git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge commit from fork

Signed-off-by: Jan Larwig <jan@larwig.com>

commitf3f30fa976fb4bb97d6345ba4735cb6d86e24f95 authorJan Larwig <jan@larwig.com> dateSat 8 Nov 2025, 12:52 (1 year ago) parent5993067
4 files changed+40−1
compare with master
unifiedsplit
docs/docs/configuration/alpha_config.md+1 pkg/apis/options/header.go+10 pkg/middleware/headers.go+5 pkg/middleware/headers_test.go+24−1
docs/docs/configuration/alpha_config.md+1
@@ -266,6 +266,7 @@ response header.
266266| ----- | ---- | ----------- |
267267| `name` | _string_ | Name is the header name to be used for this set of values.<br/>Names should be unique within a list of Headers. |
268268| `preserveRequestValue` | _bool_ | PreserveRequestValue determines whether any values for this header<br/>should be preserved for the request to the upstream server.<br/>This option only applies to injected request headers.<br/>Defaults to false (headers that match this header will be stripped). |
269+| `InsecureSkipHeaderNormalization` | _bool_ | InsecureSkipHeaderNormalization disables normalizing the header name<br/>According to RFC 7230 Section 3.2 there aren't any rules about<br/>capitalization of header names, but the standard practice is to use<br/>Title-Case (e.g. X-Forwarded-For). By default, header names will be<br/>normalized to Title-Case and any incoming headers that match will be<br/>treated as the same header. Additionally underscores (_) in header names<br/>will be converted to dashes (-) when normalizing.<br/>Defaults to false (header names will be normalized). |
269270| `values` | _[[]HeaderValue](#headervalue)_ | Values contains the desired values for this header |
270271
271272### HeaderValue
pkg/apis/options/header.go+10
@@ -13,6 +13,16 @@ type Header struct {
1313 // Defaults to false (headers that match this header will be stripped).
1414 PreserveRequestValue bool `json:"preserveRequestValue,omitempty"`
1515
16+ // InsecureSkipHeaderNormalization disables normalizing the header name
17+ // According to RFC 7230 Section 3.2 there aren't any rules about
18+ // capitalization of header names, but the standard practice is to use
19+ // Title-Case (e.g. X-Forwarded-For). By default, header names will be
20+ // normalized to Title-Case and any incoming headers that match will be
21+ // treated as the same header. Additionally underscores (_) in header names
22+ // will be converted to dashes (-) when normalizing.
23+ // Defaults to false (header names will be normalized).
24+ InsecureSkipHeaderNormalization bool `json:"InsecureSkipHeaderNormalization,omitempty"`
25+
1626 // Values contains the desired values for this header
1727 Values []HeaderValue `json:"values,omitempty"`
1828}
pkg/middleware/headers.go+5
@@ -53,6 +53,11 @@ func flattenHeaders(headers http.Header) {
5353func stripHeaders(headers []options.Header, next http.Handler) http.Handler {
5454 return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
5555 for _, header := range headers {
56+ if header.InsecureSkipHeaderNormalization {
57+ req.Header.Del(header.Name)
58+ continue
59+ }
60+
5661 stripNormalizedHeader(req, header)
5762 }
5863 next.ServeHTTP(rw, req)
pkg/middleware/headers_test.go+24−1
@@ -205,7 +205,7 @@ var _ = Describe("Headers Suite", func() {
205205 expectedHeaders: nil,
206206 expectedErr: "error building request header injector: error building request injector: error building injector for header \"X-Auth-Request-Authorization\": error loading basicAuthPassword: secret source is invalid: exactly one entry required, specify either value, fromEnv or fromFile",
207207 }),
208− Entry("strips normalized variants before injecting (no preservation)", headersTableInput{
208+ Entry("strips normalized variants before injecting", headersTableInput{
209209 headers: []options.Header{
210210 {
211211 Name: "X-Auth-Request-User",
@@ -226,6 +226,29 @@ var _ = Describe("Headers Suite", func() {
226226 },
227227 expectedErr: "",
228228 }),
229+ Entry("doesn't strip normalized variants before injecting", headersTableInput{
230+ headers: []options.Header{
231+ {
232+ Name: "X-Auth-Request-User",
233+ InsecureSkipHeaderNormalization: true,
234+ Values: []options.HeaderValue{
235+ {
236+ ClaimSource: &options.ClaimSource{Claim: "user"},
237+ },
238+ },
239+ },
240+ },
241+ initialHeaders: http.Header{
242+ "X-Auth-Request-User": []string{"old"},
243+ "X-Auth_Request_User": []string{"evil"},
244+ },
245+ session: &sessionsapi.SessionState{User: "user-123"},
246+ expectedHeaders: http.Header{
247+ "X-Auth-Request-User": []string{"user-123"},
248+ "X-Auth_Request_User": []string{"evil"},
249+ },
250+ expectedErr: "",
251+ }),
229252 )
230253
231254 DescribeTable("the response header injector",