f31e02c · typeable/oauth2-proxy

CHANGELOG.md+2

compare with master

unifiedsplit

@@ -8,6 +8,8 @@

8

9## Changes since v7.8.0

10

11+- [#2887](https://github.com/oauth2-proxy/oauth2-proxy/issues/2887) fix: jwt regex validation error during skip-jwt-bearer-tokens flow

12+

11# V7.8.0

13# V7.8.0

12

14

13## Release Highlights

15## Release Highlights

pkg/middleware/jwt_session.go+1−1

@@ -13,7 +13,7 @@ import (

13 k8serrors "k8s.io/apimachinery/pkg/util/errors"

14)

15

16−const jwtRegexFormat = `^ey[IJ][a-zA-Z0-9_-]*\.ey[IJ][a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+$`

16+const jwtRegexFormat = `^ey[a-zA-Z0-9_-]*\.ey[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+$`

17

18func NewJwtSessionLoader(sessionLoaders []middlewareapi.TokenToSessionFunc) alice.Constructor {

19 js := &jwtSessionLoader{

pkg/middleware/jwt_session_test.go+6

@@ -71,6 +71,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`

71 // validToken will pass the token regex so can be used to check token fetching

72 // is valid. It will not pass the OIDC Verifier however.

73 const validToken = "eyJfoobar.eyJfoobar.12345asdf"

74+ const validTokenWithSpace = "eyAidHlwIjogIkpXVCIsICJraWQiOiAiRTJlWW5ZMWR1eGttTkpiVGdCRzd4MkVpNVJZPSIsICJhbGciOiAiUlMyNTYiIH0K.eyJfoobar.12345asdf"

74

75

75 Context("JwtSessionLoader", func() {

76 Context("JwtSessionLoader", func() {

76 var verifier middlewareapi.VerifyFunc

77 var verifier middlewareapi.VerifyFunc

@@ -294,6 +295,11 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`

294 expectedErr: nil,

295 expectedErr: nil,

295 expectedToken: validToken,

296 expectedToken: validToken,

296 }),

297 }),

298+ Entry("Bearer <valid-token-with-whitespace>", findBearerTokenFromHeaderTableInput{

299+ header: fmt.Sprintf("Bearer %s", validTokenWithSpace),

300+ expectedErr: nil,

301+ expectedToken: validTokenWithSpace,

302+ }),

297 Entry("Basic invalid-base64", findBearerTokenFromHeaderTableInput{

303 Entry("Basic invalid-base64", findBearerTokenFromHeaderTableInput{

298 header: "Basic invalid-base64",

304 header: "Basic invalid-base64",

299 expectedErr: errors.New("invalid basic auth token: illegal base64 data at input byte 7"),

305 expectedErr: errors.New("invalid basic auth token: illegal base64 data at input byte 7"),