f31e02c · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

fix: jwt regex validation error during skip-jwt-bearer-tokens flow (#2888)

--------- Co-authored-by: Jan Larwig <jan@larwig.com>

commitf31e02cebd6cbe3e22c0f6839c6714f58f39a7ab authorstomekpe <stomekpe@gmail.com> dateWed 15 Jan 2025, 09:06 (2 years ago) parentfafb47e

3 files changed+9−1

compare with master

unifiedsplit

CHANGELOG.md+2 pkg/middleware/jwt_session.go+1−1 pkg/middleware/jwt_session_test.go+6

CHANGELOG.md+2

@@ -8,6 +8,8 @@

99## Changes since v7.8.0

1010

11+- [#2887](https://github.com/oauth2-proxy/oauth2-proxy/issues/2887) fix: jwt regex validation error during skip-jwt-bearer-tokens flow

12+

1113# V7.8.0

1214

1315## Release Highlights

pkg/middleware/jwt_session.go+1−1

@@ -13,7 +13,7 @@ import (

1313 k8serrors "k8s.io/apimachinery/pkg/util/errors"

1414)

1515

16−const jwtRegexFormat = `^ey[IJ][a-zA-Z0-9_-]*\.ey[IJ][a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+$`

16+const jwtRegexFormat = `^ey[a-zA-Z0-9_-]*\.ey[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+$`

1717

1818func NewJwtSessionLoader(sessionLoaders []middlewareapi.TokenToSessionFunc) alice.Constructor {

1919 js := &jwtSessionLoader{

pkg/middleware/jwt_session_test.go+6

@@ -71,6 +71,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`

7171 // validToken will pass the token regex so can be used to check token fetching

7272 // is valid. It will not pass the OIDC Verifier however.

7373 const validToken = "eyJfoobar.eyJfoobar.12345asdf"

74+ const validTokenWithSpace = "eyAidHlwIjogIkpXVCIsICJraWQiOiAiRTJlWW5ZMWR1eGttTkpiVGdCRzd4MkVpNVJZPSIsICJhbGciOiAiUlMyNTYiIH0K.eyJfoobar.12345asdf"

7475

7576 Context("JwtSessionLoader", func() {

7677 var verifier middlewareapi.VerifyFunc

@@ -294,6 +295,11 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`

294295 expectedErr: nil,

295296 expectedToken: validToken,

296297 }),

298+ Entry("Bearer <valid-token-with-whitespace>", findBearerTokenFromHeaderTableInput{

299+ header: fmt.Sprintf("Bearer %s", validTokenWithSpace),

300+ expectedErr: nil,

301+ expectedToken: validTokenWithSpace,

302+ }),

297303 Entry("Basic invalid-base64", findBearerTokenFromHeaderTableInput{

298304 header: "Basic invalid-base64",

299305 expectedErr: errors.New("invalid basic auth token: illegal base64 data at input byte 7"),