Header.Del("Authorization")

867+ }

845 }

868 }

846− if p.SetAuthorization && session.IDToken != "" {

869+ if p.SetAuthorization {

870+ if session.IDToken != "" {

847− rw.Header().Set("Authorization", fmt.Sprintf("Bearer %s", session.IDToken))

871+ rw.Header().Set("Authorization", fmt.Sprintf("Bearer %s", session.IDToken))

872+ } else {

873+ rw.Header().Del("Authorization")

874+ }

848 }

875 }

876+

849 if session.Email == "" {

877 if session.Email == "" {

850 rw.Header().Set("GAP-Auth", session.User)

878 rw.Header().Set("GAP-Auth", session.User)

851 } else {

879 } else {