@@ -54,7 +54,7 @@ func TestRobotsTxt(t *testing.T) {
54 t.Fatal(err)
54 t.Fatal(err)
56 rw := httptest.NewRecorder()
56 rw := httptest.NewRecorder()
57− req, _ := http.NewRequest("GET", "/robots.txt", nil)
57+ req, _ := http.NewRequest(http.MethodGet, "/robots.txt", nil)
58 proxy.ServeHTTP(rw, req)
58 proxy.ServeHTTP(rw, req)
59 assert.Equal(t, 200, rw.Code)
59 assert.Equal(t, 200, rw.Code)
60 assert.Equal(t, "User-agent: *\nDisallow: /\n", rw.Body.String())
60 assert.Equal(t, "User-agent: *\nDisallow: /\n", rw.Body.String())
@@ -241,7 +241,7 @@ func TestBasicAuthPassword(t *testing.T) {
242 // Save the required session
242 // Save the required session
243 rw := httptest.NewRecorder()
243 rw := httptest.NewRecorder()
244− req, _ := http.NewRequest("GET", "/", nil)
244+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
245 err = proxy.sessionStore.Save(rw, req, &sessions.SessionState{
245 err = proxy.sessionStore.Save(rw, req, &sessions.SessionState{
246 Email: emailAddress,
246 Email: emailAddress,
@@ -250,7 +250,7 @@ func TestBasicAuthPassword(t *testing.T) {
250 // Extract the cookie value to inject into the test request
250 // Extract the cookie value to inject into the test request
251 cookie := rw.Header().Values("Set-Cookie")[0]
251 cookie := rw.Header().Values("Set-Cookie")[0]
253− req, _ = http.NewRequest("GET", "/", nil)
253+ req, _ = http.NewRequest(http.MethodGet, "/", nil)
254 req.Header.Set("Cookie", cookie)
254 req.Header.Set("Cookie", cookie)
255 rw = httptest.NewRecorder()
255 rw = httptest.NewRecorder()
256 proxy.ServeHTTP(rw, req)
256 proxy.ServeHTTP(rw, req)
@@ -300,14 +300,14 @@ func TestPassGroupsHeadersWithGroups(t *testing.T) {
301 // Save the required session
301 // Save the required session
302 rw := httptest.NewRecorder()
302 rw := httptest.NewRecorder()
303− req, _ := http.NewRequest("GET", "/", nil)
303+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
304 err = proxy.sessionStore.Save(rw, req, session)
304 err = proxy.sessionStore.Save(rw, req, session)
305 assert.NoError(t, err)
305 assert.NoError(t, err)
307 // Extract the cookie value to inject into the test request
307 // Extract the cookie value to inject into the test request
308 cookie := rw.Header().Values("Set-Cookie")[0]
308 cookie := rw.Header().Values("Set-Cookie")[0]
310− req, _ = http.NewRequest("GET", "/", nil)
310+ req, _ = http.NewRequest(http.MethodGet, "/", nil)
311 req.Header.Set("Cookie", cookie)
311 req.Header.Set("Cookie", cookie)
312 rw = httptest.NewRecorder()
312 rw = httptest.NewRecorder()
313 proxy.ServeHTTP(rw, req)
313 proxy.ServeHTTP(rw, req)
@@ -457,7 +457,7 @@ func (patTest *PassAccessTokenTest) getEndpointWithCookie(cookie string, endpoin
457 return 0, ""
457 return 0, ""
460− req, err := http.NewRequest("GET", endpoint, strings.NewReader(""))
460+ req, err := http.NewRequest(http.MethodGet, endpoint, strings.NewReader(""))
461 if err != nil {
461 if err != nil {
462 return 0, ""
462 return 0, ""
@@ -608,7 +608,7 @@ func NewSignInPageTest(skipProvider bool) (*SignInPageTest, error) {
609func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
609func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
610 rw := httptest.NewRecorder()
610 rw := httptest.NewRecorder()
611− req, _ := http.NewRequest("GET", endpoint, strings.NewReader(""))
611+ req, _ := http.NewRequest(http.MethodGet, endpoint, strings.NewReader(""))
612 sipTest.proxy.ServeHTTP(rw, req)
612 sipTest.proxy.ServeHTTP(rw, req)
613 return rw.Code, rw.Body.String()
613 return rw.Code, rw.Body.String()
@@ -894,7 +894,7 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifi
894 // access_token validation.
