@@ -54,7 +54,7 @@ func TestRobotsTxt(t *testing.T) {
5454 t.Fatal(err)
5555 }
5656 rw := httptest.NewRecorder()
57− req, _ := http.NewRequest("GET", "/robots.txt", nil)
57+ req, _ := http.NewRequest(http.MethodGet, "/robots.txt", nil)
5858 proxy.ServeHTTP(rw, req)
5959 assert.Equal(t, 200, rw.Code)
6060 assert.Equal(t, "User-agent: *\nDisallow: /\n", rw.Body.String())
@@ -241,7 +241,7 @@ func TestBasicAuthPassword(t *testing.T) {
241241
242242 // Save the required session
243243 rw := httptest.NewRecorder()
244− req, _ := http.NewRequest("GET", "/", nil)
244+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
245245 err = proxy.sessionStore.Save(rw, req, &sessions.SessionState{
246246 Email: emailAddress,
247247 })
@@ -250,7 +250,7 @@ func TestBasicAuthPassword(t *testing.T) {
250250 // Extract the cookie value to inject into the test request
251251 cookie := rw.Header().Values("Set-Cookie")[0]
252252
253− req, _ = http.NewRequest("GET", "/", nil)
253+ req, _ = http.NewRequest(http.MethodGet, "/", nil)
254254 req.Header.Set("Cookie", cookie)
255255 rw = httptest.NewRecorder()
256256 proxy.ServeHTTP(rw, req)
@@ -300,14 +300,14 @@ func TestPassGroupsHeadersWithGroups(t *testing.T) {
300300
301301 // Save the required session
302302 rw := httptest.NewRecorder()
303− req, _ := http.NewRequest("GET", "/", nil)
303+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
304304 err = proxy.sessionStore.Save(rw, req, session)
305305 assert.NoError(t, err)
306306
307307 // Extract the cookie value to inject into the test request
308308 cookie := rw.Header().Values("Set-Cookie")[0]
309309
310− req, _ = http.NewRequest("GET", "/", nil)
310+ req, _ = http.NewRequest(http.MethodGet, "/", nil)
311311 req.Header.Set("Cookie", cookie)
312312 rw = httptest.NewRecorder()
313313 proxy.ServeHTTP(rw, req)
@@ -457,7 +457,7 @@ func (patTest *PassAccessTokenTest) getEndpointWithCookie(cookie string, endpoin
457457 return 0, ""
458458 }
459459
460− req, err := http.NewRequest("GET", endpoint, strings.NewReader(""))
460+ req, err := http.NewRequest(http.MethodGet, endpoint, strings.NewReader(""))
461461 if err != nil {
462462 return 0, ""
463463 }
@@ -608,7 +608,7 @@ func NewSignInPageTest(skipProvider bool) (*SignInPageTest, error) {
608608
609609func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
610610 rw := httptest.NewRecorder()
611− req, _ := http.NewRequest("GET", endpoint, strings.NewReader(""))
611+ req, _ := http.NewRequest(http.MethodGet, endpoint, strings.NewReader(""))
612612 sipTest.proxy.ServeHTTP(rw, req)
613613 return rw.Code, rw.Body.String()
614614}
@@ -894,7 +894,7 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifi
894894 // access_token validation.
