f054682 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Make HTTPS Redirect middleware Reverse Proxy aware

commitf054682fb7a879d7fc285d4fdeeb243e6d92f9f0 authorNick Meves <nick.meves@greenhouse.io> dateSat 2 Jan 2021, 13:16 (6 years ago) parent6fb3274

2 files changed+38−6

compare with master

unifiedsplit

pkg/middleware/redirect_to_https.go+7−6 pkg/middleware/redirect_to_https_test.go+31

pkg/middleware/redirect_to_https.go+7−6

@@ -7,7 +7,7 @@ import (

77 "strings"

99 "github.com/justinas/alice"

10− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"

10+ requestutil "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests/util"

1111)

1212

1313const httpsScheme = "https"

@@ -26,10 +26,11 @@ func NewRedirectToHTTPS(httpsPort string) alice.Constructor {

2626// to the port from the httpsAddress given.

2727func redirectToHTTPS(httpsPort string, next http.Handler) http.Handler {

2828 return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {

29− proto := req.Header.Get("X-Forwarded-Proto")

30− if strings.EqualFold(proto, httpsScheme) || (req.TLS != nil && proto == "") {

31− // Only care about the connection to us being HTTPS if the proto is empty,

32− // otherwise the proto is source of truth

29+ proto := requestutil.GetRequestProto(req)

30+ if strings.EqualFold(proto, httpsScheme) || (req.TLS != nil && proto == req.URL.Scheme) {

31+ // Only care about the connection to us being HTTPS if the proto wasn't

32+ // from a trusted `X-Forwarded-Proto` (proto == req.URL.Scheme).

33+ // Otherwise the proto is source of truth

3334 next.ServeHTTP(rw, req)

3435 return

3536 }

@@ -41,7 +42,7 @@ func redirectToHTTPS(httpsPort string, next http.Handler) http.Handler {

4142

4243 // Set the Host in case the targetURL still does not have one

4344 // or it isn't X-Forwarded-Host aware

44− targetURL.Host = util.GetRequestHost(req)

45+ targetURL.Host = requestutil.GetRequestHost(req)

4546

4647 // Overwrite the port if the original request was to a non-standard port

4748 if targetURL.Port() != "" {

pkg/middleware/redirect_to_https_test.go+31

@@ -5,6 +5,7 @@ import (

55 "fmt"

66 "net/http/httptest"

8+ middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"

89 . "github.com/onsi/ginkgo"

910 . "github.com/onsi/ginkgo/extensions/table"

1011 . "github.com/onsi/gomega"

@@ -21,6 +22,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

2122 requestString string

2223 useTLS bool

2324 headers map[string]string

25+ reverseProxy bool

2426 expectedStatus int

2527 expectedBody string

2628 expectedLocation string

@@ -35,6 +37,10 @@ var _ = Describe("RedirectToHTTPS suite", func() {

3537 if in.useTLS {

3638 req.TLS = &tls.ConnectionState{}

3739 }

40+ scope := &middlewareapi.RequestScope{

41+ ReverseProxy: in.reverseProxy,

42+ }

43+ req = middlewareapi.AddRequestScope(req, scope)

3844

3945 rw := httptest.NewRecorder()

4046

@@ -52,6 +58,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

5258 requestString: "http://example.com",

5359 useTLS: false,

5460 headers: map[string]string{},

61+ reverseProxy: false,

5562 expectedStatus: 308,

5663 expectedBody: permanentRedirectBody("https://example.com"),

5764 expectedLocation: "https://example.com",

@@ -60,6 +67,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

6067 requestString: "https://example.com",

6168 useTLS: true,

6269 headers: map[string]string{},

70+ reverseProxy: false,

6371 expectedStatus: 200,

6472 expectedBody: "test",

6573 }),

@@ -69,15 +77,28 @@ var _ = Describe("RedirectToHTTPS suite", func() {

6977 headers: map[string]string{

7078 "X-Forwarded-Proto": "HTTPS",

7179 },

80+ reverseProxy: true,

7281 expectedStatus: 200,

7382 expectedBody: "test",

7483 }),

84+ Entry("without TLS and X-Forwarded-Proto=HTTPS but ReverseProxy not set", &requestTableInput{

