git.iko.soy/typeable/oauth2-proxy
on master help sign in
fix: improve logging when session refresh token is missing (#3327)

* Improve logging for session refresh token status Signed-off-by: Yosri Barhoumi <med.yosri.brh@gmail.com> * doc: add changelog entry for #3327 Signed-off-by: Jan Larwig <jan@larwig.com> * test: fix existing test cases for new behaviour Signed-off-by: Jan Larwig <jan@larwig.com> --------- Signed-off-by: Yosri Barhoumi <med.yosri.brh@gmail.com> Signed-off-by: Jan Larwig <jan@larwig.com> Co-authored-by: Jan Larwig <jan@larwig.com>

commite2682f759539fe735b18fc655b677cb0a935637f authorYosri Barhoumi <44350807+yosri-brh@users.noreply.github.com> dateMon 23 Mar 2026, 10:54 (6 months ago) parent5ca3012
4 files changed+38−5
CHANGELOG.md+1 pkg/apis/sessions/session_state.go+2 pkg/apis/sessions/session_state_test.go+34−5 pkg/middleware/stored_session.go+1
CHANGELOG.md+1
@@ -16,6 +16,7 @@
1616- [#3382](https://github.com/oauth2-proxy/oauth2-proxy/pull/3382) chore(deps): update gomod and golangci/golangci-lint to v2.11.4 (@tuunit)
1717- [#3374](https://github.com/oauth2-proxy/oauth2-proxy/pull/3374) fix: handle Unix socket RemoteAddr in IP resolution (@H1net)
1818- [#3381](https://github.com/oauth2-proxy/oauth2-proxy/pull/3381) fix: do not log error for backend logout 204 (@artificiosus)
19+- [#3327](https://github.com/oauth2-proxy/oauth2-proxy/pull/3327) fix: improve logging when session refresh token is missing (@yosri-brh)
1920
2021
2122## Release Highlights
pkg/apis/sessions/session_state.go+2
@@ -127,6 +127,8 @@ func (s *SessionState) String() string {
127127 }
128128 if s.RefreshToken != "" {
129129 o += " refresh_token:true"
130+ } else {
131+ o += " refresh_token:false"
130132 }
131133 if len(s.Groups) > 0 {
132134 o += fmt.Sprintf(" groups:%v", s.Groups)
pkg/apis/sessions/session_state_test.go+34−5
@@ -4,6 +4,7 @@ import (
44 "crypto/rand"
55 "fmt"
66 "io"
7+ "strings"
78 "testing"
89 "time"
910
@@ -57,7 +58,7 @@ func TestString(t *testing.T) {
5758 User: "some.user",
5859 PreferredUsername: "preferred.user",
5960 },
60− expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user}",
61+ expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user refresh_token:false}",
6162 },
6263 {
6364 name: "Full Session",
@@ -81,7 +82,7 @@ func TestString(t *testing.T) {
8182 PreferredUsername: "preferred.user",
8283 CreatedAt: &created,
8384 },
84− expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user created:2000-01-01 00:00:00 +0000 UTC}",
85+ expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user created:2000-01-01 00:00:00 +0000 UTC refresh_token:false}",
8586 },
8687 {
8788 name: "With an ExpiresOn",
@@ -91,7 +92,7 @@ func TestString(t *testing.T) {
9192 PreferredUsername: "preferred.user",
9293 ExpiresOn: &expires,
9394 },
94− expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user expires:2000-01-01 01:00:00 +0000 UTC}",
95+ expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user expires:2000-01-01 01:00:00 +0000 UTC refresh_token:false}",
9596 },
9697 {
9798 name: "With an AccessToken",
@@ -101,7 +102,7 @@ func TestString(t *testing.T) {
101102 PreferredUsername: "preferred.user",
102103 AccessToken: "access.token",
103104 },
104− expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user token:true}",
105+ expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user token:true refresh_token:false}",
105106 },
106107 {
107108 name: "With an IDToken",
@@ -111,7 +112,7 @@ func TestString(t *testing.T) {
111112 PreferredUsername: "preferred.user",
112113 IDToken: "id.token",
113114 },
114− expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user id_token:true}",
115+ expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user id_token:true refresh_token:false}",
115116 },
116117 {
117118 name: "With a RefreshToken",
@@ -353,3 +354,31 @@ func TestGetClaim(t *testing.T) {
353354 })
354355 }
355356}
357+
358+func TestSessionState_String_RefreshTokenFalse(t *testing.T) {
359+ session := &SessionState{
360+ Email: "test@example.com",
361+ User: "testuser",
362+ // No RefreshToken set
363+ }
364+
365+ result := session.String()
366+
367+ if !strings.Contains(result, "refresh_token:false") {
368+ t.Errorf("Expected 'refresh_token:false' in output, got: %s", result)
369+ }
370+}
371+
372+func TestSessionState_String_RefreshTokenTrue(t *testing.T) {
373+ session := &SessionState{
374+ Email: "test@example.com",
375+ User: "testuser",
376+ RefreshToken: "some-token",
377+ }
378+
379+ result := session.String()
380+
381+ if !strings.Contains(result, "refresh_token:true") {
382+ t.Errorf("Expected 'refresh_token:true' in output, got: %s", result)
383+ }
384+}
pkg/middleware/stored_session.go+1
@@ -222,6 +222,7 @@ func (s *storedSessionLoader) refreshSession(rw http.ResponseWriter, req *http.R
222222
223223 // Session not refreshed, nothing to persist.
224224 if !refreshed {
225+ logger.Printf("Session not refreshed - User: %s; no refresh token available or provider returned false", session.User)
225226 return nil
226227 }
227228