894 // access_token validation.
895 pcTest.proxy.CookieOptions.Refresh = time.Duration(0)
895 pcTest.proxy.CookieOptions.Refresh = time.Duration(0)
896 pcTest.rw = httptest.NewRecorder()
896 pcTest.rw = httptest.NewRecorder()
897− pcTest.req, _ = http.NewRequest("GET", "/", strings.NewReader(""))
897+ pcTest.req, _ = http.NewRequest(http.MethodGet, "/", strings.NewReader(""))
898 pcTest.validateUser = true
898 pcTest.validateUser = true
899 return &pcTest, nil
899 return &pcTest, nil
@@ -1027,7 +1027,7 @@ func NewUserInfoEndpointTest() (*ProcessCookieTest, error) {
1027 if err != nil {
1027 if err != nil {
1028 return nil, err
1028 return nil, err
1030− pcTest.req, _ = http.NewRequest("GET",
1030+ pcTest.req, _ = http.NewRequest(http.MethodGet,
1031 pcTest.opts.ProxyPrefix+"/userinfo", nil)
1031 pcTest.opts.ProxyPrefix+"/userinfo", nil)
1032 return pcTest, nil
1032 return pcTest, nil
@@ -1135,7 +1135,7 @@ func NewAuthOnlyEndpointTest(querystring string, modifiers ...OptionsModifier) (
1135 return nil, err
1135 return nil, err
1137 pcTest.req, _ = http.NewRequest(
1137 pcTest.req, _ = http.NewRequest(
1138− "GET",
1138+ http.MethodGet,
1139 fmt.Sprintf("%s/auth%s", pcTest.opts.ProxyPrefix, querystring),
1139 fmt.Sprintf("%s/auth%s", pcTest.opts.ProxyPrefix, querystring),
1141 return pcTest, nil
1141 return pcTest, nil
@@ -1274,7 +1274,7 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
1274 pcTest.validateUser = true
1274 pcTest.validateUser = true
1276 pcTest.rw = httptest.NewRecorder()
1276 pcTest.rw = httptest.NewRecorder()
1277− pcTest.req, _ = http.NewRequest("GET",
1277+ pcTest.req, _ = http.NewRequest(http.MethodGet,
1278 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
1278 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
1280 created := time.Now()
1280 created := time.Now()
@@ -1367,7 +1367,7 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
1367 pcTest.validateUser = true
1367 pcTest.validateUser = true
1369 pcTest.rw = httptest.NewRecorder()
1369 pcTest.rw = httptest.NewRecorder()
1370− pcTest.req, _ = http.NewRequest("GET",
1370+ pcTest.req, _ = http.NewRequest(http.MethodGet,
1371 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
1371 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
1373 created := time.Now()
1373 created := time.Now()
@@ -1447,7 +1447,7 @@ func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
1447 pcTest.validateUser = true
1447 pcTest.validateUser = true
1449 pcTest.rw = httptest.NewRecorder()
1449 pcTest.rw = httptest.NewRecorder()
1450− pcTest.req, _ = http.NewRequest("GET",
1450+ pcTest.req, _ = http.NewRequest(http.MethodGet,
1451 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
1451 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
1453 created := time.Now()
1453 created := time.Now()
@@ -1495,7 +1495,7 @@ func TestAuthSkippedForPreflightRequests(t *testing.T) {
1496 proxy.provider = NewTestProvider(upstreamURL, "")
1496 proxy.provider = NewTestProvider(upstreamURL, "")
1497 rw := httptest.NewRecorder()
1497 rw := httptest.NewRecorder()
1498− req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)
1498+ req, _ := http.NewRequest(http.MethodOptions, "/preflight-request", nil)
1499 proxy.ServeHTTP(rw, req)
1499 proxy.ServeHTTP(rw, req)
1501 assert.Equal(t, 200, rw.Code)
1501 assert.Equal(t, 200, rw.Code)
@@ -1652,19 +1652,19 @@ func TestRequestSignature(t *testing.T) {
