@@ -15,7 +15,6 @@ import (
1515 "time"
1616
1717 "github.com/coreos/go-oidc/v3/oidc"
18− middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
1918 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
2019 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
2120 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/authentication/hmacauth"
@@ -24,7 +23,6 @@ import (
2423 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
2524 sessionscookie "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/sessions/cookie"
2625 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/upstream"
27− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
2826 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/validation"
2927 "github.com/oauth2-proxy/oauth2-proxy/v7/providers"
3028 "github.com/stretchr/testify/assert"
@@ -54,7 +52,7 @@ func TestRobotsTxt(t *testing.T) {
5452 t.Fatal(err)
5553 }
5654 rw := httptest.NewRecorder()
57− req, _ := http.NewRequest(http.MethodGet, "/robots.txt", nil)
55+ req, _ := http.NewRequest("GET", "/robots.txt", nil)
5856 proxy.ServeHTTP(rw, req)
5957 assert.Equal(t, 200, rw.Code)
6058 assert.Equal(t, "User-agent: *\nDisallow: /\n", rw.Body.String())
@@ -241,7 +239,7 @@ func TestBasicAuthPassword(t *testing.T) {
241239
242240 // Save the required session
243241 rw := httptest.NewRecorder()
244− req, _ := http.NewRequest(http.MethodGet, "/", nil)
242+ req, _ := http.NewRequest("GET", "/", nil)
245243 err = proxy.sessionStore.Save(rw, req, &sessions.SessionState{
246244 Email: emailAddress,
247245 })
@@ -250,7 +248,7 @@ func TestBasicAuthPassword(t *testing.T) {
250248 // Extract the cookie value to inject into the test request
251249 cookie := rw.Header().Values("Set-Cookie")[0]
252250
253− req, _ = http.NewRequest(http.MethodGet, "/", nil)
251+ req, _ = http.NewRequest("GET", "/", nil)
254252 req.Header.Set("Cookie", cookie)
255253 rw = httptest.NewRecorder()
256254 proxy.ServeHTTP(rw, req)
@@ -300,14 +298,14 @@ func TestPassGroupsHeadersWithGroups(t *testing.T) {
300298
301299 // Save the required session
302300 rw := httptest.NewRecorder()
303− req, _ := http.NewRequest(http.MethodGet, "/", nil)
301+ req, _ := http.NewRequest("GET", "/", nil)
304302 err = proxy.sessionStore.Save(rw, req, session)
305303 assert.NoError(t, err)
306304
307305 // Extract the cookie value to inject into the test request
308306 cookie := rw.Header().Values("Set-Cookie")[0]
309307
310− req, _ = http.NewRequest(http.MethodGet, "/", nil)
308+ req, _ = http.NewRequest("GET", "/", nil)
311309 req.Header.Set("Cookie", cookie)
312310 rw = httptest.NewRecorder()
313311 proxy.ServeHTTP(rw, req)
@@ -457,7 +455,7 @@ func (patTest *PassAccessTokenTest) getEndpointWithCookie(cookie string, endpoin
457455 return 0, ""
458456 }
459457
460− req, err := http.NewRequest(http.MethodGet, endpoint, strings.NewReader(""))
458+ req, err := http.NewRequest("GET", endpoint, strings.NewReader(""))
461459 if err != nil {
462460 return 0, ""
463461 }
@@ -508,7 +506,7 @@ func TestStaticProxyUpstream(t *testing.T) {
508506 ProxyUpstream: options.Upstream{
509507 ID: "static-proxy",
510508 Path: "/static-proxy",
511− Static: ptr.To(true),
509+ Static: true,
512510 },
513511 })
514512 if err != nil {
@@ -608,7 +606,7 @@ func NewSignInPageTest(skipProvider bool) (*SignInPageTest, error) {
608606
609607func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
610608 rw := httptest.NewRecorder()
611− req, _ := http.NewRequest(http.MethodGet, endpoint, strings.NewReader(""))
609+ req, _ := http.NewRequest("GET", endpoint, strings.NewReader(""))
612610 sipTest.proxy.ServeHTTP(rw, req)
613611 return rw.Code, rw.Body.String()
614612}
@@ -713,50 +711,6 @@ func TestManualSignInCorrectCredentials(t *testing.T) {
713711 assert.Equal(t, http.StatusFound, statusCode)
714712}
715713
716−func TestSignInPageClearsExistingSessionCookie(t *testing.T) {
717− opts := baseTestOptions()
718− err := validation.Validate(opts)
719− require.NoError(t, err)
720−
721− proxy, err := NewOAuthProxy(opts, func(string) bool {
722− return true
723− })
724− require.NoError(t, err)
725−
726− // Create a real session cookie using the actual session store.
