@@ -54,7 +54,7 @@ func TestRobotsTxt(t *testing.T) {
5454 t.Fatal(err)
5555 }
5656 rw := httptest.NewRecorder()
57− req, _ := http.NewRequest(http.MethodGet, "/robots.txt", nil)
57+ req, _ := http.NewRequest("GET", "/robots.txt", nil)
5858 proxy.ServeHTTP(rw, req)
5959 assert.Equal(t, 200, rw.Code)
6060 assert.Equal(t, "User-agent: *\nDisallow: /\n", rw.Body.String())
@@ -241,7 +241,7 @@ func TestBasicAuthPassword(t *testing.T) {
241241
242242 // Save the required session
243243 rw := httptest.NewRecorder()
244− req, _ := http.NewRequest(http.MethodGet, "/", nil)
244+ req, _ := http.NewRequest("GET", "/", nil)
245245 err = proxy.sessionStore.Save(rw, req, &sessions.SessionState{
246246 Email: emailAddress,
247247 })
@@ -250,7 +250,7 @@ func TestBasicAuthPassword(t *testing.T) {
250250 // Extract the cookie value to inject into the test request
251251 cookie := rw.Header().Values("Set-Cookie")[0]
252252
253− req, _ = http.NewRequest(http.MethodGet, "/", nil)
253+ req, _ = http.NewRequest("GET", "/", nil)
254254 req.Header.Set("Cookie", cookie)
255255 rw = httptest.NewRecorder()
256256 proxy.ServeHTTP(rw, req)
@@ -300,14 +300,14 @@ func TestPassGroupsHeadersWithGroups(t *testing.T) {
300300
301301 // Save the required session
302302 rw := httptest.NewRecorder()
303− req, _ := http.NewRequest(http.MethodGet, "/", nil)
303+ req, _ := http.NewRequest("GET", "/", nil)
304304 err = proxy.sessionStore.Save(rw, req, session)
305305 assert.NoError(t, err)
306306
307307 // Extract the cookie value to inject into the test request
308308 cookie := rw.Header().Values("Set-Cookie")[0]
309309
310− req, _ = http.NewRequest(http.MethodGet, "/", nil)
310+ req, _ = http.NewRequest("GET", "/", nil)
311311 req.Header.Set("Cookie", cookie)
312312 rw = httptest.NewRecorder()
313313 proxy.ServeHTTP(rw, req)
@@ -457,7 +457,7 @@ func (patTest *PassAccessTokenTest) getEndpointWithCookie(cookie string, endpoin
457457 return 0, ""
458458 }
459459
460− req, err := http.NewRequest(http.MethodGet, endpoint, strings.NewReader(""))
460+ req, err := http.NewRequest("GET", endpoint, strings.NewReader(""))
461461 if err != nil {
462462 return 0, ""
463463 }
@@ -608,7 +608,7 @@ func NewSignInPageTest(skipProvider bool) (*SignInPageTest, error) {
608608
609609func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
610610 rw := httptest.NewRecorder()
611− req, _ := http.NewRequest(http.MethodGet, endpoint, strings.NewReader(""))
611+ req, _ := http.NewRequest("GET", endpoint, strings.NewReader(""))
612612 sipTest.proxy.ServeHTTP(rw, req)
613613 return rw.Code, rw.Body.String()
614614}
@@ -713,50 +713,6 @@ func TestManualSignInCorrectCredentials(t *testing.T) {
713713 assert.Equal(t, http.StatusFound, statusCode)
714714}
715715
716−func TestSignInPageClearsExistingSessionCookie(t *testing.T) {
717− opts := baseTestOptions()
718− err := validation.Validate(opts)
719− require.NoError(t, err)
720−
721− proxy, err := NewOAuthProxy(opts, func(string) bool {
722− return true
723− })
724− require.NoError(t, err)
725−
726− // Create a real session cookie using the actual session store.
