ec97000 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Add silence ping logging flag

Add ability to silence logging of requests to /ping endpoint, reducing log clutter Pros: - Don't have to change all handlers to set/not set silent ping logging - Don't have to duplicate `loggingHandler` (this could be preferable yet) Cons: - Leaking oauth2proxy logic into `package logger` - Defining default pingPath in two locations Alternative: - Add generic exclude path to `logger.go` and pass in `/ping`.

commitec97000169e15de6d5870681498c71084c14f954 authorKarl Skewes <karl.skewes@gmail.com> dateFri 31 May 2019, 20:11 (7 years ago) parente952ab4

7 files changed+58−6

compare with master

unifiedsplit

CHANGELOG.md+1 docs/configuration/configuration.md+3 logging_handler.go+3−2 logging_handler_test.go+12−4 main.go+1 options.go+6 pkg/logger/logger.go+32

CHANGELOG.md+1

@@ -31,6 +31,7 @@

3131

3232## Changes since v3.2.0

3333

34+- [#178](https://github.com/pusher/outh2_proxy/pull/178) Add silence ping logging and exclude logging paths flags (@kskewes)

3435- [#209](https://github.com/pusher/outh2_proxy/pull/209) Improve docker build caching of layers (@dekimsey)

3536- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent (@JoelSpeed)

3637- [#187](https://github.com/pusher/oauth2_proxy/pull/187) Move root packages to pkg folder (@JoelSpeed)

docs/configuration/configuration.md+3

@@ -90,6 +90,7 @@ Usage of oauth2_proxy:

9090 -set-xauthrequest: set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)

9191 -set-authorization-header: set Authorization Bearer response header (useful in Nginx auth_request mode)

9292 -signature-key string: GAP-Signature request signature key (algorithm:secretkey)

93+ -silence-ping-logging bool: disable logging of requests to ping endpoint (default false)

9394 -skip-auth-preflight: will skip authentication for OPTIONS requests

9495 -skip-auth-regex value: bypass authentication for requests path's that match (may be given multiple times)

9596 -skip-jwt-bearer-tokens: will skip requests that have verified JWT bearer tokens

@@ -139,6 +140,8 @@ There are three different types of logging: standard, authentication, and HTTP r

139140

140141Each type of logging has their own configurable format and variables. By default these formats are similar to the Apache Combined Log.

141142

143+Logging of requests to the `/ping` endpoint can be disabled with `-silence-ping-logging` reducing log volume.

144+

142145### Auth Log Format

143146Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:

144147

logging_handler.go+3−2

@@ -75,18 +75,19 @@ func (l *responseLogger) Status() int {

7575 return l.status

7676}

7777

78−// Size returns teh response size

78+// Size returns the response size

7979func (l *responseLogger) Size() int {

8080 return l.size

8181}

8282

83+// Flush sends any buffered data to the client

8384func (l *responseLogger) Flush() {

8485 if flusher, ok := l.w.(http.Flusher); ok {

8586 flusher.Flush()

8687 }

8788}

8889

89−// loggingHandler is the http.Handler implementation for LoggingHandlerTo and its friends

90+// loggingHandler is the http.Handler implementation for LoggingHandler

9091type loggingHandler struct {

9192 handler http.Handler

9293}

logging_handler_test.go+12−4

@@ -17,10 +17,17 @@ func TestLoggingHandler_ServeHTTP(t *testing.T) {

1717

1818 tests := []struct {

1919 Format,

20− ExpectedLogMessage string

20+ ExpectedLogMessage,

21+ Path string

22+ SilentPing bool

2123 }{

22− {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts))},

23− {"{{.RequestMethod}}", "GET\n"},

24+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", false},

25+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/foo/bar\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/foo/bar", true},

26+ {logger.DefaultRequestLoggingFormat, fmt.Sprintf("127.0.0.1 - - [%s] test-server GET - \"/ping\" HTTP/1.1 \"\" 200 4 0.000\n", logger.FormatTimestamp(ts)), "/ping", false},

27+ {"{{.RequestMethod}}", "GET\n", "/foo/bar", false},

28+ {"{{.RequestMethod}}", "GET\n", "/foo/bar", true},

29+ {"{{.RequestMethod}}", "GET\n", "/ping", false},

30+ {"{{.RequestMethod}}", "", "/ping", true},

2431 }

2532

2633 for _, test := range tests {

@@ -36,9 +43,10 @@ func TestLoggingHandler_ServeHTTP(t *testing.T) {

3643

3744 logger.SetOutput(buf)

3845 logger.SetReqTemplate(test.Format)

46+ logger.SetSilentPing(test.SilentPing)

3947 h := LoggingHandler(http.HandlerFunc(handler))

4048

41− r, _ := http.NewRequest("GET", "/foo/bar", nil)

49+ r, _ := http.NewRequest("GET", test.Path, nil)

4250 r.RemoteAddr = "127.0.0.1"

4351 r.Host = "test-server"

4452

main.go+1

@@ -98,6 +98,7 @@ func main() {

9898

9999 flagSet.Bool("request-logging", true, "Log HTTP requests")

100100 flagSet.String("request-logging-format", logger.DefaultRequestLoggingFormat, "Template for HTTP request log lines")

