git.iko.soy/typeable/oauth2-proxy
on master help sign in
docs: fix insecure Caddy configuration example (#2827)

The original example only protected the root (`/`) path, leaving other routes unsecured. * docs: add syntax highlighting for nginx config * docs: fix headings in `configuration/integration` page * docs: fix redirect in caddy configuraion example

commitef8ba75987c8f4f441d8044a5853922929d3bd83 authorciffelia <15273128+ciffelia@users.noreply.github.com> dateMon 11 Nov 2024, 18:04 (2 years ago) parent5042203
4 files changed+103−67
compare with master
unifiedsplit
docs/docs/configuration/integration.md+34−22 docs/docusaurus.config.js+1−1 docs/versioned_docs/version-7.6.x/configuration/integration.md+34−22 docs/versioned_docs/version-7.7.x/configuration/integration.md+34−22
docs/docs/configuration/integration.md+34−22
@@ -102,7 +102,7 @@ You have to substitute *name* with the actual cookie name you configured via --c
102102
103103**This option requires `--reverse-proxy` option to be set.**
104104
105−## ForwardAuth with 401 errors middleware
105+### ForwardAuth with 401 errors middleware
106106
107107The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
108108
@@ -167,7 +167,7 @@ http:
167167 query: "/oauth2/sign_in?rd={url}"
168168```
169169
170−## ForwardAuth with static upstreams configuration
170+### ForwardAuth with static upstreams configuration
171171
172172Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
173173
@@ -265,7 +265,7 @@ http:
265265 - Authorization
266266```
267267
268−## Configuring for use with the caddy v2 `forward_auth` directive
268+## Configuring for use with the Caddy (v2) `forward_auth` directive
269269
270270The [Caddy `forward_auth` directive](https://caddyserver.com/docs/caddyfile/directives/forward_auth) allows Caddy to authenticate requests via the `oauth2-proxy`'s `/auth`.
271271
@@ -274,29 +274,41 @@ This example is for a simple reverse proxy setup where the `/oauth2/` path is ke
274274**Following options need to be set on `oauth2-proxy`:**
275275- `--reverse-proxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
276276
277−```nginx
278−{{ domain }} {
279− # define forward auth for any path under `/`, if not more specific defined
280− forward_auth / {{ oauth.internalIP }}:4180 {
281− uri /oauth2/auth
282− copy_headers Authorization X-Auth-Request-User X-Auth-Request-Email
283−
284− @error status 401
285− handle_response @error {
286− redir * /oauth2/sign_in?rd={scheme}://{host}{uri} 302
277+```nginx title="Caddyfile"
278+example.com {
279+ # Requests to /oauth2/* are proxied to oauth2-proxy without authentication.
280+ # You can't use `reverse_proxy /oauth2/* oauth2-proxy.internal:4180` here because the reverse_proxy directive has lower precedence than the handle directive.
281+ handle /oauth2/* {
282+ reverse_proxy oauth2-proxy.internal:4180 {
283+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
284+ # The reverse_proxy directive automatically sets X-Forwarded-{For,Proto,Host} headers.
285+ header_up X-Real-IP {remote_host}
286+ header_up X-Forwarded-Uri {uri}
287287 }
288288 }
289289
290− # define `/oauth2/*` as specific endpoint, to avoid forward auth protection to be able to use service
291− reverse_proxy /oauth2/* {{ oauth.internalIP }}:4180 {
292− header_up X-Real-IP {remote}
293− header_up X-Forwarded-Proto https
294− }
290+ # Requests to other paths are first processed by oauth2-proxy for authentication.
291+ handle {
292+ forward_auth oauth2-proxy.internal:4180 {
293+ uri /oauth2/auth
294+
295+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
296+ # The forward_auth directive automatically sets the X-Forwarded-{For,Proto,Host,Method,Uri} headers.
297+ header_up X-Real-IP {remote_host}
298+
299+ # If needed, you can copy headers from the oauth2-proxy response to the request sent to the upstream.
300+ # Make sure to configure the --set-xauthrequest flag to enable this feature.
301+ #copy_headers X-Auth-Request-User X-Auth-Request-Email
302+
303+ # If oauth2-proxy returns a 401 status, redirect the client to the sign-in page.
304+ @error status 401
305+ handle_response @error {
306+ redir * /oauth2/sign_in?rd={scheme}://{host}{uri}
307+ }
308+ }
295309
296− # unspecific reverse proxy will be protected from `forward_auth /`
297− reverse_proxy {{ endpointIP }} {
298− header_up X-Real-IP {remote}
299− header_up X-Forwarded-Proto https
310+ # If oauth2-proxy returns a 2xx status, the request is then proxied to the upstream.