727− saveRW := httptest.NewRecorder()
728− saveReq := httptest.NewRequest(http.MethodGet, "/", nil)
729− err = proxy.sessionStore.Save(saveRW, saveReq, &sessions.SessionState{
730− Email: "john.doe@example.com",
731− })
732− require.NoError(t, err)
733−
734− cookies := saveRW.Result().Cookies()
735− require.NotEmpty(t, cookies)
736−
737− // Send that cookie to the sign-in page.
738− req := httptest.NewRequest(http.MethodGet, "/oauth2/sign_in", nil)
739− for _, c := range cookies {
740− req.AddCookie(c)
741− }
742−
743− rw := httptest.NewRecorder()
744− proxy.ServeHTTP(rw, req)
745−
746− assert.Equal(t, http.StatusOK, rw.Code)
747−
748− cleared := false
749− for _, c := range rw.Result().Cookies() {
750− if c.Name == proxy.CookieOptions.Name {
751− cleared = true
752− assert.Equal(t, "", c.Value)
753− assert.Less(t, c.MaxAge, 0)
754− }
755− }
756−
757− assert.True(t, cleared, "expected sign-in page to clear existing session cookie")
758−}
759−
760716func TestSignInPageIncludesTargetRedirect(t *testing.T) {
761717 sipTest, err := NewSignInPageTest(false)
762718 if err != nil {
@@ -894,7 +850,7 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifi
894850 // access_token validation.
895851 pcTest.proxy.CookieOptions.Refresh = time.Duration(0)
896852 pcTest.rw = httptest.NewRecorder()
897− pcTest.req, _ = http.NewRequest(http.MethodGet, "/", strings.NewReader(""))
853+ pcTest.req, _ = http.NewRequest("GET", "/", strings.NewReader(""))
898854 pcTest.validateUser = true
899855 return &pcTest, nil
900856}
@@ -1027,7 +983,7 @@ func NewUserInfoEndpointTest() (*ProcessCookieTest, error) {
1027983 if err != nil {
1028984 return nil, err
1029985 }
1030− pcTest.req, _ = http.NewRequest(http.MethodGet,
986+ pcTest.req, _ = http.NewRequest("GET",
1031987 pcTest.opts.ProxyPrefix+"/userinfo", nil)
1032988 return pcTest, nil
1033989}
@@ -1135,7 +1091,7 @@ func NewAuthOnlyEndpointTest(querystring string, modifiers ...OptionsModifier) (
11351091 return nil, err
11361092 }
11371093 pcTest.req, _ = http.NewRequest(
1138− http.MethodGet,
1094+ "GET",
11391095 fmt.Sprintf("%s/auth%s", pcTest.opts.ProxyPrefix, querystring),
11401096 nil)
11411097 return pcTest, nil
@@ -1274,7 +1230,7 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
12741230 pcTest.validateUser = true
12751231
12761232 pcTest.rw = httptest.NewRecorder()
1277− pcTest.req, _ = http.NewRequest(http.MethodGet,
1233+ pcTest.req, _ = http.NewRequest("GET",
12781234 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
12791235
12801236 created := time.Now()
@@ -1367,7 +1323,7 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
13671323 pcTest.validateUser = true
13681324
13691325 pcTest.rw = httptest.NewRecorder()
1370− pcTest.req, _ = http.NewRequest(http.MethodGet,
1326+ pcTest.req, _ = http.NewRequest("GET",
13711327 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
13721328
13731329 created := time.Now()
@@ -1447,7 +1403,7 @@ func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
14471403 pcTest.validateUser = true
14481404
14491405 pcTest.rw = httptest.NewRecorder()
1450− pcTest.req, _ = http.NewRequest(http.MethodGet,
1406+ pcTest.req, _ = http.NewRequest("GET",
14511407 pcTest.opts.ProxyPrefix+authOnlyPath, nil)
14521408