1652 resp string
1652 resp string
1654 "No request signature": {
1654 "No request signature": {
1655− method: "GET",
1655+ method: http.MethodGet,
1656 body: "",
1656 body: "",
1657 key: "",
1657 key: "",
1658 resp: "no signature received",
1658 resp: "no signature received",
1660 "Get request": {
1660 "Get request": {
1661− method: "GET",
1661+ method: http.MethodGet,
1662 body: "",
1662 body: "",
1663 key: "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d",
1663 key: "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d",
1664 resp: "signatures match",
1664 resp: "signatures match",
1666 "Post request": {
1666 "Post request": {
1667− method: "POST",
1667+ method: http.MethodPost,
1668 body: `{ "hello": "world!" }`,
1668 body: `{ "hello": "world!" }`,
1669 key: "d90df39e2d19282840252612dd7c81421a372f61",
1669 key: "d90df39e2d19282840252612dd7c81421a372f61",
1670 resp: "signatures match",
1670 resp: "signatures match",
@@ -2189,7 +2189,7 @@ func TestTrustedIPs(t *testing.T) {
2189 reverseProxy: false,
2189 reverseProxy: false,
2190 realClientIPHeader: "X-Real-IP", // Default value
2190 realClientIPHeader: "X-Real-IP", // Default value
2191 req: func() *http.Request {
2191 req: func() *http.Request {
2192− req, _ := http.NewRequest("GET", "/", nil)
2192+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2193 return req
2193 return req
2195 expectTrusted: false,
2195 expectTrusted: false,
@@ -2201,7 +2201,7 @@ func TestTrustedIPs(t *testing.T) {
2201 reverseProxy: false,
2201 reverseProxy: false,
2202 realClientIPHeader: "X-Real-IP",
2202 realClientIPHeader: "X-Real-IP",
2203 req: func() *http.Request {
2203 req: func() *http.Request {
2204− req, _ := http.NewRequest("GET", "/", nil)
2204+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2205 req.RemoteAddr = "@"
2205 req.RemoteAddr = "@"
2206 return req
2206 return req
@@ -2214,7 +2214,7 @@ func TestTrustedIPs(t *testing.T) {
2214 reverseProxy: false,
2214 reverseProxy: false,
2215 realClientIPHeader: "X-Real-IP",
2215 realClientIPHeader: "X-Real-IP",
2216 req: func() *http.Request {
2216 req: func() *http.Request {
2217− req, _ := http.NewRequest("GET", "/", nil)
2217+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2218 req.RemoteAddr = "@"
2218 req.RemoteAddr = "@"
2219 return req
2219 return req
@@ -2227,7 +2227,7 @@ func TestTrustedIPs(t *testing.T) {
2227 reverseProxy: false,
2227 reverseProxy: false,
2228 realClientIPHeader: "X-Real-IP", // Default value
2228 realClientIPHeader: "X-Real-IP", // Default value
2229 req: func() *http.Request {
2229 req: func() *http.Request {
2230− req, _ := http.NewRequest("GET", "/", nil)
2230+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2231 req.RemoteAddr = "127.0.0.1:43670"
2231 req.RemoteAddr = "127.0.0.1:43670"
2232 return req
2232 return req
@@ -2240,7 +2240,7 @@ func TestTrustedIPs(t *testing.T) {
2240 reverseProxy: true,
2240 reverseProxy: true,
2241 realClientIPHeader: "X-Real-IP", // Default value
2241 realClientIPHeader: "X-Real-IP", // Default value
2242 req: func() *http.Request {
2242 req: func() *http.Request {
2243− req, _ := http.NewRequest("GET", "/", nil)
2243+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2244 req.RemoteAddr = "127.0.0.1:44324"
2244 req.RemoteAddr = "127.0.0.1:44324"
2245 return req
2245 return req
@@ -2253,7 +2253,7 @@ func TestTrustedIPs(t *testing.T) {