727− saveRW := httptest.NewRecorder()
728− saveReq := httptest.NewRequest(http.MethodGet, "/", nil)
729− err = proxy.sessionStore.Save(saveRW, saveReq, &sessions.SessionState{
730− Email: "john.doe@example.com",
731− })
732− require.NoError(t, err)
733−
734− cookies := saveRW.Result().Cookies()
735− require.NotEmpty(t, cookies)
736−
737− // Send that cookie to the sign-in page.
738− req := httptest.NewRequest(http.MethodGet, "/oauth2/sign_in", nil)
739− for _, c := range cookies {
740− req.AddCookie(c)
741− }
742−
743− rw := httptest.NewRecorder()
744− proxy.ServeHTTP(rw, req)
745−
746− assert.Equal(t, http.StatusOK, rw.Code)
747−
748− cleared := false
749− for _, c := range rw.Result().Cookies() {
750− if c.Name == proxy.CookieOptions.Name {
751− cleared = true
752− assert.Equal(t, "", c.Value)
753− assert.Less(t, c.MaxAge, 0)
754− }
755− }
756−
757− assert.True(t, cleared, "expected sign-in page to clear existing session cookie")
758−}
759−
760714func TestSignInPageIncludesTargetRedirect(t *testing.T) {
761715 sipTest, err := NewSignInPageTest(false)
762716 if err != nil {
@@ -894,7 +848,7 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifi
894848 // access_token validation.
895849 pcTest.proxy.CookieOptions.Refresh = time.Duration(0)
896850 pcTest.rw = httptest.NewRecorder()
897− pcTest.req, _ = http.NewRequest(http.MethodGet, "/", strings.NewReader(""))
851+ pcTest.req, _ = http.NewRequest("GET", "/", strings.NewReader(""))
898852 pcTest.validateUser = true
899853 return &pcTest, nil
900854}
@@ -1027,7 +981,7 @@ func NewUserInfoEndpointTest() (*ProcessCookieTest, error) {
1027981 if err != nil {
1028982 return nil, err
1029983 }
1030− pcTest.req, _ = http.NewRequest(http.MethodGet,
984+ pcTest.req, _ = http.NewRequest("GET",
1031985 pcTest.opts.ProxyPrefix+"/userinfo", nil)
1032986 return pcTest, nil
1033987}
@@ -1077,20 +1031,6 @@ func TestUserInfoEndpointAccepted(t *testing.T) {
10771031 },
10781032 expectedResponse: "{\"user\":\"john.doe\",\"email\":\"john.doe@example.com\",\"groups\":[\"example\",\"groups\"],\"preferredUsername\":\"john\"}\n",
10791033 },
1080− {
1081− name: "With Additional Claim",
1082− session: &sessions.SessionState{
1083− User: "john.doe",
1084− PreferredUsername: "john",
1085− Email: "john.doe@example.com",
1086− Groups: []string{"example", "groups"},
1087− AccessToken: "my_access_token",
1088− AdditionalClaims: map[string]interface{}{
1089− "foo": "bar",
1090− },
1091− },
1092− expectedResponse: "{\"user\":\"john.doe\",\"email\":\"john.doe@example.com\",\"groups\":[\"example\",\"groups\"],\"preferredUsername\":\"john\",\"additionalClaims\":{\"foo\":\"bar\"}}\n",
1093− },
10941034 }
10951035
10961036 for _, tc := range testCases {
@@ -1135,7 +1075,7 @@ func NewAuthOnlyEndpointTest(querystring string, modifiers ...OptionsModifier) (
11351075 return nil, err
11361076 }
11371077 pcTest.req, _ = http.NewRequest(
1138− http.MethodGet,
1078+ "GET",
11391079 fmt.Sprintf("%s/auth%s", pcTest.opts.ProxyPrefix, querystring),
11401080 nil)
11411081 return pcTest, nil
@@ -1274,7 +1214,7 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
12741214 pcTest.validateUser = true
12751215
12761216 pcTest.rw = httptest.NewRecorder()
1277− pcTest.req, _ = http.NewRequest(http.MethodGet,
1217+ pcTest.req, _ = http.NewRequest("GET",
12781218 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
12791219
12801220 created := time.Now()
@@ -1367,7 +1307,7 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
13671307 pcTest.validateUser = true
13681308
13691309 pcTest.rw = httptest.NewRecorder()
1370− pcTest.req, _ = http.NewRequest(http.MethodGet,
1310+ pcTest.req, _ = http.NewRequest("GET",
13711311 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