14531409 created := time.Now()
@@ -1495,7 +1451,7 @@ func TestAuthSkippedForPreflightRequests(t *testing.T) {
14951451 }
14961452 proxy.provider = NewTestProvider(upstreamURL, "")
14971453 rw := httptest.NewRecorder()
1498− req, _ := http.NewRequest(http.MethodOptions, "/preflight-request", nil)
1454+ req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)
14991455 proxy.ServeHTTP(rw, req)
15001456
15011457 assert.Equal(t, 200, rw.Code)
@@ -1652,19 +1608,19 @@ func TestRequestSignature(t *testing.T) {
16521608 resp string
16531609 }{
16541610 "No request signature": {
1655− method: http.MethodGet,
1611+ method: "GET",
16561612 body: "",
16571613 key: "",
16581614 resp: "no signature received",
16591615 },
16601616 "Get request": {
1661− method: http.MethodGet,
1617+ method: "GET",
16621618 body: "",
16631619 key: "7d9e1aa87a5954e6f9fc59266b3af9d7c35fda2d",
16641620 resp: "signatures match",
16651621 },
16661622 "Post request": {
1667− method: http.MethodPost,
1623+ method: "POST",
16681624 body: `{ "hello": "world!" }`,
16691625 key: "d90df39e2d19282840252612dd7c81421a372f61",
16701626 resp: "signatures match",
@@ -2189,33 +2145,7 @@ func TestTrustedIPs(t *testing.T) {
21892145 reverseProxy: false,
21902146 realClientIPHeader: "X-Real-IP", // Default value
21912147 req: func() *http.Request {
2192− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2193− return req
2194− }(),
2195− expectTrusted: false,
2196− },
2197− // Check Unix socket with no trusted IPs configured does not error.
2198− {
2199− name: "UnixSocketWithoutTrustedIPs",
2200− trustedIPs: nil,
2201− reverseProxy: false,
2202− realClientIPHeader: "X-Real-IP",
2203− req: func() *http.Request {
2204− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2205− req.RemoteAddr = "@"
2206− return req
2207− }(),
2208− expectTrusted: false,
2209− },
2210− // Check Unix socket with trusted IPs configured returns false (no IP to match).
2211− {
2212− name: "UnixSocketWithTrustedIPs",
2213− trustedIPs: []string{"127.0.0.1"},
2214− reverseProxy: false,
2215− realClientIPHeader: "X-Real-IP",
2216− req: func() *http.Request {
2217− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2218− req.RemoteAddr = "@"
2148+ req, _ := http.NewRequest("GET", "/", nil)
22192149 return req
22202150 }(),
22212151 expectTrusted: false,
@@ -2227,7 +2157,7 @@ func TestTrustedIPs(t *testing.T) {
22272157 reverseProxy: false,
22282158 realClientIPHeader: "X-Real-IP", // Default value
22292159 req: func() *http.Request {
2230− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2160+ req, _ := http.NewRequest("GET", "/", nil)
22312161 req.RemoteAddr = "127.0.0.1:43670"
22322162 return req
22332163 }(),
@@ -2240,7 +2170,7 @@ func TestTrustedIPs(t *testing.T) {
22402170 reverseProxy: true,
22412171 realClientIPHeader: "X-Real-IP", // Default value
22422172 req: func() *http.Request {
2243− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2173+ req, _ := http.NewRequest("GET", "/", nil)
22442174 req.RemoteAddr = "127.0.0.1:44324"
22452175 return req
22462176 }(),
@@ -2253,7 +2183,7 @@ func TestTrustedIPs(t *testing.T) {
22532183 reverseProxy: true,
22542184 realClientIPHeader: "X-Forwarded-For",
22552185 req: func() *http.Request {