895895 pcTest.proxy.CookieOptions.Refresh = time.Duration(0)
896896 pcTest.rw = httptest.NewRecorder()
897− pcTest.req, _ = http.NewRequest("GET", "/", strings.NewReader(""))
897+ pcTest.req, _ = http.NewRequest(http.MethodGet, "/", strings.NewReader(""))
898898 pcTest.validateUser = true
899899 return &pcTest, nil
900900}
@@ -1027,7 +1027,7 @@ func NewUserInfoEndpointTest() (*ProcessCookieTest, error) {
10271027 if err != nil {
10281028 return nil, err
10291029 }
1030− pcTest.req, _ = http.NewRequest("GET",
1030+ pcTest.req, _ = http.NewRequest(http.MethodGet,
10311031 pcTest.opts.ProxyPrefix+"/userinfo", nil)
10321032 return pcTest, nil
10331033}
@@ -1135,7 +1135,7 @@ func NewAuthOnlyEndpointTest(querystring string, modifiers ...OptionsModifier) (
11351135 return nil, err
11361136 }
11371137 pcTest.req, _ = http.NewRequest(
1138− "GET",
1138+ http.MethodGet,
11391139 fmt.Sprintf("%s/auth%s", pcTest.opts.ProxyPrefix, querystring),
11401140 nil)
11411141 return pcTest, nil
@@ -1274,7 +1274,7 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
12741274 pcTest.validateUser = true
12751275
12761276 pcTest.rw = httptest.NewRecorder()
1277− pcTest.req, _ = http.NewRequest("GET",
1277+ pcTest.req, _ = http.NewRequest(http.MethodGet,
12781278 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
12791279
12801280 created := time.Now()
@@ -1367,7 +1367,7 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
13671367 pcTest.validateUser = true
13681368
13691369 pcTest.rw = httptest.NewRecorder()
1370− pcTest.req, _ = http.NewRequest("GET",
1370+ pcTest.req, _ = http.NewRequest(http.MethodGet,
13711371 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
13721372
13731373 created := time.Now()
@@ -1447,7 +1447,7 @@ func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
14471447 pcTest.validateUser = true
14481448
14491449 pcTest.rw = httptest.NewRecorder()
1450− pcTest.req, _ = http.NewRequest("GET",
1450+ pcTest.req, _ = http.NewRequest(http.MethodGet,
14511451 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
14521452
14531453 created := time.Now()
@@ -1495,7 +1495,7 @@ func TestAuthSkippedForPreflightRequests(t *testing.T) {
14951495 }
14961496 proxy.provider = NewTestProvider(upstreamURL, "")
14971497 rw := httptest.NewRecorder()
1498− req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)
1498+ req, _ := http.NewRequest(http.MethodOptions, "/preflight-request", nil)
14991499 proxy.ServeHTTP(rw, req)
15001500
15011501 assert.Equal(t, 200, rw.Code)
@@ -1652,19 +1652,19 @@ func TestRequestSignature(t *testing.T) {
16521652 resp string
16531653 }{
16541654 "No request signature": {
1655− method: "GET",
1655+ method: http.MethodGet,
16561656 body: "",
16571657 key: "",
16581658 resp: "no signature received",
16591659 },
16601660 "Get request": {
1661− method: "GET",
1661+ method: http.MethodGet,
16621662 body: "",
16631663 key: "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d",
16641664 resp: "signatures match",
16651665 },
16661666 "Post request": {
1667− method: "POST",
1667+ method: http.MethodPost,
16681668 body: `{ "hello": "world!" }`,
16691669 key: "d90df39e2d19282840252612dd7c81421a372f61",
16701670 resp: "signatures match",
@@ -2189,7 +2189,7 @@ func TestTrustedIPs(t *testing.T) {
21892189 reverseProxy: false,
21902190 realClientIPHeader: "X-Real-IP", // Default value
21912191 req: func() *http.Request {
2192− req, _ := http.NewRequest("GET", "/", nil)
2192+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
21932193 return req
21942194 }(),
21952195 expectTrusted: false,
@@ -2201,7 +2201,7 @@ func TestTrustedIPs(t *testing.T) {
22012201 reverseProxy: false,
22022202 realClientIPHeader: "X-Real-IP",
22032203 req: func() *http.Request {
2204− req, _ := http.NewRequest("GET", "/", nil)