13721312
13731313 created := time.Now()
@@ -1447,7 +1387,7 @@ func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
14471387 pcTest.validateUser = true
14481388
14491389 pcTest.rw = httptest.NewRecorder()
1450− pcTest.req, _ = http.NewRequest(http.MethodGet,
1390+ pcTest.req, _ = http.NewRequest("GET",
14511391 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
14521392
14531393 created := time.Now()
@@ -1495,7 +1435,7 @@ func TestAuthSkippedForPreflightRequests(t *testing.T) {
14951435 }
14961436 proxy.provider = NewTestProvider(upstreamURL, "")
14971437 rw := httptest.NewRecorder()
1498− req, _ := http.NewRequest(http.MethodOptions, "/preflight-request", nil)
1438+ req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)
14991439 proxy.ServeHTTP(rw, req)
15001440
15011441 assert.Equal(t, 200, rw.Code)
@@ -1652,19 +1592,19 @@ func TestRequestSignature(t *testing.T) {
16521592 resp string
16531593 }{
16541594 "No request signature": {
1655− method: http.MethodGet,
1595+ method: "GET",
16561596 body: "",
16571597 key: "",
16581598 resp: "no signature received",
16591599 },
16601600 "Get request": {
1661− method: http.MethodGet,
1601+ method: "GET",
16621602 body: "",
16631603 key: "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d",
16641604 resp: "signatures match",
16651605 },
16661606 "Post request": {
1667− method: http.MethodPost,
1607+ method: "POST",
16681608 body: `{ "hello": "world!" }`,
16691609 key: "d90df39e2d19282840252612dd7c81421a372f61",
16701610 resp: "signatures match",
@@ -2087,44 +2027,6 @@ func Test_noCacheHeaders(t *testing.T) {
20872027 })
20882028}
20892029
2090−func TestSignOutCallsBackendLogoutURL(t *testing.T) {
2091− const testIDToken = "test-id-token-12345"
2092− var receivedURL string
2093− backendLogoutServer := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
2094− receivedURL = req.URL.String()
2095− rw.WriteHeader(http.StatusOK)
2096− }))
2097− defer backendLogoutServer.Close()
2098−
2099− opts := baseTestOptions()
2100− opts.Providers[0].BackendLogoutURL = backendLogoutServer.URL + "/logout?id_token_hint={id_token}"
2101− err := validation.Validate(opts)
2102− require.NoError(t, err)
2103−
2104− proxy, err := NewOAuthProxy(opts, func(string) bool { return true })
2105− require.NoError(t, err)
2106−
2107− // Save a session with IDToken so backend logout can use it
2108− rw := httptest.NewRecorder()
2109− req := httptest.NewRequest(http.MethodGet, "/", nil)
2110− err = proxy.sessionStore.Save(rw, req, &sessions.SessionState{
2111− Email: "user@example.com",
2112− IDToken: testIDToken,
2113− })
2114− require.NoError(t, err)
2115− cookie := rw.Header().Values("Set-Cookie")[0]
2116−
2117− // Hit sign_out with the session cookie; backend logout should be called before session is cleared
2118− signOutReq := httptest.NewRequest(http.MethodGet, "/oauth2/sign_out", nil)
2119− signOutReq.Header.Set("Cookie", cookie)
2120− rec := httptest.NewRecorder()
2121− proxy.ServeHTTP(rec, signOutReq)
2122−
2123− assert.Equal(t, http.StatusFound, rec.Code, "sign_out should redirect")
2124− assert.Contains(t, receivedURL, "id_token_hint="+testIDToken,
2125− "backend logout URL should have been called with id_token from session")
2126−}
2127−
21282030func baseTestOptions() *options.Options {
21292031 opts := options.NewOptions()
21302032 opts.Cookie.Secret = rawCookieSecret
@@ -2189,33 +2091,7 @@ func TestTrustedIPs(t *testing.T) {
21892091 reverseProxy: false,
21902092 realClientIPHeader: "X-Real-IP", // Default value
21912093 req: func() *http.Request {
2192− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2193− return req
2194− }(),
2195− expectTrusted: false,
2196− },
2197− // Check Unix socket with no trusted IPs configured does not error.