2253 reverseProxy: true,
2253 reverseProxy: true,
2254 realClientIPHeader: "X-Forwarded-For",
2254 realClientIPHeader: "X-Forwarded-For",
2255 req: func() *http.Request {
2255 req: func() *http.Request {
2256− req, _ := http.NewRequest("GET", "/", nil)
2256+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2257 req.Header.Add("X-Forwarded-For", "127.0.0.1")
2257 req.Header.Add("X-Forwarded-For", "127.0.0.1")
2258 return req
2258 return req
@@ -2266,7 +2266,7 @@ func TestTrustedIPs(t *testing.T) {
2266 reverseProxy: true,
2266 reverseProxy: true,
2267 realClientIPHeader: "X-Forwarded-For",
2267 realClientIPHeader: "X-Forwarded-For",
2268 req: func() *http.Request {
2268 req: func() *http.Request {
2269− req, _ := http.NewRequest("GET", "/", nil)
2269+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2270 req.Header.Add("X-Forwarded-For", "::1")
2270 req.Header.Add("X-Forwarded-For", "::1")
2271 return req
2271 return req
@@ -2279,7 +2279,7 @@ func TestTrustedIPs(t *testing.T) {
2279 reverseProxy: true,
2279 reverseProxy: true,
2280 realClientIPHeader: "X-Forwarded-For",
2280 realClientIPHeader: "X-Forwarded-For",
2281 req: func() *http.Request {
2281 req: func() *http.Request {
2282− req, _ := http.NewRequest("GET", "/", nil)
2282+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2283 req.Header.Add("X-Forwarded-For", "12.34.56.78")
2283 req.Header.Add("X-Forwarded-For", "12.34.56.78")
2284 return req
2284 return req
@@ -2292,7 +2292,7 @@ func TestTrustedIPs(t *testing.T) {
2292 reverseProxy: true,
2292 reverseProxy: true,
2293 realClientIPHeader: "X-Forwarded-For",
2293 realClientIPHeader: "X-Forwarded-For",
2294 req: func() *http.Request {
2294 req: func() *http.Request {
2295− req, _ := http.NewRequest("GET", "/", nil)
2295+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2296 req.Header.Add("X-Forwarded-For", "::2")
2296 req.Header.Add("X-Forwarded-For", "::2")
2297 return req
2297 return req
@@ -2305,7 +2305,7 @@ func TestTrustedIPs(t *testing.T) {
2305 reverseProxy: true,
2305 reverseProxy: true,
2306 realClientIPHeader: "X-Forwarded-For",
2306 realClientIPHeader: "X-Forwarded-For",
2307 req: func() *http.Request {
2307 req: func() *http.Request {
2308− req, _ := http.NewRequest("GET", "/", nil)
2308+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2309 req.Header.Add("X-Real-IP", "::1")
2309 req.Header.Add("X-Real-IP", "::1")
2310 return req
2310 return req
@@ -2318,7 +2318,7 @@ func TestTrustedIPs(t *testing.T) {
2318 reverseProxy: true,
2318 reverseProxy: true,
2319 realClientIPHeader: "X-Forwarded-For",
2319 realClientIPHeader: "X-Forwarded-For",
2320 req: func() *http.Request {
2320 req: func() *http.Request {
2321− req, _ := http.NewRequest("GET", "/", nil)
2321+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2322 req.Header.Add("X-Forwarded-For", "adsfljk29242as!!")
2322 req.Header.Add("X-Forwarded-For", "adsfljk29242as!!")
2323 return req
2323 return req
@@ -2331,7 +2331,7 @@ func TestTrustedIPs(t *testing.T) {
2331 reverseProxy: false,
2331 reverseProxy: false,
2332 realClientIPHeader: "X-Real-IP",
2332 realClientIPHeader: "X-Real-IP",
2333 req: func() *http.Request {
2333 req: func() *http.Request {
2334− req, _ := http.NewRequest("GET", "/", nil)
2334+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
2335 req.RemoteAddr = "adsfljk29242as!!"
2335 req.RemoteAddr = "adsfljk29242as!!"
