git.iko.soy/typeable/oauth2-proxy
on master help sign in
Fixes deletion of splitted cookies - Issue #69 (#70)

* fixes deletion of splitted cookies * three minor adjustments to improve the tests * changed cookie name matching to regex * Update oauthproxy.go Co-Authored-By: einfachchr <einfachchr@gmail.com> * removed unused variable * Changelog

commitf715c9371b1b61cc3d62c94f87da78a15b69a7ad authoreinfachchr <einfachchr@gmail.com> dateFri 15 Mar 2019, 08:18 (8 years ago) parentcfd1fd8
3 files changed+57−3
CHANGELOG.md+1 oauthproxy.go+12−3 oauthproxy_test.go+44
CHANGELOG.md+1
@@ -2,6 +2,7 @@
22
33## Changes since v3.1.0
44
5+- [#70](https://github.com/pusher/oauth2_proxy/pull/70) Fix handling of splitted cookies (@einfachchr)
56- [#92](https://github.com/pusher/oauth2_proxy/pull/92) Merge websocket proxy feature from openshift/oauth-proxy (@butzist)
67- [#57](https://github.com/pusher/oauth2_proxy/pull/57) Fall back to using OIDC Subject instead of Email (@aigarius)
78- [#85](https://github.com/pusher/oauth2_proxy/pull/85) Use non-root user in docker images (@kskewes)
oauthproxy.go+12−3
@@ -452,9 +452,18 @@ func (p *OAuthProxy) SetCSRFCookie(rw http.ResponseWriter, req *http.Request, va
452452// ClearSessionCookie creates a cookie to unset the user's authentication cookie
453453// stored in the user's session
454454func (p *OAuthProxy) ClearSessionCookie(rw http.ResponseWriter, req *http.Request) {
455− cookies := p.MakeSessionCookie(req, "", time.Hour*-1, time.Now())
456− for _, clr := range cookies {
457− http.SetCookie(rw, clr)
455+ var cookies []*http.Cookie
456+
457+ // matches CookieName, CookieName_<number>
458+ var cookieNameRegex = regexp.MustCompile(fmt.Sprintf("^%s(_\\d+)?$", p.CookieName))
459+
460+ for _, c := range req.Cookies() {
461+ if cookieNameRegex.MatchString(c.Name) {
462+ clearCookie := p.makeCookie(req, c.Name, "", time.Hour*-1, time.Now())
463+
464+ http.SetCookie(rw, clearCookie)
465+ cookies = append(cookies, clearCookie)
466+ }
458467 }
459468
460469 // ugly hack because default domain changed
oauthproxy_test.go+44
@@ -1064,3 +1064,47 @@ func TestAjaxForbiddendRequest(t *testing.T) {
10641064 mime := rh.Get("Content-Type")
10651065 assert.NotEqual(t, applicationJSON, mime)
10661066}
1067+
1068+func TestClearSplitCookie(t *testing.T) {
1069+ p := OAuthProxy{CookieName: "oauth2", CookieDomain: "abc"}
1070+ var rw = httptest.NewRecorder()
1071+ req := httptest.NewRequest("get", "/", nil)
1072+
1073+ req.AddCookie(&http.Cookie{
1074+ Name: "test1",
1075+ Value: "test1",
1076+ })
1077+ req.AddCookie(&http.Cookie{
1078+ Name: "oauth2_0",
1079+ Value: "oauth2_0",
1080+ })
1081+ req.AddCookie(&http.Cookie{
1082+ Name: "oauth2_1",
1083+ Value: "oauth2_1",
1084+ })
1085+
1086+ p.ClearSessionCookie(rw, req)
1087+ header := rw.Header()
1088+
1089+ assert.Equal(t, 2, len(header["Set-Cookie"]), "should have 3 set-cookie header entries")
1090+}
1091+
1092+func TestClearSingleCookie(t *testing.T) {
1093+ p := OAuthProxy{CookieName: "oauth2", CookieDomain: "abc"}
1094+ var rw = httptest.NewRecorder()
1095+ req := httptest.NewRequest("get", "/", nil)
1096+
1097+ req.AddCookie(&http.Cookie{
1098+ Name: "test1",
1099+ Value: "test1",
1100+ })
1101+ req.AddCookie(&http.Cookie{
1102+ Name: "oauth2",
1103+ Value: "oauth2",
1104+ })
1105+
1106+ p.ClearSessionCookie(rw, req)
1107+ header := rw.Header()
1108+
1109+ assert.Equal(t, 1, len(header["Set-Cookie"]), "should have 1 set-cookie header entries")
1110+}