git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #2803 from tuunit/bugfix/self-signed-certificate-handling

fix: self signed certificate handling in v7.7.0

commitd68336dcf4ec88ffd12398234511f923df298b7a authorJoel Speed <Joel.speed@hotmail.co.uk> dateMon 7 Oct 2024, 11:54 (2 years ago) parentcda64144bd920b
3 files changed+9−8
compare with master
unifiedsplit
CHANGELOG.md+2 pkg/requests/http.go+3−1 pkg/validation/options.go+4−7
CHANGELOG.md+2
@@ -8,6 +8,8 @@
88
99## Changes since v7.7.0
1010
11+- [#2803](https://github.com/oauth2-proxy/oauth2-proxy/pull/2803) fix: self signed certificate handling in v7.7.0 (@tuunit)
12+
1113# V7.7.0
1214
1315## Release Highlights
pkg/requests/http.go+3−1
@@ -18,10 +18,12 @@ func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error
1818}
1919
2020var DefaultHTTPClient = &http.Client{Transport: &userAgentTransport{
21− next: http.DefaultTransport,
21+ next: DefaultTransport,
2222 userAgent: "oauth2-proxy/" + version.VERSION,
2323}}
2424
25+var DefaultTransport = http.DefaultTransport
26+
2527func setDefaultUserAgent(header http.Header, userAgent string) {
2628 if header != nil && len(header.Values("User-Agent")) == 0 {
2729 header.Set("User-Agent", userAgent)
pkg/validation/options.go+4−7
@@ -13,6 +13,7 @@ import (
1313 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
1414 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
1515 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
16+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
1617 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
1718)
1819
@@ -30,20 +31,16 @@ func Validate(o *options.Options) error {
3031 msgs = parseSignatureKey(o, msgs)
3132
3233 if o.SSLInsecureSkipVerify {
33− insecureTransport := &http.Transport{
34− TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
35− }
36− http.DefaultClient = &http.Client{Transport: insecureTransport}
34+ transport := requests.DefaultTransport.(*http.Transport)
35+ transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
3736 } else if len(o.Providers[0].CAFiles) > 0 {
3837 pool, err := util.GetCertPool(o.Providers[0].CAFiles, o.Providers[0].UseSystemTrustStore)
3938 if err == nil {
40− transport := http.DefaultTransport.(*http.Transport).Clone()
39+ transport := requests.DefaultTransport.(*http.Transport)
4140 transport.TLSClientConfig = &tls.Config{
4241 RootCAs: pool,
4342 MinVersion: tls.VersionTLS12,
4443 }
45−
46− http.DefaultClient = &http.Client{Transport: transport}
4744 } else {
4845 msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err))
4946 }