2336 return req
2336 return req
@@ -2427,12 +2427,12 @@ func Test_buildRoutesAllowlist(t *testing.T) {
2428 expectedRoutes: []expectedAllowedRoute{
2428 expectedRoutes: []expectedAllowedRoute{
2430− method: "GET",
2430+ method: http.MethodGet,
2431 negate: false,
2431 negate: false,
2432 regexString: "^/foo/bar",
2432 regexString: "^/foo/bar",
2435− method: "POST",
2435+ method: http.MethodPost,
2436 negate: false,
2436 negate: false,
2437 regexString: "^/baz/[0-9]+/thing",
2437 regexString: "^/baz/[0-9]+/thing",
@@ -2485,11 +2485,11 @@ func Test_buildRoutesAllowlist(t *testing.T) {
2485 regexString: "^/baz/[0-9]+/thing/regex",
2485 regexString: "^/baz/[0-9]+/thing/regex",
2488− method: "GET",
2488+ method: http.MethodGet,
2489 regexString: "^/foo/bar",
2489 regexString: "^/foo/bar",
2492− method: "POST",
2492+ method: http.MethodPost,
2493 regexString: "^/baz/[0-9]+/thing",
2493 regexString: "^/baz/[0-9]+/thing",
@@ -2641,7 +2641,7 @@ func TestApiRoutes(t *testing.T) {
2642 for _, tc := range testCases {
2642 for _, tc := range testCases {
2643 t.Run(tc.name, func(t *testing.T) {
2643 t.Run(tc.name, func(t *testing.T) {
2644− req, err := http.NewRequest("GET", tc.url, nil)
2644+ req, err := http.NewRequest(http.MethodGet, tc.url, nil)
2645 req.Header.Set("Accept", tc.contentType)
2645 req.Header.Set("Accept", tc.contentType)
2646 assert.NoError(t, err)
2646 assert.NoError(t, err)
@@ -2679,9 +2679,11 @@ func TestAllowedRequest(t *testing.T) {
2680 opts.SkipAuthRegex = []string{
2680 opts.SkipAuthRegex = []string{
2681 "^/skip/auth/regex$",
2681 "^/skip/auth/regex$",
2682+ "^/public/.*/endpoint$",
2683 opts.SkipAuthRoutes = []string{
2684 opts.SkipAuthRoutes = []string{
2684 "GET=^/skip/auth/routes/get",
2685 "GET=^/skip/auth/routes/get",
2686 err := validation.Validate(opts)
2688 err := validation.Validate(opts)
2687 assert.NoError(t, err)
2689 assert.NoError(t, err)
@@ -2698,25 +2700,37 @@ func TestAllowedRequest(t *testing.T) {
2700 name: "Regex GET allowed",
2702 name: "Regex GET allowed",
2701− method: "GET",
2703+ method: http.MethodGet,
2702 url: "/skip/auth/regex",
2704 url: "/skip/auth/regex",
2703 allowed: true,
2705 allowed: true,
2706 name: "Regex POST allowed ",
2708 name: "Regex POST allowed ",
2707− method: "POST",
2709+ method: http.MethodPost,
2708 url: "/skip/auth/regex",
2710 url: "/skip/auth/regex",
2709 allowed: true,
2711 allowed: true,
2712 name: "Regex denied",
2714 name: "Regex denied",
2713− method: "GET",
2715+ method: http.MethodGet,
2714 url: "/wrong/denied",
2716 url: "/wrong/denied",
2715 allowed: false,
2717 allowed: false,
2720+ name: "Regex allowed with fragment-free path",
2721+ method: http.MethodGet,
2722+ url: "/public/legit/endpoint",
2726+ name: "Regex denied when path contains encoded fragment suffix",
2727+ method: http.MethodGet,
2728+ url: "/public/secret%23/endpoint",
2718 name: "Route allowed",
2732 name: "Route allowed",
2719− method: "GET",
2733+ method: http.MethodGet,
2720 url: "/skip/auth/routes/get",
2734 url: "/skip/auth/routes/get",
2721 allowed: true,
2735 allowed: true,
@@ -2728,16 +2742,28 @@ func TestAllowedRequest(t *testing.T) {
2730 name: "Route denied with wrong path",
2744 name: "Route denied with wrong path",
2731− method: "GET",
2745+ method: http.MethodGet,
2732 url: "/skip/auth/routes/wrong/path",
2746 url: "/skip/auth/routes/wrong/path",
2733 allowed: false,
2747 allowed: false,
2736 name: "Route denied with wrong path and method",