2256− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2186+ req, _ := http.NewRequest("GET", "/", nil)
22572187 req.Header.Add("X-Forwarded-For", "127.0.0.1")
22582188 return req
22592189 }(),
@@ -2266,7 +2196,7 @@ func TestTrustedIPs(t *testing.T) {
22662196 reverseProxy: true,
22672197 realClientIPHeader: "X-Forwarded-For",
22682198 req: func() *http.Request {
2269− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2199+ req, _ := http.NewRequest("GET", "/", nil)
22702200 req.Header.Add("X-Forwarded-For", "::1")
22712201 return req
22722202 }(),
@@ -2279,7 +2209,7 @@ func TestTrustedIPs(t *testing.T) {
22792209 reverseProxy: true,
22802210 realClientIPHeader: "X-Forwarded-For",
22812211 req: func() *http.Request {
2282− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2212+ req, _ := http.NewRequest("GET", "/", nil)
22832213 req.Header.Add("X-Forwarded-For", "12.34.56.78")
22842214 return req
22852215 }(),
@@ -2292,7 +2222,7 @@ func TestTrustedIPs(t *testing.T) {
22922222 reverseProxy: true,
22932223 realClientIPHeader: "X-Forwarded-For",
22942224 req: func() *http.Request {
2295− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2225+ req, _ := http.NewRequest("GET", "/", nil)
22962226 req.Header.Add("X-Forwarded-For", "::2")
22972227 return req
22982228 }(),
@@ -2305,7 +2235,7 @@ func TestTrustedIPs(t *testing.T) {
23052235 reverseProxy: true,
23062236 realClientIPHeader: "X-Forwarded-For",
23072237 req: func() *http.Request {
2308− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2238+ req, _ := http.NewRequest("GET", "/", nil)
23092239 req.Header.Add("X-Real-IP", "::1")
23102240 return req
23112241 }(),
@@ -2318,7 +2248,7 @@ func TestTrustedIPs(t *testing.T) {
23182248 reverseProxy: true,
23192249 realClientIPHeader: "X-Forwarded-For",
23202250 req: func() *http.Request {
2321− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2251+ req, _ := http.NewRequest("GET", "/", nil)
23222252 req.Header.Add("X-Forwarded-For", "adsfljk29242as!!")
23232253 return req
23242254 }(),
@@ -2331,7 +2261,7 @@ func TestTrustedIPs(t *testing.T) {
23312261 reverseProxy: false,
23322262 realClientIPHeader: "X-Real-IP",
23332263 req: func() *http.Request {
2334− req, _ := http.NewRequest(http.MethodGet, "/", nil)
2264+ req, _ := http.NewRequest("GET", "/", nil)
23352265 req.RemoteAddr = "adsfljk29242as!!"
23362266 return req
23372267 }(),
@@ -2427,12 +2357,12 @@ func Test_buildRoutesAllowlist(t *testing.T) {
24272357 },
24282358 expectedRoutes: []expectedAllowedRoute{
24292359 {
2430− method: http.MethodGet,
2360+ method: "GET",
24312361 negate: false,
24322362 regexString: "^/foo/bar",
24332363 },
24342364 {
2435− method: http.MethodPost,
2365+ method: "POST",
24362366 negate: false,
24372367 regexString: "^/baz/[0-9]+/thing",
24382368 },
@@ -2485,11 +2415,11 @@ func Test_buildRoutesAllowlist(t *testing.T) {
24852415 regexString: "^/baz/[0-9]+/thing/regex",
24862416 },
24872417 {
2488− method: http.MethodGet,
2418+ method: "GET",
24892419 regexString: "^/foo/bar",
24902420 },
24912421 {
2492− method: http.MethodPost,
2422+ method: "POST",
24932423 regexString: "^/baz/[0-9]+/thing",
24942424 },
24952425 {
@@ -2641,7 +2571,7 @@ func TestApiRoutes(t *testing.T) {
26412571
26422572 for _, tc := range testCases {