2204+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
22052205 req.RemoteAddr = "@"
22062206 return req
22072207 }(),
@@ -2214,7 +2214,7 @@ func TestTrustedIPs(t *testing.T) {
22142214 reverseProxy: false,
22152215 realClientIPHeader: "X-Real-IP",
22162216 req: func() *http.Request {
2217− req, _ := http.NewRequest("GET", "/", nil)
2217+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
22182218 req.RemoteAddr = "@"
22192219 return req
22202220 }(),
@@ -2227,7 +2227,7 @@ func TestTrustedIPs(t *testing.T) {
22272227 reverseProxy: false,
22282228 realClientIPHeader: "X-Real-IP", // Default value
22292229 req: func() *http.Request {
2230− req, _ := http.NewRequest("GET", "/", nil)
2230+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
22312231 req.RemoteAddr = "127.0.0.1:43670"
22322232 return req
22332233 }(),
@@ -2240,7 +2240,7 @@ func TestTrustedIPs(t *testing.T) {
22402240 reverseProxy: true,
22412241 realClientIPHeader: "X-Real-IP", // Default value
22422242 req: func() *http.Request {
2243− req, _ := http.NewRequest("GET", "/", nil)
2243+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
22442244 req.RemoteAddr = "127.0.0.1:44324"
22452245 return req
22462246 }(),
@@ -2253,7 +2253,7 @@ func TestTrustedIPs(t *testing.T) {
22532253 reverseProxy: true,
22542254 realClientIPHeader: "X-Forwarded-For",
22552255 req: func() *http.Request {
2256− req, _ := http.NewRequest("GET", "/", nil)
2256+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
22572257 req.Header.Add("X-Forwarded-For", "127.0.0.1")
22582258 return req
22592259 }(),
@@ -2266,7 +2266,7 @@ func TestTrustedIPs(t *testing.T) {
22662266 reverseProxy: true,
22672267 realClientIPHeader: "X-Forwarded-For",
22682268 req: func() *http.Request {
2269− req, _ := http.NewRequest("GET", "/", nil)
2269+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
22702270 req.Header.Add("X-Forwarded-For", "::1")
22712271 return req
22722272 }(),
@@ -2279,7 +2279,7 @@ func TestTrustedIPs(t *testing.T) {
22792279 reverseProxy: true,
22802280 realClientIPHeader: "X-Forwarded-For",
22812281 req: func() *http.Request {
2282− req, _ := http.NewRequest("GET", "/", nil)
2282+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
22832283 req.Header.Add("X-Forwarded-For", "12.34.56.78")
22842284 return req
22852285 }(),
@@ -2292,7 +2292,7 @@ func TestTrustedIPs(t *testing.T) {
22922292 reverseProxy: true,
22932293 realClientIPHeader: "X-Forwarded-For",
22942294 req: func() *http.Request {
2295− req, _ := http.NewRequest("GET", "/", nil)
2295+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
22962296 req.Header.Add("X-Forwarded-For", "::2")
22972297 return req
22982298 }(),
@@ -2305,7 +2305,7 @@ func TestTrustedIPs(t *testing.T) {
23052305 reverseProxy: true,
23062306 realClientIPHeader: "X-Forwarded-For",
23072307 req: func() *http.Request {
2308− req, _ := http.NewRequest("GET", "/", nil)
2308+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
23092309 req.Header.Add("X-Real-IP", "::1")
23102310 return req
23112311 }(),
@@ -2318,7 +2318,7 @@ func TestTrustedIPs(t *testing.T) {
23182318 reverseProxy: true,
23192319 realClientIPHeader: "X-Forwarded-For",
23202320 req: func() *http.Request {
2321− req, _ := http.NewRequest("GET", "/", nil)
2321+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
23222322 req.Header.Add("X-Forwarded-For", "adsfljk29242as!!")
23232323 return req
23242324 }(),
@@ -2331,7 +2331,7 @@ func TestTrustedIPs(t *testing.T) {
23312331 reverseProxy: false,
23322332 realClientIPHeader: "X-Real-IP",
23332333 req: func() *http.Request {
2334− req, _ := http.NewRequest("GET", "/", nil)
2334+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
23352335 req.RemoteAddr = "adsfljk29242as!!"