2750 name: "Route denied with wrong path and method",
2737− method: "POST",
2751+ method: http.MethodPost,
2738 url: "/skip/auth/routes/wrong/path",
2752 url: "/skip/auth/routes/wrong/path",
2739 allowed: false,
2753 allowed: false,
2756+ name: "Route allowed with fragment-free path",
2757+ method: http.MethodGet,
2758+ url: "/foo/public/bar",
2762+ name: "Route denied when path contains encoded fragment suffix",
2763+ method: http.MethodGet,
2764+ url: "/foo/secret%23/bar",
2743 for _, tc := range testCases {
2769 for _, tc := range testCases {
@@ -2778,9 +2804,11 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
2779 opts.SkipAuthRegex = []string{
2805 opts.SkipAuthRegex = []string{
2780 "^/skip/auth/regex$",
2806 "^/skip/auth/regex$",
2807+ "^/public/.*/endpoint$",
2782 opts.SkipAuthRoutes = []string{
2809 opts.SkipAuthRoutes = []string{
2783 "GET=^/skip/auth/routes/get",
2810 "GET=^/skip/auth/routes/get",
2785 err := validation.Validate(opts)
2813 err := validation.Validate(opts)
2786 assert.NoError(t, err)
2814 assert.NoError(t, err)
@@ -2797,25 +2825,37 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
2799 name: "Regex GET allowed",
2827 name: "Regex GET allowed",
2800− method: "GET",
2828+ method: http.MethodGet,
2801 url: "/skip/auth/regex",
2829 url: "/skip/auth/regex",
2802 allowed: true,
2830 allowed: true,
2805 name: "Regex POST allowed ",
2833 name: "Regex POST allowed ",
2806− method: "POST",
2834+ method: http.MethodPost,
2807 url: "/skip/auth/regex",
2835 url: "/skip/auth/regex",
2808 allowed: true,
2836 allowed: true,
2811 name: "Regex denied",
2839 name: "Regex denied",
2812− method: "GET",
2840+ method: http.MethodGet,
2813 url: "/wrong/denied",
2841 url: "/wrong/denied",
2814 allowed: false,
2842 allowed: false,
2845+ name: "Regex allowed with fragment-free path",
2846+ method: http.MethodGet,
2847+ url: "/public/legit/endpoint",
2851+ name: "Regex denied when X-Forwarded-Uri contains an encoded fragment suffix",
2852+ method: http.MethodGet,
2853+ url: "/public/secret%23/endpoint",
2817 name: "Route allowed",
2857 name: "Route allowed",
2818− method: "GET",
2858+ method: http.MethodGet,
2819 url: "/skip/auth/routes/get",
2859 url: "/skip/auth/routes/get",
2820 allowed: true,
2860 allowed: true,
@@ -2827,16 +2867,28 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
2829 name: "Route denied with wrong path",
2869 name: "Route denied with wrong path",
2830− method: "GET",
2870+ method: http.MethodGet,
2831 url: "/skip/auth/routes/wrong/path",
2871 url: "/skip/auth/routes/wrong/path",
2832 allowed: false,
2872 allowed: false,
2835 name: "Route denied with wrong path and method",
2875 name: "Route denied with wrong path and method",
2836− method: "POST",
2876+ method: http.MethodPost,
2837 url: "/skip/auth/routes/wrong/path",
2877 url: "/skip/auth/routes/wrong/path",
2838 allowed: false,
2878 allowed: false,
2881+ name: "Route allowed with fragment-free path",
2882+ method: http.MethodGet,
2883+ url: "/foo/public/bar",
2887+ name: "Route denied when X-Forwarded-Uri contains an encoded fragment suffix",
2888+ method: http.MethodGet,
2889+ url: "/foo/secret%23/bar",
2842 for _, tc := range testCases {
2894 for _, tc := range testCases {
@@ -2934,37 +2986,37 @@ func TestAllowedRequestNegateWithoutMethod(t *testing.T) {
2936 name: "Some static file allowed",
2988 name: "Some static file allowed",
2937− method: "GET",
2989+ method: http.MethodGet,
2938 url: "/static/file.txt",
2990 url: "/static/file.txt",
2939 allowed: true,
