@@ -5,7 +5,6 @@ import (
55 "encoding/json"
66 "errors"
77 "fmt"
8− "html/template"
98 "net"
109 "net/http"
1110 "net/url"
@@ -76,39 +75,34 @@ type OAuthProxy struct {
7675 AuthOnlyPath string
7776 UserInfoPath string
7877
79− allowedRoutes []allowedRoute
80− redirectURL *url.URL // the url to receive requests at
81− whitelistDomains []string
82− provider providers.Provider
83− providerNameOverride string
84− sessionStore sessionsapi.SessionStore
85− ProxyPrefix string
86− SignInMessage string
87− basicAuthValidator basic.Validator
88− displayHtpasswdForm bool
89− serveMux http.Handler
90− SetXAuthRequest bool
91− PassBasicAuth bool
92− SetBasicAuth bool
93− SkipProviderButton bool
94− PassUserHeaders bool
95− BasicAuthPassword string
96− PassAccessToken bool
97− SetAuthorization bool
98− PassAuthorization bool
99− PreferEmailToUser bool
100− skipAuthPreflight bool
101− skipJwtBearerTokens bool
102− templates *template.Template
103− realClientIPParser ipapi.RealClientIPParser
104− trustedIPs *ip.NetSet
105− Banner string
106− Footer string
78+ allowedRoutes []allowedRoute
79+ redirectURL *url.URL // the url to receive requests at
80+ whitelistDomains []string
81+ provider providers.Provider
82+ sessionStore sessionsapi.SessionStore
83+ ProxyPrefix string
84+ basicAuthValidator basic.Validator
85+ serveMux http.Handler
86+ SetXAuthRequest bool
87+ PassBasicAuth bool
88+ SetBasicAuth bool
89+ SkipProviderButton bool
90+ PassUserHeaders bool
91+ BasicAuthPassword string
92+ PassAccessToken bool
93+ SetAuthorization bool
94+ PassAuthorization bool
95+ PreferEmailToUser bool
96+ skipAuthPreflight bool
97+ skipJwtBearerTokens bool
98+ realClientIPParser ipapi.RealClientIPParser
99+ trustedIPs *ip.NetSet
107100
108101 sessionChain alice.Chain
109102 headersChain alice.Chain
110103 preAuthChain alice.Chain
111104 errorPage *app.ErrorPage
105+ signInPage *app.SignInPage
112106}
113107
114108// NewOAuthProxy creates a new instance of OAuthProxy from the options provided
@@ -174,6 +168,17 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr
174168 }
175169 }
176170
171+ signInPage := &app.SignInPage{
172+ Template: templates.Lookup("sign_in.html"),
173+ ErrorPage: errorPage,
174+ ProxyPrefix: opts.ProxyPrefix,
175+ ProviderName: buildProviderName(opts.GetProvider(), opts.ProviderName),
176+ SignInMessage: buildSignInMessage(opts),
177+ Footer: opts.Templates.Footer,
178+ Version: VERSION,
179+ DisplayLoginForm: basicAuthValidator != nil && opts.Templates.DisplayLoginForm,
180+ }
181+
177182 allowedRoutes, err := buildRoutesAllowlist(opts)
178183 if err != nil {
179184 return nil, err
@@ -210,30 +215,25 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr
210215 AuthOnlyPath: fmt.Sprintf("%s/auth", opts.ProxyPrefix),
211216 UserInfoPath: fmt.Sprintf("%s/userinfo", opts.ProxyPrefix),
212217
213− ProxyPrefix: opts.ProxyPrefix,
214− provider: opts.GetProvider(),
215− providerNameOverride: opts.ProviderName,
216− sessionStore: sessionStore,
217− serveMux: upstreamProxy,
218− redirectURL: redirectURL,
219− allowedRoutes: allowedRoutes,
220− whitelistDomains: opts.WhitelistDomains,
221− skipAuthPreflight: opts.SkipAuthPreflight,
222− skipJwtBearerTokens: opts.SkipJwtBearerTokens,
223− realClientIPParser: opts.GetRealClientIPParser(),
224− SkipProviderButton: opts.SkipProviderButton,
225− templates: templates,
226− trustedIPs: trustedIPs,
227− Banner: opts.Templates.Banner,
228− Footer: opts.Templates.Footer,
229− SignInMessage: buildSignInMessage(opts),
230−
231− basicAuthValidator: basicAuthValidator,
232− displayHtpasswdForm: basicAuthValidator != nil && opts.Templates.DisplayLoginForm,
233− sessionChain: sessionChain,
234− headersChain: headersChain,
235− preAuthChain: preAuthChain,
236− errorPage: errorPage,
218+ ProxyPrefix: opts.ProxyPrefix,
219+ provider: opts.GetProvider(),
220+ sessionStore: sessionStore,
221+ serveMux: upstreamProxy,
222+ redirectURL: redirectURL,
223+ allowedRoutes: allowedRoutes,
224+ whitelistDomains: opts.WhitelistDomains,
225+ skipAuthPreflight: opts.SkipAuthPreflight,
226+ skipJwtBearerTokens: opts.SkipJwtBearerTokens,
227+ realClientIPParser: opts.GetRealClientIPParser(),
228+ SkipProviderButton: opts.SkipProviderButton,
229+ trustedIPs: trustedIPs,
230+
231+ basicAuthValidator: basicAuthValidator,
232+ sessionChain: sessionChain,
233+ headersChain: headersChain,
234+ preAuthChain: preAuthChain,
235+ errorPage: errorPage,
236+ signInPage: signInPage,
237237 }, nil
238238}
239239
@@ -331,6 +331,13 @@ func buildSignInMessage(opts *options.Options) string {
331331 return msg
332332}
333333
334+func buildProviderName(p providers.Provider, override string) string {
335+ if override != "" {
336+ return override
337+ }
338+ return p.Data().ProviderName
339+}
340+
334341// buildRoutesAllowlist builds an []allowedRoute list from either the legacy
335342// SkipAuthRegex option (paths only support) or newer SkipAuthRoutes option
336343// (method=path support)
@@ -594,33 +601,7 @@ func (p *OAuthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code
594601 redirectURL = "/"
595602 }
596603
597− // We allow unescaped template.HTML since it is user configured options
598− /* #nosec G203 */
599− t := struct {
600− ProviderName string
601− SignInMessage template.HTML
602− CustomLogin bool
603− Redirect string
604− Version string
605− ProxyPrefix string
606− Footer template.HTML
607− }{
608− ProviderName: p.provider.Data().ProviderName,
609− SignInMessage: template.HTML(p.SignInMessage),
610− CustomLogin: p.displayHtpasswdForm,
611− Redirect: redirectURL,
612− Version: VERSION,
613− ProxyPrefix: p.ProxyPrefix,
614− Footer: template.HTML(p.Footer),
615− }
616− if p.providerNameOverride != "" {
617− t.ProviderName = p.providerNameOverride
618− }
619− err = p.templates.ExecuteTemplate(rw, "sign_in.html", t)
620− if err != nil {
621− logger.Printf("Error rendering sign_in.html template: %v", err)
622− p.ErrorPage(rw, req, http.StatusInternalServerError, err.Error())
623− }
604+ p.signInPage.Render(rw, redirectURL)
624605}
625606
626607// ManualSignIn handles basic auth logins to the proxy