23362336 return req
23372337 }(),
@@ -2427,12 +2427,12 @@ func Test_buildRoutesAllowlist(t *testing.T) {
24272427 },
24282428 expectedRoutes: []expectedAllowedRoute{
24292429 {
2430− method: "GET",
2430+ method: http.MethodGet,
24312431 negate: false,
24322432 regexString: "^/foo/bar",
24332433 },
24342434 {
2435− method: "POST",
2435+ method: http.MethodPost,
24362436 negate: false,
24372437 regexString: "^/baz/[0-9]+/thing",
24382438 },
@@ -2485,11 +2485,11 @@ func Test_buildRoutesAllowlist(t *testing.T) {
24852485 regexString: "^/baz/[0-9]+/thing/regex",
24862486 },
24872487 {
2488− method: "GET",
2488+ method: http.MethodGet,
24892489 regexString: "^/foo/bar",
24902490 },
24912491 {
2492− method: "POST",
2492+ method: http.MethodPost,
24932493 regexString: "^/baz/[0-9]+/thing",
24942494 },
24952495 {
@@ -2641,7 +2641,7 @@ func TestApiRoutes(t *testing.T) {
26412641
26422642 for _, tc := range testCases {
26432643 t.Run(tc.name, func(t *testing.T) {
2644− req, err := http.NewRequest("GET", tc.url, nil)
2644+ req, err := http.NewRequest(http.MethodGet, tc.url, nil)
26452645 req.Header.Set("Accept", tc.contentType)
26462646 assert.NoError(t, err)
26472647
@@ -2679,9 +2679,11 @@ func TestAllowedRequest(t *testing.T) {
26792679 }
26802680 opts.SkipAuthRegex = []string{
26812681 "^/skip/auth/regex$",
2682+ "^/public/.*/endpoint$",
26822683 }
26832684 opts.SkipAuthRoutes = []string{
26842685 "GET=^/skip/auth/routes/get",
2686+ "^/foo/.*/bar$",
26852687 }
26862688 err := validation.Validate(opts)
26872689 assert.NoError(t, err)
@@ -2698,25 +2700,37 @@ func TestAllowedRequest(t *testing.T) {
26982700 }{
26992701 {
27002702 name: "Regex GET allowed",
2701− method: "GET",
2703+ method: http.MethodGet,
27022704 url: "/skip/auth/regex",
27032705 allowed: true,
27042706 },
27052707 {
27062708 name: "Regex POST allowed ",
2707− method: "POST",
2709+ method: http.MethodPost,
27082710 url: "/skip/auth/regex",
27092711 allowed: true,
27102712 },
27112713 {
27122714 name: "Regex denied",
2713− method: "GET",
2715+ method: http.MethodGet,
27142716 url: "/wrong/denied",
27152717 allowed: false,
27162718 },
2719+ {
2720+ name: "Regex allowed with fragment-free path",
2721+ method: http.MethodGet,
2722+ url: "/public/legit/endpoint",
2723+ allowed: true,
2724+ },
2725+ {
2726+ name: "Regex denied when path contains encoded fragment suffix",
2727+ method: http.MethodGet,
2728+ url: "/public/secret%23/endpoint",
2729+ allowed: false,
2730+ },
27172731 {
27182732 name: "Route allowed",
2719− method: "GET",
2733+ method: http.MethodGet,
27202734 url: "/skip/auth/routes/get",
27212735 allowed: true,
27222736 },
@@ -2728,16 +2742,28 @@ func TestAllowedRequest(t *testing.T) {
27282742 },
27292743 {
27302744 name: "Route denied with wrong path",
2731− method: "GET",
2745+ method: http.MethodGet,
27322746 url: "/skip/auth/routes/wrong/path",
27332747 allowed: false,
27342748 },
27352749 {
27362750 name: "Route denied with wrong path and method",
2737− method: "POST",
2751+ method: http.MethodPost,
27382752 url: "/skip/auth/routes/wrong/path",
27392753 allowed: false,
27402754 },
2755+ {
2756+ name: "Route allowed with fragment-free path",
2757+ method: http.MethodGet,
2758+ url: "/foo/public/bar",
2759+ allowed: true,
2760+ },
2761+ {
2762+ name: "Route denied when path contains encoded fragment suffix",
2763+ method: http.MethodGet,
2764+ url: "/foo/secret%23/bar",
2765+ allowed: false,
2766+ },
27412767 }
27422768
27432769 for _, tc := range testCases {