2991 allowed: true,
2942 name: "POST to contact form allowed",
2994 name: "POST to contact form allowed",
2943− method: "POST",
2995+ method: http.MethodPost,
2944 url: "/contact",
2996 url: "/contact",
2945 allowed: true,
2997 allowed: true,
2948 name: "Regex POST allowed",
3000 name: "Regex POST allowed",
2949− method: "POST",
3001+ method: http.MethodPost,
2950 url: "/api/public-entity",
3002 url: "/api/public-entity",
2951 allowed: true,
3003 allowed: true,
2954 name: "Regex POST with trailing slash allowed",
3006 name: "Regex POST with trailing slash allowed",
2955− method: "POST",
3007+ method: http.MethodPost,
2956 url: "/api/public-entity/",
3008 url: "/api/public-entity/",
2957 allowed: true,
3009 allowed: true,
2960 name: "Regex GET api route denied",
3012 name: "Regex GET api route denied",
2961− method: "GET",
3013+ method: http.MethodGet,
2962 url: "/api/users",
3014 url: "/api/users",
2963 allowed: false,
3015 allowed: false,
2966 name: "Regex POST api route denied",
3018 name: "Regex POST api route denied",
2967− method: "POST",
3019+ method: http.MethodPost,
2968 url: "/api/users",
3020 url: "/api/users",
2969 allowed: false,
3021 allowed: false,
@@ -3034,37 +3086,37 @@ func TestAllowedRequestNegateWithMethod(t *testing.T) {
3036 name: "Some static file allowed",
3088 name: "Some static file allowed",
3037− method: "GET",
3089+ method: http.MethodGet,
3038 url: "/static/file.txt",
3090 url: "/static/file.txt",
3039 allowed: true,
3091 allowed: true,
3042 name: "POST to contact form not allowed",
3094 name: "POST to contact form not allowed",
3043− method: "POST",
3095+ method: http.MethodPost,
3044 url: "/contact",
3096 url: "/contact",
3045 allowed: false,
3097 allowed: false,
3048 name: "Regex POST allowed",
3100 name: "Regex POST allowed",
3049− method: "POST",
3101+ method: http.MethodPost,
3050 url: "/api/public-entity",
3102 url: "/api/public-entity",
3051 allowed: true,
3103 allowed: true,
3054 name: "Regex POST with trailing slash allowed",
3106 name: "Regex POST with trailing slash allowed",
3055− method: "POST",
3107+ method: http.MethodPost,
3056 url: "/api/public-entity/",
3108 url: "/api/public-entity/",
3057 allowed: true,
3109 allowed: true,
3060 name: "Regex GET api route denied",
3112 name: "Regex GET api route denied",
3061− method: "GET",
3113+ method: http.MethodGet,
3062 url: "/api/users",
3114 url: "/api/users",
3063 allowed: false,
3115 allowed: false,
3066 name: "Regex POST api route denied",
3118 name: "Regex POST api route denied",
3067− method: "POST",
3119+ method: http.MethodPost,
3068 url: "/api/users",
3120 url: "/api/users",
3069 allowed: false,
3121 allowed: false,
@@ -3204,7 +3256,7 @@ func TestProxyAllowedGroups(t *testing.T) {
3204 t.Fatal(err)
3256 t.Fatal(err)
3207− test.req, _ = http.NewRequest("GET", fmt.Sprintf("/%s", tt.querystring), nil)
3259+ test.req, _ = http.NewRequest(http.MethodGet, fmt.Sprintf("/%s", tt.querystring), nil)
3209 test.req.Header.Add("accept", applicationJSON)
3261 test.req.Header.Add("accept", applicationJSON)
3210 err = test.SaveSession(session)
3262 err = test.SaveSession(session)
@@ -3348,7 +3400,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
3349 name: "UserWithGroupSkipAuthPreflight",
3401 name: "UserWithGroupSkipAuthPreflight",
3350 groups: []string{"a", "c"},
3402 groups: []string{"a", "c"},
3351− method: "OPTIONS",
3403+ method: http.MethodOptions,
3352 ip: "1.2.3.5:43670",
3404 ip: "1.2.3.5:43670",
3353 withSession: true,