101+ flagSet.Bool("silence-ping-logging", false, "Disable logging of requests to ping endpoint")

101102

102103 flagSet.Bool("auth-logging", true, "Log authentication attempts")

103104 flagSet.String("auth-logging-format", logger.DefaultAuthLoggingFormat, "Template for authentication log lines")

options.go+6

@@ -103,6 +103,8 @@ type Options struct {

103103 StandardLoggingFormat string `flag:"standard-logging-format" cfg:"standard_logging_format" env:"OAUTH2_PROXY_STANDARD_LOGGING_FORMAT"`

104104 RequestLogging bool `flag:"request-logging" cfg:"request_logging" env:"OAUTH2_PROXY_REQUEST_LOGGING"`

105105 RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format" env:"OAUTH2_PROXY_REQUEST_LOGGING_FORMAT"`

106+ PingPath string `flag:"ping-path" cfg:"ping_path" env:"OAUTH2_PROXY_PING_PATH"`

107+ SilencePingLogging bool `flag:"silence-ping-logging" cfg:"silence_ping_logging" env:"OAUTH2_PROXY_SILENCE_PING_LOGGING"`

106108 AuthLogging bool `flag:"auth-logging" cfg:"auth_logging" env:"OAUTH2_PROXY_LOGGING_AUTH_LOGGING"`

107109 AuthLoggingFormat string `flag:"auth-logging-format" cfg:"auth_logging_format" env:"OAUTH2_PROXY_AUTH_LOGGING_FORMAT"`

108110

@@ -165,6 +167,8 @@ func NewOptions() *Options {

165167 LoggingMaxBackups: 0,

166168 LoggingLocalTime: true,

167169 LoggingCompress: false,

170+ PingPath: "/ping",

171+ SilencePingLogging: false,

168172 StandardLogging: true,

169173 StandardLoggingFormat: logger.DefaultStandardLoggingFormat,

170174 RequestLogging: true,

@@ -567,6 +571,8 @@ func setupLogger(o *Options, msgs []string) []string {

567571 logger.SetStandardEnabled(o.StandardLogging)

568572 logger.SetAuthEnabled(o.AuthLogging)

569573 logger.SetReqEnabled(o.RequestLogging)

574+ logger.SetSilentPing(o.SilencePingLogging)

575+ logger.SetPingPath(o.PingPath)

570576 logger.SetStandardTemplate(o.StandardLoggingFormat)

571577 logger.SetAuthTemplate(o.AuthLoggingFormat)

572578 logger.SetReqTemplate(o.RequestLoggingFormat)

pkg/logger/logger.go+32

@@ -88,6 +88,8 @@ type Logger struct {

8888 stdEnabled bool

8989 authEnabled bool

9090 reqEnabled bool

91+ silentPing bool

92+ pingPath string

9193 stdLogTemplate *template.Template

9294 authTemplate *template.Template

9395 reqTemplate *template.Template

@@ -101,6 +103,8 @@ func New(flag int) *Logger {

101103 stdEnabled: true,

102104 authEnabled: true,

103105 reqEnabled: true,

106+ silentPing: false,

107+ pingPath: "/ping",

104108 stdLogTemplate: template.Must(template.New("std-log").Parse(DefaultStandardLoggingFormat)),

105109 authTemplate: template.Must(template.New("auth-log").Parse(DefaultAuthLoggingFormat)),

106110 reqTemplate: template.Must(template.New("req-log").Parse(DefaultRequestLoggingFormat)),

@@ -177,6 +181,9 @@ func (l *Logger) PrintReq(username, upstream string, req *http.Request, url url.

177181 return

178182 }

179183

184+ if url.Path == l.pingPath && l.silentPing {

185+ return

186+ }

180187 duration := float64(time.Now().Sub(ts)) / float64(time.Second)

181188

182189 if username == "" {

@@ -302,6 +309,20 @@ func (l *Logger) SetReqEnabled(e bool) {

302309 l.reqEnabled = e

303310}

304311

312+// SetPingPath sets the ping path.

313+func (l *Logger) SetPingPath(s string) {

314+ l.mu.Lock()

315+ defer l.mu.Unlock()

316+ l.pingPath = s

317+}

318+

319+// SetSilentPing disables ping request logging.

320+func (l *Logger) SetSilentPing(e bool) {

321+ l.mu.Lock()

322+ defer l.mu.Unlock()

323+ l.silentPing = e

324+}

325+

305326// SetStandardTemplate sets the template for standard logging.

306327func (l *Logger) SetStandardTemplate(t string) {

307328 l.mu.Lock()

@@ -365,6 +386,17 @@ func SetReqEnabled(e bool) {

365386 std.SetReqEnabled(e)

366387}

367388

389+// SetPingPath sets the healthcheck endpoint path.

390+// FIXME: Seems wrong to define this

391+func SetPingPath(s string) {

392+ std.SetPingPath(s)

393+}

394+

395+// SetSilentPing disables request logging for the ping endpoint.

396+func SetSilentPing(e bool) {

397+ std.SetSilentPing(e)

398+}

399+

368400// SetStandardTemplate sets the template for standard logging for

369401// the standard logger.

370402func SetStandardTemplate(t string) {