311+ reverse_proxy upstream.internal:3000
300312 }
301313}
302314```
docs/docusaurus.config.js+1−1
@@ -123,7 +123,7 @@ const config = {
123123 prism: {
124124 theme: prismThemes.github,
125125 darkTheme: prismThemes.dracula,
126− additionalLanguages: ['hcl', 'powershell'],
126+ additionalLanguages: ['hcl', 'nginx', 'powershell'],
127127 },
128128 }),
129129};
docs/versioned_docs/version-7.6.x/configuration/integration.md+34−22
@@ -102,7 +102,7 @@ You have to substitute *name* with the actual cookie name you configured via --c
102102
103103**This option requires `--reverse-proxy` option to be set.**
104104
105−## ForwardAuth with 401 errors middleware
105+### ForwardAuth with 401 errors middleware
106106
107107The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
108108
@@ -167,7 +167,7 @@ http:
167167 query: "/oauth2/sign_in?rd={url}"
168168```
169169
170−## ForwardAuth with static upstreams configuration
170+### ForwardAuth with static upstreams configuration
171171
172172Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
173173
@@ -265,7 +265,7 @@ http:
265265 - Authorization
266266```
267267
268−## Configuring for use with the caddy v2 `forward_auth` directive
268+## Configuring for use with the Caddy (v2) `forward_auth` directive
269269
270270The [Caddy `forward_auth` directive](https://caddyserver.com/docs/caddyfile/directives/forward_auth) allows Caddy to authenticate requests via the `oauth2-proxy`'s `/auth`.
271271
@@ -274,29 +274,41 @@ This example is for a simple reverse proxy setup where the `/oauth2/` path is ke
274274**Following options need to be set on `oauth2-proxy`:**
275275- `--reverse-proxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
276276
277−```nginx
278−{{ domain }} {
279− # define forward auth for any path under `/`, if not more specific defined
280− forward_auth / {{ oauth.internalIP }}:4180 {
281− uri /oauth2/auth
282− copy_headers Authorization X-Auth-Request-User X-Auth-Request-Email
283−
284− @error status 401
285− handle_response @error {
286− redir * /oauth2/sign_in?rd={scheme}://{host}{uri} 302
277+```nginx title="Caddyfile"
278+example.com {
279+ # Requests to /oauth2/* are proxied to oauth2-proxy without authentication.
280+ # You can't use `reverse_proxy /oauth2/* oauth2-proxy.internal:4180` here because the reverse_proxy directive has lower precedence than the handle directive.
281+ handle /oauth2/* {
282+ reverse_proxy oauth2-proxy.internal:4180 {
283+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
284+ # The reverse_proxy directive automatically sets X-Forwarded-{For,Proto,Host} headers.
285+ header_up X-Real-IP {remote_host}
286+ header_up X-Forwarded-Uri {uri}
287287 }
288288 }
289289
290− # define `/oauth2/*` as specific endpoint, to avoid forward auth protection to be able to use service
291− reverse_proxy /oauth2/* {{ oauth.internalIP }}:4180 {
292− header_up X-Real-IP {remote}
293− header_up X-Forwarded-Proto https
294− }
290+ # Requests to other paths are first processed by oauth2-proxy for authentication.
291+ handle {
292+ forward_auth oauth2-proxy.internal:4180 {
293+ uri /oauth2/auth
294+
295+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
296+ # The forward_auth directive automatically sets the X-Forwarded-{For,Proto,Host,Method,Uri} headers.
297+ header_up X-Real-IP {remote_host}
298+
299+ # If needed, you can copy headers from the oauth2-proxy response to the request sent to the upstream.
300+ # Make sure to configure the --set-xauthrequest flag to enable this feature.
301+ #copy_headers X-Auth-Request-User X-Auth-Request-Email
302+
303+ # If oauth2-proxy returns a 401 status, redirect the client to the sign-in page.
304+ @error status 401
305+ handle_response @error {
306+ redir * /oauth2/sign_in?rd={scheme}://{host}{uri}
307+ }
308+ }
295309
296− # unspecific reverse proxy will be protected from `forward_auth /`
297− reverse_proxy {{ endpointIP }} {
298− header_up X-Real-IP {remote}
299− header_up X-Forwarded-Proto https
310+ # If oauth2-proxy returns a 2xx status, the request is then proxied to the upstream.
