git.iko.soy/typeable/oauth2-proxy
on 59da013 help sign in
20d4e9c
swap
9 ahead, 1335 behind
5 files changed+40−14
since splitsnapshots
unifiedsplit
CHANGELOG.md+1 docs/configuration/configuration.md+1 oauthproxy.go+13 pkg/apis/options/options.go+17−14 pkg/validation/options_test.go+8
CHANGELOG.md+1
@@ -51,6 +51,7 @@
5151
5252## Changes since v5.1.1
5353
54+- [#583](https://github.com/oauth2-proxy/oauth2-proxy/pull/583) Add configurable proxy timeout (@RO-29, @TeroPihlaja)
5455- [#574](https://github.com/oauth2-proxy/oauth2-proxy/pull/574) render error page on 502 proxy status (@amnay-mo)
5556- [#559](https://github.com/oauth2-proxy/oauth2-proxy/pull/559) Rename cookie-domain config to cookie-domains (@JoelSpeed)
5657- [#569](https://github.com/oauth2-proxy/oauth2-proxy/pull/569) Updated autocompletion for `--` long options. (@Izzette)
docs/configuration/configuration.md+1
@@ -88,6 +88,7 @@ An example [oauth2-proxy.cfg]({{ site.gitweb }}/contrib/oauth2-proxy.cfg.example
8888| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
8989| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
9090| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
91+| `--proxy-time-out` | duration | timeout for upstream proxy | `"30s"` |
9192| `--proxy-websockets` | bool | enables WebSocket proxying | true |
9293| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
9394| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
oauthproxy.go+13
@@ -148,6 +148,19 @@ func (u *UpstreamProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
148148// servers
149149func NewReverseProxy(target *url.URL, opts *options.Options) (proxy *httputil.ReverseProxy) {
150150 proxy = httputil.NewSingleHostReverseProxy(target)
151+ // Settings from net/http DefaultTransport except timeout
152+ proxy.Transport = &http.Transport{
153+ Proxy: http.ProxyFromEnvironment,
154+ DialContext: (&net.Dialer{
155+ Timeout: opts.ProxyTimeOut,
156+ KeepAlive: 30 * time.Second,
157+ DualStack: true,
158+ }).DialContext,
159+ MaxIdleConns: 100,
160+ IdleConnTimeout: 90 * time.Second,
161+ TLSHandshakeTimeout: 10 * time.Second,
162+ ExpectContinueTimeout: 1 * time.Second,
163+ }
151164 proxy.FlushInterval = opts.FlushInterval
152165 if opts.SSLUpstreamInsecureSkipVerify {
153166 proxy.Transport = &http.Transport{
pkg/apis/options/options.go+17−14
@@ -23,20 +23,21 @@ type SignatureData struct {
2323// Options holds Configuration Options that can be set by Command Line Flag,
2424// or Config File
2525type Options struct {
26− ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix"`
27− PingPath string `flag:"ping-path" cfg:"ping_path"`
28− ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets"`
29− HTTPAddress string `flag:"http-address" cfg:"http_address"`
30− HTTPSAddress string `flag:"https-address" cfg:"https_address"`
31− ReverseProxy bool `flag:"reverse-proxy" cfg:"reverse_proxy"`
32− RealClientIPHeader string `flag:"real-client-ip-header" cfg:"real_client_ip_header"`
33− ForceHTTPS bool `flag:"force-https" cfg:"force_https"`
34− RawRedirectURL string `flag:"redirect-url" cfg:"redirect_url"`
35− ClientID string `flag:"client-id" cfg:"client_id"`
36− ClientSecret string `flag:"client-secret" cfg:"client_secret"`
37− ClientSecretFile string `flag:"client-secret-file" cfg:"client_secret_file"`
38− TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file"`
39− TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file"`
26+ ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix"`
27+ PingPath string `flag:"ping-path" cfg:"ping_path"`
28+ ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets"`
29+ HTTPAddress string `flag:"http-address" cfg:"http_address"`
30+ HTTPSAddress string `flag:"https-address" cfg:"https_address"`
31+ ReverseProxy bool `flag:"reverse-proxy" cfg:"reverse_proxy"`
32+ RealClientIPHeader string `flag:"real-client-ip-header" cfg:"real_client_ip_header"`
33+ ForceHTTPS bool `flag:"force-https" cfg:"force_https"`
34+ RawRedirectURL string `flag:"redirect-url" cfg:"redirect_url"`
35+ ClientID string `flag:"client-id" cfg:"client_id"`
36+ ClientSecret string `flag:"client-secret" cfg:"client_secret"`
37+ ClientSecretFile string `flag:"client-secret-file" cfg:"client_secret_file"`
38+ TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file"`
39+ TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file"`
40+ ProxyTimeOut time.Duration `flag:"proxy-time-out" cfg:"proxy_time_out"`
4041
4142 AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file"`
4243 KeycloakGroup string `flag:"keycloak-group" cfg:"keycloak_group"`
@@ -166,6 +167,7 @@ func NewOptions() *Options {
166167 ProxyWebSockets: true,
167168 HTTPAddress: "127.0.0.1:4180",
168169 HTTPSAddress: ":443",
170+ ProxyTimeOut: time.Duration(30) * time.Second,
169171 RealClientIPHeader: "X-Real-IP",
170172 ForceHTTPS: false,
171173 DisplayHtpasswdForm: true,
@@ -243,6 +245,7 @@ func NewFlagSet() *pflag.FlagSet {
243245 flagSet.Bool("ssl-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS providers")
244246 flagSet.Bool("ssl-upstream-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS upstreams")
245247 flagSet.Duration("flush-interval", time.Duration(1)*time.Second, "period between response flushing when streaming responses")
248+ flagSet.Duration("proxy-time-out", time.Duration(30)*time.Second, "timeout for upstream proxy")
246249 flagSet.Bool("skip-jwt-bearer-tokens", false, "will skip requests that have verified JWT bearer tokens (default false)")
247250 flagSet.StringSlice("extra-jwt-issuers", []string{}, "if skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)")
248251
pkg/validation/options_test.go+8
@@ -140,6 +140,14 @@ func TestRedirectURL(t *testing.T) {
140140 assert.Equal(t, expected, o.GetRedirectURL())
141141}
142142
143+func TestProxyTimeOut(t *testing.T) {
144+ o := testOptions()
145+ o.ProxyTimeOut = 40 * time.Second
146+ assert.Equal(t, nil, Validate(o))
147+ expected := 40 * time.Second
148+ assert.Equal(t, expected, o.ProxyTimeOut)
149+}
150+
143151func TestProxyURLs(t *testing.T) {
144152 o := testOptions()
145153 o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8081")