@@ -2778,9 +2804,11 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
27782804 }
27792805 opts.SkipAuthRegex = []string{
27802806 "^/skip/auth/regex$",
2807+ "^/public/.*/endpoint$",
27812808 }
27822809 opts.SkipAuthRoutes = []string{
27832810 "GET=^/skip/auth/routes/get",
2811+ "^/foo/.*/bar$",
27842812 }
27852813 err := validation.Validate(opts)
27862814 assert.NoError(t, err)
@@ -2797,25 +2825,37 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
27972825 }{
27982826 {
27992827 name: "Regex GET allowed",
2800− method: "GET",
2828+ method: http.MethodGet,
28012829 url: "/skip/auth/regex",
28022830 allowed: true,
28032831 },
28042832 {
28052833 name: "Regex POST allowed ",
2806− method: "POST",
2834+ method: http.MethodPost,
28072835 url: "/skip/auth/regex",
28082836 allowed: true,
28092837 },
28102838 {
28112839 name: "Regex denied",
2812− method: "GET",
2840+ method: http.MethodGet,
28132841 url: "/wrong/denied",
28142842 allowed: false,
28152843 },
2844+ {
2845+ name: "Regex allowed with fragment-free path",
2846+ method: http.MethodGet,
2847+ url: "/public/legit/endpoint",
2848+ allowed: true,
2849+ },
2850+ {
2851+ name: "Regex denied when X-Forwarded-Uri contains an encoded fragment suffix",
2852+ method: http.MethodGet,
2853+ url: "/public/secret%23/endpoint",
2854+ allowed: false,
2855+ },
28162856 {
28172857 name: "Route allowed",
2818− method: "GET",
2858+ method: http.MethodGet,
28192859 url: "/skip/auth/routes/get",
28202860 allowed: true,
28212861 },
@@ -2827,22 +2867,35 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
28272867 },
28282868 {
28292869 name: "Route denied with wrong path",
2830− method: "GET",
2870+ method: http.MethodGet,
28312871 url: "/skip/auth/routes/wrong/path",
28322872 allowed: false,
28332873 },
28342874 {
28352875 name: "Route denied with wrong path and method",
2836− method: "POST",
2876+ method: http.MethodPost,
28372877 url: "/skip/auth/routes/wrong/path",
28382878 allowed: false,
28392879 },
2880+ {
2881+ name: "Route allowed with fragment-free path",
2882+ method: http.MethodGet,
2883+ url: "/foo/public/bar",
2884+ allowed: true,
2885+ },
2886+ {
2887+ name: "Route denied when X-Forwarded-Uri contains an encoded fragment suffix",
2888+ method: http.MethodGet,
2889+ url: "/foo/secret%23/bar",
2890+ allowed: false,
2891+ },
28402892 }
28412893
28422894 for _, tc := range testCases {
28432895 t.Run(tc.name, func(t *testing.T) {
28442896 req, err := http.NewRequest(tc.method, opts.ProxyPrefix+authOnlyPath, nil)
28452897 req.Header.Set("X-Forwarded-Uri", tc.url)
2898+ req.RemoteAddr = "127.0.0.1:4180"
28462899 assert.NoError(t, err)
28472900
28482901 rw := httptest.NewRecorder()
@@ -2857,6 +2910,43 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
28572910 }
28582911}
28592912
2913+func TestAllowedRequestWithForwardedUriHeaderRequiresTrustedProxy(t *testing.T) {
2914+ upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
2915+ w.WriteHeader(200)
2916+ }))
2917+ t.Cleanup(upstreamServer.Close)
2918+
2919+ opts := baseTestOptions()
2920+ opts.ReverseProxy = true
2921+ opts.TrustedProxyIPs = []string{"127.0.0.1/32"}
2922+ opts.UpstreamServers = options.UpstreamConfig{
2923+ Upstreams: []options.Upstream{
2924+ {
2925+ ID: upstreamServer.URL,
2926+ Path: "/",
2927+ URI: upstreamServer.URL,
2928+ },
2929+ },
2930+ }
2931+ opts.SkipAuthRegex = []string{"^/skip/auth/regex$"}
2932+
2933+ err := validation.Validate(opts)
2934+ assert.NoError(t, err)