2198− {
2199− name: "UnixSocketWithoutTrustedIPs",
2200− trustedIPs: nil,
2201− reverseProxy: false,
2202− realClientIPHeader: "X-Real-IP",
2203− req: func() *http.Request {
2204− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2205− req.RemoteAddr = "@"
2206− return req
2207− }(),
2208− expectTrusted: false,
2209− },
2210− // Check Unix socket with trusted IPs configured returns false (no IP to match).
2211− {
2212− name: "UnixSocketWithTrustedIPs",
2213− trustedIPs: []string{"127.0.0.1"},
2214− reverseProxy: false,
2215− realClientIPHeader: "X-Real-IP",
2216− req: func() *http.Request {
2217− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2218− req.RemoteAddr = "@"
2094+ req, _ := http.NewRequest("GET", "/", nil)
22192095 return req
22202096 }(),
22212097 expectTrusted: false,
@@ -2227,7 +2103,7 @@ func TestTrustedIPs(t *testing.T) {
22272103 reverseProxy: false,
22282104 realClientIPHeader: "X-Real-IP", // Default value
22292105 req: func() *http.Request {
2230− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2106+ req, _ := http.NewRequest("GET", "/", nil)
22312107 req.RemoteAddr = "127.0.0.1:43670"
22322108 return req
22332109 }(),
@@ -2240,7 +2116,7 @@ func TestTrustedIPs(t *testing.T) {
22402116 reverseProxy: true,
22412117 realClientIPHeader: "X-Real-IP", // Default value
22422118 req: func() *http.Request {
2243− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2119+ req, _ := http.NewRequest("GET", "/", nil)
22442120 req.RemoteAddr = "127.0.0.1:44324"
22452121 return req
22462122 }(),
@@ -2253,7 +2129,7 @@ func TestTrustedIPs(t *testing.T) {
22532129 reverseProxy: true,
22542130 realClientIPHeader: "X-Forwarded-For",
22552131 req: func() *http.Request {
2256− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2132+ req, _ := http.NewRequest("GET", "/", nil)
22572133 req.Header.Add("X-Forwarded-For", "127.0.0.1")
22582134 return req
22592135 }(),
@@ -2266,7 +2142,7 @@ func TestTrustedIPs(t *testing.T) {
22662142 reverseProxy: true,
22672143 realClientIPHeader: "X-Forwarded-For",
22682144 req: func() *http.Request {
2269− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2145+ req, _ := http.NewRequest("GET", "/", nil)
22702146 req.Header.Add("X-Forwarded-For", "::1")
22712147 return req
22722148 }(),
@@ -2279,7 +2155,7 @@ func TestTrustedIPs(t *testing.T) {
22792155 reverseProxy: true,
22802156 realClientIPHeader: "X-Forwarded-For",
22812157 req: func() *http.Request {
2282− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2158+ req, _ := http.NewRequest("GET", "/", nil)
22832159 req.Header.Add("X-Forwarded-For", "12.34.56.78")
22842160 return req
22852161 }(),
@@ -2292,7 +2168,7 @@ func TestTrustedIPs(t *testing.T) {
22922168 reverseProxy: true,
22932169 realClientIPHeader: "X-Forwarded-For",
22942170 req: func() *http.Request {
2295− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2171+ req, _ := http.NewRequest("GET", "/", nil)
22962172 req.Header.Add("X-Forwarded-For", "::2")
22972173 return req
22982174 }(),
@@ -2305,7 +2181,7 @@ func TestTrustedIPs(t *testing.T) {
23052181 reverseProxy: true,
23062182 realClientIPHeader: "X-Forwarded-For",
23072183 req: func() *http.Request {
2308− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2184+ req, _ := http.NewRequest("GET", "/", nil)
23092185 req.Header.Add("X-Real-IP", "::1")
23102186 return req
23112187 }(),
@@ -2318,7 +2194,7 @@ func TestTrustedIPs(t *testing.T) {
23182194 reverseProxy: true,
23192195 realClientIPHeader: "X-Forwarded-For",
23202196 req: func() *http.Request {
2321− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2197+ req, _ := http.NewRequest("GET", "/", nil)
23222198 req.Header.Add("X-Forwarded-For", "adsfljk29242as!!")
23232199 return req
23242200 }(),
@@ -2331,7 +2207,7 @@ func TestTrustedIPs(t *testing.T) {
23312207 reverseProxy: false,
23322208 realClientIPHeader: "X-Real-IP",
23332209 req: func() *http.Request {
2334− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2210+ req, _ := http.NewRequest("GET", "/", nil)
23352211 req.RemoteAddr = "adsfljk29242as!!"