26432573 t.Run(tc.name, func(t *testing.T) {
2644− req, err := http.NewRequest(http.MethodGet, tc.url, nil)
2574+ req, err := http.NewRequest("GET", tc.url, nil)
26452575 req.Header.Set("Accept", tc.contentType)
26462576 assert.NoError(t, err)
26472577
@@ -2679,11 +2609,9 @@ func TestAllowedRequest(t *testing.T) {
26792609 }
26802610 opts.SkipAuthRegex = []string{
26812611 "^/skip/auth/regex$",
2682− "^/public/.*/endpoint$",
26832612 }
26842613 opts.SkipAuthRoutes = []string{
26852614 "GET=^/skip/auth/routes/get",
2686− "^/foo/.*/bar$",
26872615 }
26882616 err := validation.Validate(opts)
26892617 assert.NoError(t, err)
@@ -2700,37 +2628,25 @@ func TestAllowedRequest(t *testing.T) {
27002628 }{
27012629 {
27022630 name: "Regex GET allowed",
2703− method: http.MethodGet,
2631+ method: "GET",
27042632 url: "/skip/auth/regex",
27052633 allowed: true,
27062634 },
27072635 {
27082636 name: "Regex POST allowed ",
2709− method: http.MethodPost,
2637+ method: "POST",
27102638 url: "/skip/auth/regex",
27112639 allowed: true,
27122640 },
27132641 {
27142642 name: "Regex denied",
2715− method: http.MethodGet,
2643+ method: "GET",
27162644 url: "/wrong/denied",
27172645 allowed: false,
27182646 },
2719− {
2720− name: "Regex allowed with fragment-free path",
2721− method: http.MethodGet,
2722− url: "/public/legit/endpoint",
2723− allowed: true,
2724− },
2725− {
2726− name: "Regex denied when path contains encoded fragment suffix",
2727− method: http.MethodGet,
2728− url: "/public/secret%23/endpoint",
2729− allowed: false,
2730− },
27312647 {
27322648 name: "Route allowed",
2733− method: http.MethodGet,
2649+ method: "GET",
27342650 url: "/skip/auth/routes/get",
27352651 allowed: true,
27362652 },
@@ -2742,28 +2658,16 @@ func TestAllowedRequest(t *testing.T) {
27422658 },
27432659 {
27442660 name: "Route denied with wrong path",
2745− method: http.MethodGet,
2661+ method: "GET",
27462662 url: "/skip/auth/routes/wrong/path",
27472663 allowed: false,
27482664 },
27492665 {
27502666 name: "Route denied with wrong path and method",
2751− method: http.MethodPost,
2667+ method: "POST",
27522668 url: "/skip/auth/routes/wrong/path",
27532669 allowed: false,
27542670 },
2755− {
2756− name: "Route allowed with fragment-free path",
2757− method: http.MethodGet,
2758− url: "/foo/public/bar",
2759− allowed: true,
2760− },
2761− {
2762− name: "Route denied when path contains encoded fragment suffix",
2763− method: http.MethodGet,
2764− url: "/foo/secret%23/bar",
2765− allowed: false,
2766− },
27672671 }
27682672
27692673 for _, tc := range testCases {
@@ -2804,11 +2708,9 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
28042708 }
28052709 opts.SkipAuthRegex = []string{
28062710 "^/skip/auth/regex$",
2807− "^/public/.*/endpoint$",
28082711 }
28092712 opts.SkipAuthRoutes = []string{
28102713 "GET=^/skip/auth/routes/get",
2811− "^/foo/.*/bar$",
28122714 }
28132715 err := validation.Validate(opts)
28142716 assert.NoError(t, err)
@@ -2825,37 +2727,25 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
28252727 }{
28262728 {
28272729 name: "Regex GET allowed",
2828− method: http.MethodGet,
2730+ method: "GET",
28292731 url: "/skip/auth/regex",
28302732 allowed: true,
28312733 },
28322734 {
28332735 name: "Regex POST allowed ",