3405 withSession: true,
3354 expectedStatusCode: http.StatusAccepted,
3406 expectedStatusCode: http.StatusAccepted,
@@ -3356,7 +3408,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
3357 name: "UserWithGroupTrustedIp",
3409 name: "UserWithGroupTrustedIp",
3358 groups: []string{"a", "c"},
3410 groups: []string{"a", "c"},
3359− method: "GET",
3411+ method: http.MethodGet,
3360 ip: "1.2.3.4:43670",
3412 ip: "1.2.3.4:43670",
3361 withSession: true,
3413 withSession: true,
3362 expectedStatusCode: http.StatusAccepted,
3414 expectedStatusCode: http.StatusAccepted,
@@ -3364,7 +3416,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
3365 name: "UserWithoutGroupSkipAuthPreflight",
3417 name: "UserWithoutGroupSkipAuthPreflight",
3366 groups: []string{"c"},
3418 groups: []string{"c"},
3367− method: "OPTIONS",
3419+ method: http.MethodOptions,
3368 ip: "1.2.3.5:43670",
3420 ip: "1.2.3.5:43670",
3369 withSession: true,
3421 withSession: true,
3370 expectedStatusCode: http.StatusForbidden,
3422 expectedStatusCode: http.StatusForbidden,
@@ -3372,21 +3424,21 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
3373 name: "UserWithoutGroupTrustedIp",
3425 name: "UserWithoutGroupTrustedIp",
3374 groups: []string{"c"},
3426 groups: []string{"c"},
3375− method: "GET",
3427+ method: http.MethodGet,
3376 ip: "1.2.3.4:43670",
3428 ip: "1.2.3.4:43670",
3377 withSession: true,
3429 withSession: true,
3378 expectedStatusCode: http.StatusForbidden,
3430 expectedStatusCode: http.StatusForbidden,
3381 name: "UserWithoutSessionSkipAuthPreflight",
3433 name: "UserWithoutSessionSkipAuthPreflight",
3382− method: "OPTIONS",
3434+ method: http.MethodOptions,
3383 ip: "1.2.3.5:43670",
3435 ip: "1.2.3.5:43670",
3384 withSession: false,
3436 withSession: false,
3385 expectedStatusCode: http.StatusAccepted,
3437 expectedStatusCode: http.StatusAccepted,
3388 name: "UserWithoutSessionTrustedIp",
3440 name: "UserWithoutSessionTrustedIp",
3389− method: "GET",
3441+ method: http.MethodGet,
3390 ip: "1.2.3.4:43670",
3442 ip: "1.2.3.4:43670",
3391 withSession: false,
3443 withSession: false,
3392 expectedStatusCode: http.StatusAccepted,
3444 expectedStatusCode: http.StatusAccepted,
@@ -3738,14 +3790,14 @@ func TestIdTokenPlaceholderInSignOut(t *testing.T) {
3739 // Save the required session
3791 // Save the required session
3740 rw := httptest.NewRecorder()
3792 rw := httptest.NewRecorder()
3741− req, _ := http.NewRequest("GET", "/", nil)
3793+ req, _ := http.NewRequest(http.MethodGet, "/", nil)
3742 err = proxy.sessionStore.Save(rw, req, session)
3794 err = proxy.sessionStore.Save(rw, req, session)
3743 assert.NoError(t, err)
3795 assert.NoError(t, err)
3745 rw = httptest.NewRecorder()
3797 rw = httptest.NewRecorder()
3747 rdUrl := url.QueryEscape("https://my-oidc-provider.example.com/sign_out_page?id_token_hint={id_token}&post_logout_redirect_uri=https://my-app.example.com/")
3799 rdUrl := url.QueryEscape("https://my-oidc-provider.example.com/sign_out_page?id_token_hint={id_token}&post_logout_redirect_uri=https://my-app.example.com/")
3748− req, _ = http.NewRequest("GET", "/oauth2/sign_out?rd="+rdUrl, nil)
3800+ req, _ = http.NewRequest(http.MethodGet, "/oauth2/sign_out?rd="+rdUrl, nil)
3749 req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{
3801 req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{
3750 RequestID: "11111111-2222-4333-8444-555555555555",
3802 RequestID: "11111111-2222-4333-8444-555555555555",
3751 Session: session,
3803 Session: session,