23362212 return req
23372213 }(),
@@ -2347,7 +2223,7 @@ func TestTrustedIPs(t *testing.T) {
23472223 {
23482224 ID: "static",
23492225 Path: "/",
2350− Static: ptr.To(true),
2226+ Static: true,
23512227 },
23522228 },
23532229 }
@@ -2427,12 +2303,12 @@ func Test_buildRoutesAllowlist(t *testing.T) {
24272303 },
24282304 expectedRoutes: []expectedAllowedRoute{
24292305 {
2430− method: http.MethodGet,
2306+ method: "GET",
24312307 negate: false,
24322308 regexString: "^/foo/bar",
24332309 },
24342310 {
2435− method: http.MethodPost,
2311+ method: "POST",
24362312 negate: false,
24372313 regexString: "^/baz/[0-9]+/thing",
24382314 },
@@ -2485,11 +2361,11 @@ func Test_buildRoutesAllowlist(t *testing.T) {
24852361 regexString: "^/baz/[0-9]+/thing/regex",
24862362 },
24872363 {
2488− method: http.MethodGet,
2364+ method: "GET",
24892365 regexString: "^/foo/bar",
24902366 },
24912367 {
2492− method: http.MethodPost,
2368+ method: "POST",
24932369 regexString: "^/baz/[0-9]+/thing",
24942370 },
24952371 {
@@ -2641,7 +2517,7 @@ func TestApiRoutes(t *testing.T) {
26412517
26422518 for _, tc := range testCases {
26432519 t.Run(tc.name, func(t *testing.T) {
2644− req, err := http.NewRequest(http.MethodGet, tc.url, nil)
2520+ req, err := http.NewRequest("GET", tc.url, nil)
26452521 req.Header.Set("Accept", tc.contentType)
26462522 assert.NoError(t, err)
26472523
@@ -2679,11 +2555,9 @@ func TestAllowedRequest(t *testing.T) {
26792555 }
26802556 opts.SkipAuthRegex = []string{
26812557 "^/skip/auth/regex$",
2682− "^/public/.*/endpoint$",
26832558 }
26842559 opts.SkipAuthRoutes = []string{
26852560 "GET=^/skip/auth/routes/get",
2686− "^/foo/.*/bar$",
26872561 }
26882562 err := validation.Validate(opts)
26892563 assert.NoError(t, err)
@@ -2700,37 +2574,25 @@ func TestAllowedRequest(t *testing.T) {
27002574 }{
27012575 {
27022576 name: "Regex GET allowed",
2703− method: http.MethodGet,
2577+ method: "GET",
27042578 url: "/skip/auth/regex",
27052579 allowed: true,
27062580 },
27072581 {
27082582 name: "Regex POST allowed ",
2709− method: http.MethodPost,
2583+ method: "POST",
27102584 url: "/skip/auth/regex",
27112585 allowed: true,
27122586 },
27132587 {
27142588 name: "Regex denied",
2715− method: http.MethodGet,
2589+ method: "GET",
27162590 url: "/wrong/denied",
27172591 allowed: false,
27182592 },
2719− {
2720− name: "Regex allowed with fragment-free path",
2721− method: http.MethodGet,
2722− url: "/public/legit/endpoint",
2723− allowed: true,
2724− },
2725− {
2726− name: "Regex denied when path contains encoded fragment suffix",
2727− method: http.MethodGet,
2728− url: "/public/secret%23/endpoint",
2729− allowed: false,
2730− },
27312593 {
27322594 name: "Route allowed",
2733− method: http.MethodGet,
2595+ method: "GET",
27342596 url: "/skip/auth/routes/get",
27352597 allowed: true,
27362598 },
@@ -2742,28 +2604,16 @@ func TestAllowedRequest(t *testing.T) {
27422604 },
27432605 {
27442606 name: "Route denied with wrong path",
2745− method: http.MethodGet,
2607+ method: "GET",
27462608 url: "/skip/auth/routes/wrong/path",
27472609 allowed: false,
27482610 },
27492611 {
27502612 name: "Route denied with wrong path and method",
2751− method: http.MethodPost,
2613+ method: "POST",
27522614 url: "/skip/auth/routes/wrong/path",
27532615 allowed: false,
27542616 },
2755− {
2756− name: "Route allowed with fragment-free path",
2757− method: http.MethodGet,
2758− url: "/foo/public/bar",
2759− allowed: true,
2760− },
2761− {
2762− name: "Route denied when path contains encoded fragment suffix",
2763− method: http.MethodGet,
2764− url: "/foo/secret%23/bar",
2765− allowed: false,
2766− },
27672617 }
27682618
27692619 for _, tc := range testCases {
@@ -2804,11 +2654,9 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
