git.iko.soy/typeable/oauth2-proxy
on 8102f63 help sign in
20d4e9c
swap
7 ahead, 1335 behind
docs/configuration/configuration.md+1
since splitsnapshots
unifiedsplit
@@ -88,6 +88,7 @@ An example [oauth2-proxy.cfg]({{ site.gitweb }}/contrib/oauth2-proxy.cfg.example
88| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
88| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
89| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
89| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
90| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
90| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
91+| `--proxy-time-out` | duration | timeout for upstream proxy | `"30s"` |
91| `--proxy-websockets` | bool | enables WebSocket proxying | true |
92| `--proxy-websockets` | bool | enables WebSocket proxying | true |
92| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
93| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
93| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
94| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
oauthproxy.go+13
@@ -148,6 +148,19 @@ func (u *UpstreamProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
148// servers
148// servers
149func NewReverseProxy(target *url.URL, opts *options.Options) (proxy *httputil.ReverseProxy) {
149func NewReverseProxy(target *url.URL, opts *options.Options) (proxy *httputil.ReverseProxy) {
150 proxy = httputil.NewSingleHostReverseProxy(target)
150 proxy = httputil.NewSingleHostReverseProxy(target)
151+ // Settings from net/http DefaultTransport except timeout
152+ proxy.Transport = &http.Transport{
153+ Proxy: http.ProxyFromEnvironment,
154+ DialContext: (&net.Dialer{
155+ Timeout: opts.ProxyTimeOut,
156+ KeepAlive: 30 * time.Second,
157+ DualStack: true,
158+ }).DialContext,
159+ MaxIdleConns: 100,
160+ IdleConnTimeout: 90 * time.Second,
161+ TLSHandshakeTimeout: 10 * time.Second,
162+ ExpectContinueTimeout: 1 * time.Second,
163+ }
151 proxy.FlushInterval = opts.FlushInterval
164 proxy.FlushInterval = opts.FlushInterval
152 if opts.SSLUpstreamInsecureSkipVerify {
165 if opts.SSLUpstreamInsecureSkipVerify {
153 proxy.Transport = &http.Transport{
166 proxy.Transport = &http.Transport{
pkg/apis/options/options.go+16−14
@@ -23,20 +23,21 @@ type SignatureData struct {
23// Options holds Configuration Options that can be set by Command Line Flag,
23// Options holds Configuration Options that can be set by Command Line Flag,
24// or Config File
24// or Config File
25type Options struct {
25type Options struct {
26− ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix"`
26+ ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix"`
27− PingPath string `flag:"ping-path" cfg:"ping_path"`
27+ PingPath string `flag:"ping-path" cfg:"ping_path"`
28− ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets"`
28+ ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets"`
29− HTTPAddress string `flag:"http-address" cfg:"http_address"`
29+ HTTPAddress string `flag:"http-address" cfg:"http_address"`
30− HTTPSAddress string `flag:"https-address" cfg:"https_address"`
30+ HTTPSAddress string `flag:"https-address" cfg:"https_address"`
31− ReverseProxy bool `flag:"reverse-proxy" cfg:"reverse_proxy"`
31+ ReverseProxy bool `flag:"reverse-proxy" cfg:"reverse_proxy"`
32− RealClientIPHeader string `flag:"real-client-ip-header" cfg:"real_client_ip_header"`
32+ RealClientIPHeader string `flag:"real-client-ip-header" cfg:"real_client_ip_header"`
33− ForceHTTPS bool `flag:"force-https" cfg:"force_https"`
33+ ForceHTTPS bool `flag:"force-https" cfg:"force_https"`
34− RawRedirectURL string `flag:"redirect-url" cfg:"redirect_url"`
34+ RawRedirectURL string `flag:"redirect-url" cfg:"redirect_url"`
35− ClientID string `flag:"client-id" cfg:"client_id"`
35+ ClientID string `flag:"client-id" cfg:"client_id"`
36− ClientSecret string `flag:"client-secret" cfg:"client_secret"`
36+ ClientSecret string `flag:"client-secret" cfg:"client_secret"`
37− ClientSecretFile string `flag:"client-secret-file" cfg:"client_secret_file"`
37+ ClientSecretFile string `flag:"client-secret-file" cfg:"client_secret_file"`
38− TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file"`
38+ TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file"`
39− TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file"`
39+ TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file"`
40+ ProxyTimeOut time.Duration `flag:"proxy-time-out" cfg:"proxy_time_out"`
40
41
41 AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file"`
42 AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file"`
42 KeycloakGroup string `flag:"keycloak-group" cfg:"keycloak_group"`
43 KeycloakGroup string `flag:"keycloak-group" cfg:"keycloak_group"`
@@ -166,6 +167,7 @@ func NewOptions() *Options {
166 ProxyWebSockets: true,
167 ProxyWebSockets: true,
167 HTTPAddress: "127.0.0.1:4180",
168 HTTPAddress: "127.0.0.1:4180",
168 HTTPSAddress: ":443",
169 HTTPSAddress: ":443",
170+ ProxyTimeOut: time.Duration(30) * time.Second,
169 RealClientIPHeader: "X-Real-IP",
171 RealClientIPHeader: "X-Real-IP",
170 ForceHTTPS: false,
172 ForceHTTPS: false,
171 DisplayHtpasswdForm: true,
173 DisplayHtpasswdForm: true,
pkg/validation/options_test.go+8
@@ -140,6 +140,14 @@ func TestRedirectURL(t *testing.T) {
140 assert.Equal(t, expected, o.GetRedirectURL())
140 assert.Equal(t, expected, o.GetRedirectURL())
141}
141}
142
142
143+func TestProxyTimeOut(t *testing.T) {
144+ o := testOptions()
145+ o.ProxyTimeOut = 40 * time.Second
146+ assert.Equal(t, nil, Validate(o))
147+ expected := 40 * time.Second
148+ assert.Equal(t, expected, o.ProxyTimeOut)
149+}
150+
143func TestProxyURLs(t *testing.T) {
151func TestProxyURLs(t *testing.T) {
144 o := testOptions()
152 o := testOptions()
145 o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8081")
153 o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8081")