2834− method: http.MethodPost,
2736+ method: "POST",
28352737 url: "/skip/auth/regex",
28362738 allowed: true,
28372739 },
28382740 {
28392741 name: "Regex denied",
2840− method: http.MethodGet,
2742+ method: "GET",
28412743 url: "/wrong/denied",
28422744 allowed: false,
28432745 },
2844− {
2845− name: "Regex allowed with fragment-free path",
2846− method: http.MethodGet,
2847− url: "/public/legit/endpoint",
2848− allowed: true,
2849− },
2850− {
2851− name: "Regex denied when X-Forwarded-Uri contains an encoded fragment suffix",
2852− method: http.MethodGet,
2853− url: "/public/secret%23/endpoint",
2854− allowed: false,
2855− },
28562746 {
28572747 name: "Route allowed",
2858− method: http.MethodGet,
2748+ method: "GET",
28592749 url: "/skip/auth/routes/get",
28602750 allowed: true,
28612751 },
@@ -2867,35 +2757,22 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
28672757 },
28682758 {
28692759 name: "Route denied with wrong path",
2870− method: http.MethodGet,
2760+ method: "GET",
28712761 url: "/skip/auth/routes/wrong/path",
28722762 allowed: false,
28732763 },
28742764 {
28752765 name: "Route denied with wrong path and method",
2876− method: http.MethodPost,
2766+ method: "POST",
28772767 url: "/skip/auth/routes/wrong/path",
28782768 allowed: false,
28792769 },
2880− {
2881− name: "Route allowed with fragment-free path",
2882− method: http.MethodGet,
2883− url: "/foo/public/bar",
2884− allowed: true,
2885− },
2886− {
2887− name: "Route denied when X-Forwarded-Uri contains an encoded fragment suffix",
2888− method: http.MethodGet,
2889− url: "/foo/secret%23/bar",
2890− allowed: false,
2891− },
28922770 }
28932771
28942772 for _, tc := range testCases {
28952773 t.Run(tc.name, func(t *testing.T) {
28962774 req, err := http.NewRequest(tc.method, opts.ProxyPrefix+authOnlyPath, nil)
28972775 req.Header.Set("X-Forwarded-Uri", tc.url)
2898− req.RemoteAddr = "127.0.0.1:4180"
28992776 assert.NoError(t, err)
29002777
29012778 rw := httptest.NewRecorder()
@@ -2910,43 +2787,6 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
29102787 }
29112788}
29122789
2913−func TestAllowedRequestWithForwardedUriHeaderRequiresTrustedProxy(t *testing.T) {
2914− upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
2915− w.WriteHeader(200)
2916− }))
2917− t.Cleanup(upstreamServer.Close)
2918−
2919− opts := baseTestOptions()
2920− opts.ReverseProxy = true
2921− opts.TrustedProxyIPs = []string{"127.0.0.1/32"}
2922− opts.UpstreamServers = options.UpstreamConfig{
2923− Upstreams: []options.Upstream{
2924− {
2925− ID: upstreamServer.URL,
2926− Path: "/",
2927− URI: upstreamServer.URL,
2928− },
2929− },
2930− }
2931− opts.SkipAuthRegex = []string{"^/skip/auth/regex$"}
2932−
2933− err := validation.Validate(opts)
2934− assert.NoError(t, err)
2935−
2936− proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })
2937− assert.NoError(t, err)
2938−
2939− req, err := http.NewRequest(http.MethodGet, opts.ProxyPrefix+authOnlyPath, nil)
2940− assert.NoError(t, err)
2941− req.RemoteAddr = "192.0.2.10:4180"
2942− req.Header.Set("X-Forwarded-Uri", "/skip/auth/regex")
2943−
2944− rw := httptest.NewRecorder()
2945− proxy.ServeHTTP(rw, req)
2946−
2947− assert.Equal(t, 401, rw.Code)
2948−}
2949−