28042654 }
28052655 opts.SkipAuthRegex = []string{
28062656 "^/skip/auth/regex$",
2807− "^/public/.*/endpoint$",
28082657 }
28092658 opts.SkipAuthRoutes = []string{
28102659 "GET=^/skip/auth/routes/get",
2811− "^/foo/.*/bar$",
28122660 }
28132661 err := validation.Validate(opts)
28142662 assert.NoError(t, err)
@@ -2825,37 +2673,25 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
28252673 }{
28262674 {
28272675 name: "Regex GET allowed",
2828− method: http.MethodGet,
2676+ method: "GET",
28292677 url: "/skip/auth/regex",
28302678 allowed: true,
28312679 },
28322680 {
28332681 name: "Regex POST allowed ",
2834− method: http.MethodPost,
2682+ method: "POST",
28352683 url: "/skip/auth/regex",
28362684 allowed: true,
28372685 },
28382686 {
28392687 name: "Regex denied",
2840− method: http.MethodGet,
2688+ method: "GET",
28412689 url: "/wrong/denied",
28422690 allowed: false,
28432691 },
2844− {
2845− name: "Regex allowed with fragment-free path",
2846− method: http.MethodGet,
2847− url: "/public/legit/endpoint",
2848− allowed: true,
2849− },
2850− {
2851− name: "Regex denied when X-Forwarded-Uri contains an encoded fragment suffix",
2852− method: http.MethodGet,
2853− url: "/public/secret%23/endpoint",
2854− allowed: false,
2855− },
28562692 {
28572693 name: "Route allowed",
2858− method: http.MethodGet,
2694+ method: "GET",
28592695 url: "/skip/auth/routes/get",
28602696 allowed: true,
28612697 },
@@ -2867,35 +2703,22 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
28672703 },
28682704 {
28692705 name: "Route denied with wrong path",
2870− method: http.MethodGet,
2706+ method: "GET",
28712707 url: "/skip/auth/routes/wrong/path",
28722708 allowed: false,
28732709 },
28742710 {
28752711 name: "Route denied with wrong path and method",
2876− method: http.MethodPost,
2712+ method: "POST",
28772713 url: "/skip/auth/routes/wrong/path",
28782714 allowed: false,
28792715 },
2880− {
2881− name: "Route allowed with fragment-free path",
2882− method: http.MethodGet,
2883− url: "/foo/public/bar",
2884− allowed: true,
2885− },
2886− {
2887− name: "Route denied when X-Forwarded-Uri contains an encoded fragment suffix",
2888− method: http.MethodGet,
2889− url: "/foo/secret%23/bar",
2890− allowed: false,
2891− },
28922716 }
28932717
28942718 for _, tc := range testCases {
28952719 t.Run(tc.name, func(t *testing.T) {
28962720 req, err := http.NewRequest(tc.method, opts.ProxyPrefix+authOnlyPath, nil)
28972721 req.Header.Set("X-Forwarded-Uri", tc.url)
2898− req.RemoteAddr = "127.0.0.1:4180"
28992722 assert.NoError(t, err)
29002723
29012724 rw := httptest.NewRecorder()
@@ -2910,43 +2733,6 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
29102733 }
29112734}
29122735
2913−func TestAllowedRequestWithForwardedUriHeaderRequiresTrustedProxy(t *testing.T) {
2914− upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
2915− w.WriteHeader(200)
2916− }))
2917− t.Cleanup(upstreamServer.Close)
2918−
2919− opts := baseTestOptions()
2920− opts.ReverseProxy = true
2921− opts.TrustedProxyIPs = []string{"127.0.0.1/32"}
2922− opts.UpstreamServers = options.UpstreamConfig{
2923− Upstreams: []options.Upstream{
2924− {
2925− ID: upstreamServer.URL,
2926− Path: "/",
2927− URI: upstreamServer.URL,
2928− },
2929− },
2930− }
2931− opts.SkipAuthRegex = []string{"^/skip/auth/regex$"}
2932−
2933− err := validation.Validate(opts)
2934− assert.NoError(t, err)
2935−
2936− proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })
2937− assert.NoError(t, err)
2938−
2939− req, err := http.NewRequest(http.MethodGet, opts.ProxyPrefix+authOnlyPath, nil)
2940− assert.NoError(t, err)
2941− req.RemoteAddr = "192.0.2.10:4180"
2942− req.Header.Set("X-Forwarded-Uri", "/skip/auth/regex")
2943−