2935+
2936+ proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })
2937+ assert.NoError(t, err)
2938+
2939+ req, err := http.NewRequest(http.MethodGet, opts.ProxyPrefix+authOnlyPath, nil)
2940+ assert.NoError(t, err)
2941+ req.RemoteAddr = "192.0.2.10:4180"
2942+ req.Header.Set("X-Forwarded-Uri", "/skip/auth/regex")
2943+
2944+ rw := httptest.NewRecorder()
2945+ proxy.ServeHTTP(rw, req)
2946+
2947+ assert.Equal(t, 401, rw.Code)
2948+}
2949+
28602950func TestAllowedRequestNegateWithoutMethod(t *testing.T) {
28612951 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
28622952 w.WriteHeader(200)
@@ -2896,37 +2986,37 @@ func TestAllowedRequestNegateWithoutMethod(t *testing.T) {
28962986 }{
28972987 {
28982988 name: "Some static file allowed",
2899− method: "GET",
2989+ method: http.MethodGet,
29002990 url: "/static/file.txt",
29012991 allowed: true,
29022992 },
29032993 {
29042994 name: "POST to contact form allowed",
2905− method: "POST",
2995+ method: http.MethodPost,
29062996 url: "/contact",
29072997 allowed: true,
29082998 },
29092999 {
29103000 name: "Regex POST allowed",
2911− method: "POST",
3001+ method: http.MethodPost,
29123002 url: "/api/public-entity",
29133003 allowed: true,
29143004 },
29153005 {
29163006 name: "Regex POST with trailing slash allowed",
2917− method: "POST",
3007+ method: http.MethodPost,
29183008 url: "/api/public-entity/",
29193009 allowed: true,
29203010 },
29213011 {
29223012 name: "Regex GET api route denied",
2923− method: "GET",
3013+ method: http.MethodGet,
29243014 url: "/api/users",
29253015 allowed: false,
29263016 },
29273017 {
29283018 name: "Regex POST api route denied",
2929− method: "POST",
3019+ method: http.MethodPost,
29303020 url: "/api/users",
29313021 allowed: false,
29323022 },
@@ -2996,37 +3086,37 @@ func TestAllowedRequestNegateWithMethod(t *testing.T) {
29963086 }{
29973087 {
29983088 name: "Some static file allowed",
2999− method: "GET",
3089+ method: http.MethodGet,
30003090 url: "/static/file.txt",
30013091 allowed: true,
30023092 },
30033093 {
30043094 name: "POST to contact form not allowed",
3005− method: "POST",
3095+ method: http.MethodPost,
30063096 url: "/contact",
30073097 allowed: false,
30083098 },
30093099 {
30103100 name: "Regex POST allowed",
3011− method: "POST",
3101+ method: http.MethodPost,
30123102 url: "/api/public-entity",
30133103 allowed: true,
30143104 },
30153105 {
30163106 name: "Regex POST with trailing slash allowed",
3017− method: "POST",
3107+ method: http.MethodPost,
30183108 url: "/api/public-entity/",
30193109 allowed: true,
30203110 },
30213111 {
30223112 name: "Regex GET api route denied",
3023− method: "GET",
3113+ method: http.MethodGet,
30243114 url: "/api/users",
30253115 allowed: false,
30263116 },
30273117 {
30283118 name: "Regex POST api route denied",
3029− method: "POST",
3119+ method: http.MethodPost,
30303120 url: "/api/users",
30313121 allowed: false,
30323122 },
@@ -3166,7 +3256,7 @@ func TestProxyAllowedGroups(t *testing.T) {
31663256 t.Fatal(err)
31673257 }
31683258
3169− test.req, _ = http.NewRequest("GET", fmt.Sprintf("/%s", tt.querystring), nil)
3259+ test.req, _ = http.NewRequest(http.MethodGet, fmt.Sprintf("/%s", tt.querystring), nil)
31703260
31713261 test.req.Header.Add("accept", applicationJSON)
31723262 err = test.SaveSession(session)
@@ -3310,7 +3400,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
33103400 {
33113401 name: "UserWithGroupSkipAuthPreflight",
33123402 groups: []string{"a", "c"},