29502790func TestAllowedRequestNegateWithoutMethod(t *testing.T) {
29512791 upstreamServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
29522792 w.WriteHeader(200)
@@ -2986,37 +2826,37 @@ func TestAllowedRequestNegateWithoutMethod(t *testing.T) {
29862826 }{
29872827 {
29882828 name: "Some static file allowed",
2989− method: http.MethodGet,
2829+ method: "GET",
29902830 url: "/static/file.txt",
29912831 allowed: true,
29922832 },
29932833 {
29942834 name: "POST to contact form allowed",
2995− method: http.MethodPost,
2835+ method: "POST",
29962836 url: "/contact",
29972837 allowed: true,
29982838 },
29992839 {
30002840 name: "Regex POST allowed",
3001− method: http.MethodPost,
2841+ method: "POST",
30022842 url: "/api/public-entity",
30032843 allowed: true,
30042844 },
30052845 {
30062846 name: "Regex POST with trailing slash allowed",
3007− method: http.MethodPost,
2847+ method: "POST",
30082848 url: "/api/public-entity/",
30092849 allowed: true,
30102850 },
30112851 {
30122852 name: "Regex GET api route denied",
3013− method: http.MethodGet,
2853+ method: "GET",
30142854 url: "/api/users",
30152855 allowed: false,
30162856 },
30172857 {
30182858 name: "Regex POST api route denied",
3019− method: http.MethodPost,
2859+ method: "POST",
30202860 url: "/api/users",
30212861 allowed: false,
30222862 },
@@ -3086,37 +2926,37 @@ func TestAllowedRequestNegateWithMethod(t *testing.T) {
30862926 }{
30872927 {
30882928 name: "Some static file allowed",
3089− method: http.MethodGet,
2929+ method: "GET",
30902930 url: "/static/file.txt",
30912931 allowed: true,
30922932 },
30932933 {
30942934 name: "POST to contact form not allowed",
3095− method: http.MethodPost,
2935+ method: "POST",
30962936 url: "/contact",
30972937 allowed: false,
30982938 },
30992939 {
31002940 name: "Regex POST allowed",
3101− method: http.MethodPost,
2941+ method: "POST",
31022942 url: "/api/public-entity",
31032943 allowed: true,
31042944 },
31052945 {
31062946 name: "Regex POST with trailing slash allowed",
3107− method: http.MethodPost,
2947+ method: "POST",
31082948 url: "/api/public-entity/",
31092949 allowed: true,
31102950 },
31112951 {
31122952 name: "Regex GET api route denied",
3113− method: http.MethodGet,
2953+ method: "GET",
31142954 url: "/api/users",
31152955 allowed: false,
31162956 },
31172957 {
31182958 name: "Regex POST api route denied",
3119− method: http.MethodPost,
2959+ method: "POST",
31202960 url: "/api/users",
31212961 allowed: false,
31222962 },
@@ -3256,7 +3096,7 @@ func TestProxyAllowedGroups(t *testing.T) {
32563096 t.Fatal(err)
32573097 }
32583098
3259− test.req, _ = http.NewRequest(http.MethodGet, fmt.Sprintf("/%s", tt.querystring), nil)
3099+ test.req, _ = http.NewRequest("GET", fmt.Sprintf("/%s", tt.querystring), nil)
32603100
32613101 test.req.Header.Add("accept", applicationJSON)
32623102 err = test.SaveSession(session)
@@ -3400,7 +3240,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
34003240 {
34013241 name: "UserWithGroupSkipAuthPreflight",
34023242 groups: []string{"a", "c"},
3403− method: http.MethodOptions,
3243+ method: "OPTIONS",
34043244 ip: "1.2.3.5:43670",
34053245 withSession: true,
34063246 expectedStatusCode: http.StatusAccepted,
@@ -3408,7 +3248,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