2944− rw := httptest.NewRecorder()
2945− proxy.ServeHTTP(rw, req)
2946−
2947− assert.Equal(t, 401, rw.Code)
2948−}
2949−
29502736func TestAllowedRequestNegateWithoutMethod(t *testing.T) {
29512737 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
29522738 w.WriteHeader(200)
@@ -2986,37 +2772,37 @@ func TestAllowedRequestNegateWithoutMethod(t *testing.T) {
29862772 }{
29872773 {
29882774 name: "Some static file allowed",
2989− method: http.MethodGet,
2775+ method: "GET",
29902776 url: "/static/file.txt",
29912777 allowed: true,
29922778 },
29932779 {
29942780 name: "POST to contact form allowed",
2995− method: http.MethodPost,
2781+ method: "POST",
29962782 url: "/contact",
29972783 allowed: true,
29982784 },
29992785 {
30002786 name: "Regex POST allowed",
3001− method: http.MethodPost,
2787+ method: "POST",
30022788 url: "/api/public-entity",
30032789 allowed: true,
30042790 },
30052791 {
30062792 name: "Regex POST with trailing slash allowed",
3007− method: http.MethodPost,
2793+ method: "POST",
30082794 url: "/api/public-entity/",
30092795 allowed: true,
30102796 },
30112797 {
30122798 name: "Regex GET api route denied",
3013− method: http.MethodGet,
2799+ method: "GET",
30142800 url: "/api/users",
30152801 allowed: false,
30162802 },
30172803 {
30182804 name: "Regex POST api route denied",
3019− method: http.MethodPost,
2805+ method: "POST",
30202806 url: "/api/users",
30212807 allowed: false,
30222808 },
@@ -3086,37 +2872,37 @@ func TestAllowedRequestNegateWithMethod(t *testing.T) {
30862872 }{
30872873 {
30882874 name: "Some static file allowed",
3089− method: http.MethodGet,
2875+ method: "GET",
30902876 url: "/static/file.txt",
30912877 allowed: true,
30922878 },
30932879 {
30942880 name: "POST to contact form not allowed",
3095− method: http.MethodPost,
2881+ method: "POST",
30962882 url: "/contact",
30972883 allowed: false,
30982884 },
30992885 {
31002886 name: "Regex POST allowed",
3101− method: http.MethodPost,
2887+ method: "POST",
31022888 url: "/api/public-entity",
31032889 allowed: true,
31042890 },
31052891 {
31062892 name: "Regex POST with trailing slash allowed",
3107− method: http.MethodPost,
2893+ method: "POST",
31082894 url: "/api/public-entity/",
31092895 allowed: true,
31102896 },
31112897 {
31122898 name: "Regex GET api route denied",
3113− method: http.MethodGet,
2899+ method: "GET",
31142900 url: "/api/users",
31152901 allowed: false,
31162902 },
31172903 {
31182904 name: "Regex POST api route denied",
3119− method: http.MethodPost,
2905+ method: "POST",
31202906 url: "/api/users",
31212907 allowed: false,
31222908 },
@@ -3256,7 +3042,7 @@ func TestProxyAllowedGroups(t *testing.T) {
32563042 t.Fatal(err)
32573043 }
32583044
3259− test.req, _ = http.NewRequest(http.MethodGet, fmt.Sprintf("/%s", tt.querystring), nil)
3045+ test.req, _ = http.NewRequest("GET", fmt.Sprintf("/%s", tt.querystring), nil)
32603046
32613047 test.req.Header.Add("accept", applicationJSON)
32623048 err = test.SaveSession(session)
@@ -3400,7 +3186,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
34003186 {
34013187 name: "UserWithGroupSkipAuthPreflight",
34023188 groups: []string{"a", "c"},
3403− method: http.MethodOptions,
3189+ method: "OPTIONS",
34043190 ip: "1.2.3.5:43670",
34053191 withSession: true,
34063192 expectedStatusCode: http.StatusAccepted,
@@ -3408,7 +3194,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
34083194 {
34093195 name: "UserWithGroupTrustedIp",
34103196 groups: []string{"a", "c"},
3411− method: http.MethodGet,
3197+ method: "GET",
34123198 ip: "1.2.3.4:43670",
34133199 withSession: true,
34143200 expectedStatusCode: http.StatusAccepted,
@@ -3416,7 +3202,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
34163202 {
34173203 name: "UserWithoutGroupSkipAuthPreflight",
