e2682f7 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

fix: improve logging when session refresh token is missing (#3327)

e2682f7Yosri Barhoumi6 months ago

CHANGELOG.md+1

@@ -16,6 +16,7 @@

16- [#3382](https://github.com/oauth2-proxy/oauth2-proxy/pull/3382) chore(deps): update gomod and golangci/golangci-lint to v2.11.4 (@tuunit)

17- [#3374](https://github.com/oauth2-proxy/oauth2-proxy/pull/3374) fix: handle Unix socket RemoteAddr in IP resolution (@H1net)

18- [#3381](https://github.com/oauth2-proxy/oauth2-proxy/pull/3381) fix: do not log error for backend logout 204 (@artificiosus)

19+- [#3327](https://github.com/oauth2-proxy/oauth2-proxy/pull/3327) fix: improve logging when session refresh token is missing (@yosri-brh)

21## Release Highlights

22## Release Highlights

pkg/apis/sessions/session_state.go+2

@@ -127,6 +127,8 @@ func (s *SessionState) String() string {

127 }

128 if s.RefreshToken != "" {

129 o += " refresh_token:true"

130+ } else {

131+ o += " refresh_token:false"

130 }

132 }

131 if len(s.Groups) > 0 {

133 if len(s.Groups) > 0 {

132 o += fmt.Sprintf(" groups:%v", s.Groups)

134 o += fmt.Sprintf(" groups:%v", s.Groups)

pkg/apis/sessions/session_state_test.go+34−5

@@ -4,6 +4,7 @@ import (

4 "crypto/rand"

5 "fmt"

6 "io"

7+ "strings"

7 "testing"

8 "testing"

8 "time"

9 "time"

@@ -57,7 +58,7 @@ func TestString(t *testing.T) {

57 User: "some.user",

58 User: "some.user",

58 PreferredUsername: "preferred.user",

59 PreferredUsername: "preferred.user",

59 },

60 },

60− expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user}",

61+ expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user refresh_token:false}",

61 },

62 },

62 {

63 {

63 name: "Full Session",

64 name: "Full Session",

@@ -81,7 +82,7 @@ func TestString(t *testing.T) {

81 PreferredUsername: "preferred.user",

82 PreferredUsername: "preferred.user",

82 CreatedAt: &created,

83 CreatedAt: &created,

83 },

84 },

84− expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user created:2000-01-01 00:00:00 +0000 UTC}",

85+ expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user created:2000-01-01 00:00:00 +0000 UTC refresh_token:false}",

85 },

86 },

86 {

87 {

87 name: "With an ExpiresOn",

88 name: "With an ExpiresOn",

@@ -91,7 +92,7 @@ func TestString(t *testing.T) {

91 PreferredUsername: "preferred.user",

92 PreferredUsername: "preferred.user",

92 ExpiresOn: &expires,

93 ExpiresOn: &expires,

93 },

94 },

94− expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user expires:2000-01-01 01:00:00 +0000 UTC}",

95+ expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user expires:2000-01-01 01:00:00 +0000 UTC refresh_token:false}",

95 },

96 },

96 {

97 {

97 name: "With an AccessToken",

98 name: "With an AccessToken",

@@ -101,7 +102,7 @@ func TestString(t *testing.T) {

101 PreferredUsername: "preferred.user",

102 PreferredUsername: "preferred.user",

102 AccessToken: "access.token",

103 AccessToken: "access.token",

103 },

104 },

104− expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user token:true}",

105+ expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user token:true refresh_token:false}",

105 },

106 },

106 {

107 {

107 name: "With an IDToken",

108 name: "With an IDToken",

@@ -111,7 +112,7 @@ func TestString(t *testing.T) {

111 PreferredUsername: "preferred.user",

112 PreferredUsername: "preferred.user",

112 IDToken: "id.token",

113 IDToken: "id.token",

113 },

114 },

114− expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user id_token:true}",

115+ expected: "Session{email:email@email.email user:some.user PreferredUsername:preferred.user id_token:true refresh_token:false}",

115 },

116 },

116 {

117 {

117 name: "With a RefreshToken",

118 name: "With a RefreshToken",

@@ -353,3 +354,31 @@ func TestGetClaim(t *testing.T) {

353 })

354 })

354 }

355 }

355}

356}

357+

358+func TestSessionState_String_RefreshTokenFalse(t *testing.T) {

359+ session := &SessionState{

360+ Email: "test@example.com",

361+ User: "testuser",

362+ // No RefreshToken set

363+ }

364+

365+ result := session.String()

366+

367+ if !strings.Contains(result, "refresh_token:false") {

368+ t.Errorf("Expected 'refresh_token:false' in output, got: %s", result)

369+ }

370+}

371+

372+func TestSessionState_String_RefreshTokenTrue(t *testing.T) {

373+ session := &SessionState{

374+ Email: "test@example.com",

375+ User: "testuser",

376+ RefreshToken: "some-token",

377+ }

378+

379+ result := session.String()

380+

381+ if !strings.Contains(result, "refresh_token:true") {

382+ t.Errorf("Expected 'refresh_token:true' in output, got: %s", result)

383+ }

384+}

pkg/middleware/stored_session.go+1

@@ -222,6 +222,7 @@ func (s *storedSessionLoader) refreshSession(rw http.ResponseWriter, req *http.R

222

223 // Session not refreshed, nothing to persist.

224 if !refreshed {

225+ logger.Printf("Session not refreshed - User: %s; no refresh token available or provider returned false", session.User)

225 return nil

226 return nil

226 }

227 }

227

228