85+ requestString: "http://example.com",

86+ useTLS: false,

87+ headers: map[string]string{

88+ "X-Forwarded-Proto": "HTTPS",

89+ },

90+ reverseProxy: false,

91+ expectedStatus: 308,

92+ expectedBody: permanentRedirectBody("https://example.com"),

93+ expectedLocation: "https://example.com",

94+ }),

7595 Entry("with TLS and X-Forwarded-Proto=HTTPS", &requestTableInput{

7696 requestString: "https://example.com",

7797 useTLS: true,

7898 headers: map[string]string{

7999 "X-Forwarded-Proto": "HTTPS",

80100 },

101+ reverseProxy: true,

81102 expectedStatus: 200,

82103 expectedBody: "test",

83104 }),

@@ -87,6 +108,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

87108 headers: map[string]string{

88109 "X-Forwarded-Proto": "https",

89110 },

111+ reverseProxy: true,

90112 expectedStatus: 200,

91113 expectedBody: "test",

92114 }),

@@ -96,6 +118,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

96118 headers: map[string]string{

97119 "X-Forwarded-Proto": "https",

98120 },

121+ reverseProxy: true,

99122 expectedStatus: 200,

100123 expectedBody: "test",

101124 }),

@@ -105,6 +128,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

105128 headers: map[string]string{

106129 "X-Forwarded-Proto": "HTTP",

107130 },

131+ reverseProxy: true,

108132 expectedStatus: 308,

109133 expectedBody: permanentRedirectBody("https://example.com"),

110134 expectedLocation: "https://example.com",

@@ -115,6 +139,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

115139 headers: map[string]string{

116140 "X-Forwarded-Proto": "HTTP",

117141 },

142+ reverseProxy: true,

118143 expectedStatus: 308,

119144 expectedBody: permanentRedirectBody("https://example.com"),

120145 expectedLocation: "https://example.com",

@@ -125,6 +150,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

125150 headers: map[string]string{

126151 "X-Forwarded-Proto": "http",

127152 },

153+ reverseProxy: true,

128154 expectedStatus: 308,

129155 expectedBody: permanentRedirectBody("https://example.com"),

130156 expectedLocation: "https://example.com",

@@ -135,6 +161,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

135161 headers: map[string]string{

136162 "X-Forwarded-Proto": "http",

137163 },

164+ reverseProxy: true,

138165 expectedStatus: 308,

139166 expectedBody: permanentRedirectBody("https://example.com"),

140167 expectedLocation: "https://example.com",

@@ -143,6 +170,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

143170 requestString: "http://example.com:8080",

144171 useTLS: false,

145172 headers: map[string]string{},

173+ reverseProxy: false,

146174 expectedStatus: 308,

147175 expectedBody: permanentRedirectBody("https://example.com:8443"),

148176 expectedLocation: "https://example.com:8443",

@@ -151,6 +179,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

151179 requestString: "https://example.com:8443",

152180 useTLS: true,

153181 headers: map[string]string{},

182+ reverseProxy: false,

154183 expectedStatus: 200,

155184 expectedBody: "test",

156185 }),

@@ -161,6 +190,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

161190 requestString: "/",

162191 useTLS: false,

163192 expectedStatus: 308,

193+ reverseProxy: false,

164194 expectedBody: permanentRedirectBody("https://example.com/"),

165195 expectedLocation: "https://example.com/",

166196 }),

@@ -171,6 +201,7 @@ var _ = Describe("RedirectToHTTPS suite", func() {

171201 "X-Forwarded-Proto": "HTTP",

172202 "X-Forwarded-Host": "external.example.com",

173203 },

204+ reverseProxy: true,

174205 expectedStatus: 308,

175206 expectedBody: permanentRedirectBody("https://external.example.com"),

176207 expectedLocation: "https://external.example.com",