34183204 groups: []string{"c"},
3419− method: http.MethodOptions,
3205+ method: "OPTIONS",
34203206 ip: "1.2.3.5:43670",
34213207 withSession: true,
34223208 expectedStatusCode: http.StatusForbidden,
@@ -3424,21 +3210,21 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
34243210 {
34253211 name: "UserWithoutGroupTrustedIp",
34263212 groups: []string{"c"},
3427− method: http.MethodGet,
3213+ method: "GET",
34283214 ip: "1.2.3.4:43670",
34293215 withSession: true,
34303216 expectedStatusCode: http.StatusForbidden,
34313217 },
34323218 {
34333219 name: "UserWithoutSessionSkipAuthPreflight",
3434− method: http.MethodOptions,
3220+ method: "OPTIONS",
34353221 ip: "1.2.3.5:43670",
34363222 withSession: false,
34373223 expectedStatusCode: http.StatusAccepted,
34383224 },
34393225 {
34403226 name: "UserWithoutSessionTrustedIp",
3441− method: http.MethodGet,
3227+ method: "GET",
34423228 ip: "1.2.3.4:43670",
34433229 withSession: false,
34443230 expectedStatusCode: http.StatusAccepted,
@@ -3538,24 +3324,6 @@ func TestAuthOnlyAllowedEmailDomains(t *testing.T) {
35383324 querystring: "?allowed_email_domains=a.b.c.example.com,*.c.example.com",
35393325 expectedStatusCode: http.StatusAccepted,
35403326 },
3541− {
3542− name: "UserWithMultipleAtSignsExactDomain",
3543− email: "attacker@evil.com@example.com",
3544− querystring: "?allowed_email_domains=example.com",
3545− expectedStatusCode: http.StatusForbidden,
3546− },
3547− {
3548− name: "UserWithMultipleAtSignsWildcardDomain",
3549− email: "attacker@evil.com@foo.example.com",
3550− querystring: "?allowed_email_domains=*.example.com",
3551− expectedStatusCode: http.StatusForbidden,
3552− },
3553− {
3554− name: "UserWithMultipleAtSignsDotPrefixedDomain",
3555− email: "attacker@evil.com@foo.example.com",
3556− querystring: "?allowed_email_domains=.example.com",
3557− expectedStatusCode: http.StatusForbidden,
3558− },
35593327 }
35603328
35613329 for _, tc := range testCases {
@@ -3762,49 +3530,3 @@ func TestGetOAuthRedirectURI(t *testing.T) {
37623530 })
37633531 }
37643532}
3765−
3766−func TestIdTokenPlaceholderInSignOut(t *testing.T) {
3767− opts := baseTestOptions()
3768− opts.WhitelistDomains = []string{"my-oidc-provider.example.com"}
3769−
3770− err := validation.Validate(opts)
3771− assert.NoError(t, err)
3772−
3773− const emailAddress = "john.doe@example.com"
3774− const userName = "9fcab5c9b889a557"
3775− created := time.Now()
3776−
3777− session := &sessions.SessionState{
3778− User: userName,
3779− Groups: []string{"a", "b"},
3780− Email: emailAddress,
3781− IDToken: "eYjjjjjj.vvvv.ddd",
3782− AccessToken: "oauth_token",
3783− CreatedAt: &created,
3784− }
3785−
3786− proxy, err := NewOAuthProxy(opts, func(email string) bool {
3787− return true
3788− })
3789− assert.NoError(t, err)
3790−
3791− // Save the required session
3792− rw := httptest.NewRecorder()
3793− req, _ := http.NewRequest(http.MethodGet, "/", nil)
3794− err = proxy.sessionStore.Save(rw, req, session)
3795− assert.NoError(t, err)
3796−
3797− rw = httptest.NewRecorder()
3798−
3799− rdUrl := url.QueryEscape("https://my-oidc-provider.example.com/sign_out_page?id_token_hint={id_token}&post_logout_redirect_uri=https://my-app.example.com/")
3800− req, _ = http.NewRequest(http.MethodGet, "/oauth2/sign_out?rd="+rdUrl, nil)
3801− req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{
3802− RequestID: "11111111-2222-4333-8444-555555555555",
3803− Session: session,
3804− })
3805−
3806− proxy.SignOut(rw, req)
3807− newLocation := rw.Header().Values("Location")[0]
3808−
3809− assert.Equal(t, "https://my-oidc-provider.example.com/sign_out_page?id_token_hint=eYjjjjjj.vvvv.ddd&post_logout_redirect_uri=https://my-app.example.com/", newLocation)
3810−}