3313− method: "OPTIONS",
3403+ method: http.MethodOptions,
33143404 ip: "1.2.3.5:43670",
33153405 withSession: true,
33163406 expectedStatusCode: http.StatusAccepted,
@@ -3318,7 +3408,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
33183408 {
33193409 name: "UserWithGroupTrustedIp",
33203410 groups: []string{"a", "c"},
3321− method: "GET",
3411+ method: http.MethodGet,
33223412 ip: "1.2.3.4:43670",
33233413 withSession: true,
33243414 expectedStatusCode: http.StatusAccepted,
@@ -3326,7 +3416,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
33263416 {
33273417 name: "UserWithoutGroupSkipAuthPreflight",
33283418 groups: []string{"c"},
3329− method: "OPTIONS",
3419+ method: http.MethodOptions,
33303420 ip: "1.2.3.5:43670",
33313421 withSession: true,
33323422 expectedStatusCode: http.StatusForbidden,
@@ -3334,21 +3424,21 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
33343424 {
33353425 name: "UserWithoutGroupTrustedIp",
33363426 groups: []string{"c"},
3337− method: "GET",
3427+ method: http.MethodGet,
33383428 ip: "1.2.3.4:43670",
33393429 withSession: true,
33403430 expectedStatusCode: http.StatusForbidden,
33413431 },
33423432 {
33433433 name: "UserWithoutSessionSkipAuthPreflight",
3344− method: "OPTIONS",
3434+ method: http.MethodOptions,
33453435 ip: "1.2.3.5:43670",
33463436 withSession: false,
33473437 expectedStatusCode: http.StatusAccepted,
33483438 },
33493439 {
33503440 name: "UserWithoutSessionTrustedIp",
3351− method: "GET",
3441+ method: http.MethodGet,
33523442 ip: "1.2.3.4:43670",
33533443 withSession: false,
33543444 expectedStatusCode: http.StatusAccepted,
@@ -3448,6 +3538,24 @@ func TestAuthOnlyAllowedEmailDomains(t *testing.T) {
34483538 querystring: "?allowed_email_domains=a.b.c.example.com,*.c.example.com",
34493539 expectedStatusCode: http.StatusAccepted,
34503540 },
3541+ {
3542+ name: "UserWithMultipleAtSignsExactDomain",
3543+ email: "attacker@evil.com@example.com",
3544+ querystring: "?allowed_email_domains=example.com",
3545+ expectedStatusCode: http.StatusForbidden,
3546+ },
3547+ {
3548+ name: "UserWithMultipleAtSignsWildcardDomain",
3549+ email: "attacker@evil.com@foo.example.com",
3550+ querystring: "?allowed_email_domains=*.example.com",
3551+ expectedStatusCode: http.StatusForbidden,
3552+ },
3553+ {
3554+ name: "UserWithMultipleAtSignsDotPrefixedDomain",
3555+ email: "attacker@evil.com@foo.example.com",
3556+ querystring: "?allowed_email_domains=.example.com",
3557+ expectedStatusCode: http.StatusForbidden,
3558+ },
34513559 }
34523560
34533561 for _, tc := range testCases {
@@ -3682,14 +3790,14 @@ func TestIdTokenPlaceholderInSignOut(t *testing.T) {
36823790
36833791 // Save the required session
36843792 rw := httptest.NewRecorder()
3685− req, _ := http.NewRequest("GET", "/", nil)
3793+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
36863794 err = proxy.sessionStore.Save(rw, req, session)
36873795 assert.NoError(t, err)
36883796
36893797 rw = httptest.NewRecorder()
36903798
36913799 rdUrl := url.QueryEscape("https://my-oidc-provider.example.com/sign_out_page?id_token_hint={id_token}&post_logout_redirect_uri=https://my-app.example.com/")
3692− req, _ = http.NewRequest("GET", "/oauth2/sign_out?rd="+rdUrl, nil)
3800+ req, _ = http.NewRequest(http.MethodGet, "/oauth2/sign_out?rd="+rdUrl, nil)
36933801 req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{
36943802 RequestID: "11111111-2222-4333-8444-555555555555",
36953803 Session: session,