34083248 {
34093249 name: "UserWithGroupTrustedIp",
34103250 groups: []string{"a", "c"},
3411− method: http.MethodGet,
3251+ method: "GET",
34123252 ip: "1.2.3.4:43670",
34133253 withSession: true,
34143254 expectedStatusCode: http.StatusAccepted,
@@ -3416,7 +3256,7 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
34163256 {
34173257 name: "UserWithoutGroupSkipAuthPreflight",
34183258 groups: []string{"c"},
3419− method: http.MethodOptions,
3259+ method: "OPTIONS",
34203260 ip: "1.2.3.5:43670",
34213261 withSession: true,
34223262 expectedStatusCode: http.StatusForbidden,
@@ -3424,21 +3264,21 @@ func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {
34243264 {
34253265 name: "UserWithoutGroupTrustedIp",
34263266 groups: []string{"c"},
3427− method: http.MethodGet,
3267+ method: "GET",
34283268 ip: "1.2.3.4:43670",
34293269 withSession: true,
34303270 expectedStatusCode: http.StatusForbidden,
34313271 },
34323272 {
34333273 name: "UserWithoutSessionSkipAuthPreflight",
3434− method: http.MethodOptions,
3274+ method: "OPTIONS",
34353275 ip: "1.2.3.5:43670",
34363276 withSession: false,
34373277 expectedStatusCode: http.StatusAccepted,
34383278 },
34393279 {
34403280 name: "UserWithoutSessionTrustedIp",
3441− method: http.MethodGet,
3281+ method: "GET",
34423282 ip: "1.2.3.4:43670",
34433283 withSession: false,
34443284 expectedStatusCode: http.StatusAccepted,
@@ -3538,24 +3378,6 @@ func TestAuthOnlyAllowedEmailDomains(t *testing.T) {
35383378 querystring: "?allowed_email_domains=a.b.c.example.com,*.c.example.com",
35393379 expectedStatusCode: http.StatusAccepted,
35403380 },
3541− {
3542− name: "UserWithMultipleAtSignsExactDomain",
3543− email: "attacker@evil.com@example.com",
3544− querystring: "?allowed_email_domains=example.com",
3545− expectedStatusCode: http.StatusForbidden,
3546− },
3547− {
3548− name: "UserWithMultipleAtSignsWildcardDomain",
3549− email: "attacker@evil.com@foo.example.com",
3550− querystring: "?allowed_email_domains=*.example.com",
3551− expectedStatusCode: http.StatusForbidden,
3552− },
3553− {
3554− name: "UserWithMultipleAtSignsDotPrefixedDomain",
3555− email: "attacker@evil.com@foo.example.com",
3556− querystring: "?allowed_email_domains=.example.com",
3557− expectedStatusCode: http.StatusForbidden,
3558− },
35593381 }
35603382
35613383 for _, tc := range testCases {
@@ -3790,14 +3612,14 @@ func TestIdTokenPlaceholderInSignOut(t *testing.T) {
37903612
37913613 // Save the required session
37923614 rw := httptest.NewRecorder()
3793− req, _ := http.NewRequest(http.MethodGet, "/", nil)
3615+ req, _ := http.NewRequest("GET", "/", nil)
37943616 err = proxy.sessionStore.Save(rw, req, session)
37953617 assert.NoError(t, err)
37963618
37973619 rw = httptest.NewRecorder()
37983620
37993621 rdUrl := url.QueryEscape("https://my-oidc-provider.example.com/sign_out_page?id_token_hint={id_token}&post_logout_redirect_uri=https://my-app.example.com/")
3800− req, _ = http.NewRequest(http.MethodGet, "/oauth2/sign_out?rd="+rdUrl, nil)
3622+ req, _ = http.NewRequest("GET", "/oauth2/sign_out?rd="+rdUrl, nil)
38013623 req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{
38023624 RequestID: "11111111-2222-4333-8444-555555555555",
38033625 Session: session,