311+ reverse_proxy upstream.internal:3000
300312 }
301313}
302314```
docs/versioned_docs/version-7.7.x/configuration/integration.md+34−22
@@ -102,7 +102,7 @@ You have to substitute *name* with the actual cookie name you configured via --c
102102
103103**This option requires `--reverse-proxy` option to be set.**
104104
105−## ForwardAuth with 401 errors middleware
105+### ForwardAuth with 401 errors middleware
106106
107107The [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) allows Traefik to authenticate requests via the oauth2-proxy's `/oauth2/auth` endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:
108108
@@ -167,7 +167,7 @@ http:
167167 query: "/oauth2/sign_in?rd={url}"
168168```
169169
170−## ForwardAuth with static upstreams configuration
170+### ForwardAuth with static upstreams configuration
171171
172172Redirect to sign_in functionality provided without the use of `errors` middleware with [Traefik v2 `ForwardAuth` middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/) pointing to oauth2-proxy service's `/` endpoint
173173
@@ -265,7 +265,7 @@ http:
265265 - Authorization
266266```
267267
268−## Configuring for use with the caddy v2 `forward_auth` directive
268+## Configuring for use with the Caddy (v2) `forward_auth` directive
269269
270270The [Caddy `forward_auth` directive](https://caddyserver.com/docs/caddyfile/directives/forward_auth) allows Caddy to authenticate requests via the `oauth2-proxy`'s `/auth`.
271271
@@ -274,29 +274,41 @@ This example is for a simple reverse proxy setup where the `/oauth2/` path is ke
274274**Following options need to be set on `oauth2-proxy`:**
275275- `--reverse-proxy=true`: Enables the use of `X-Forwarded-*` headers to determine redirects correctly
276276
277−```nginx
278−{{ domain }} {
279− # define forward auth for any path under `/`, if not more specific defined
280− forward_auth / {{ oauth.internalIP }}:4180 {
281− uri /oauth2/auth
282− copy_headers Authorization X-Auth-Request-User X-Auth-Request-Email
283−
284− @error status 401
285− handle_response @error {
286− redir * /oauth2/sign_in?rd={scheme}://{host}{uri} 302
277+```nginx title="Caddyfile"
278+example.com {
279+ # Requests to /oauth2/* are proxied to oauth2-proxy without authentication.
280+ # You can't use `reverse_proxy /oauth2/* oauth2-proxy.internal:4180` here because the reverse_proxy directive has lower precedence than the handle directive.
281+ handle /oauth2/* {
282+ reverse_proxy oauth2-proxy.internal:4180 {
283+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
284+ # The reverse_proxy directive automatically sets X-Forwarded-{For,Proto,Host} headers.
285+ header_up X-Real-IP {remote_host}
286+ header_up X-Forwarded-Uri {uri}
287287 }
288288 }
289289
290− # define `/oauth2/*` as specific endpoint, to avoid forward auth protection to be able to use service
291− reverse_proxy /oauth2/* {{ oauth.internalIP }}:4180 {
292− header_up X-Real-IP {remote}
293− header_up X-Forwarded-Proto https
294− }
290+ # Requests to other paths are first processed by oauth2-proxy for authentication.
291+ handle {
292+ forward_auth oauth2-proxy.internal:4180 {
293+ uri /oauth2/auth
294+
295+ # oauth2-proxy requires the X-Real-IP and X-Forwarded-{Proto,Host,Uri} headers.
296+ # The forward_auth directive automatically sets the X-Forwarded-{For,Proto,Host,Method,Uri} headers.
297+ header_up X-Real-IP {remote_host}
298+
299+ # If needed, you can copy headers from the oauth2-proxy response to the request sent to the upstream.
300+ # Make sure to configure the --set-xauthrequest flag to enable this feature.
301+ #copy_headers X-Auth-Request-User X-Auth-Request-Email
302+
303+ # If oauth2-proxy returns a 401 status, redirect the client to the sign-in page.
304+ @error status 401
305+ handle_response @error {
306+ redir * /oauth2/sign_in?rd={scheme}://{host}{uri}
307+ }
308+ }
295309
296− # unspecific reverse proxy will be protected from `forward_auth /`
297− reverse_proxy {{ endpointIP }} {
298− header_up X-Real-IP {remote}
299− header_up X-Forwarded-Proto https
310+ # If oauth2-proxy returns a 2xx status, the request is then proxied to the upstream.
311+ reverse_proxy upstream.internal:3000
300312 }
301313}
302314```