baalajimaestro/traefik
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Forward Proxy-Authorization header to authentication server

Browse source
This commit is contained in:
Pascal Fautré 2021-01-21 18:34:04 +01:00 • committed by GitHub
parent a90b2a672e
commit f0d78471af
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 24 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
pkg/middlewares/auth/forward.go
View file

@ -26,6 +26,18 @@ const (
forwardedTypeName = "ForwardedAuthType" forwardedTypeName = "ForwardedAuthType"
) )
// hopHeaders Hop-by-hop headers to be removed in the authentication request.
// http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
// Proxy-Authorization header is forwarded to the authentication server (see https://tools.ietf.org/html/rfc7235#section-4.4).
var hopHeaders = []string{
forward.Connection,
forward.KeepAlive,
forward.Te, // canonicalized version of "TE"
forward.Trailers,
forward.TransferEncoding,
forward.Upgrade,
}
type forwardAuth struct { type forwardAuth struct {
address string address string
authResponseHeaders []string authResponseHeaders []string
@ -131,7 +143,7 @@ func (fa *forwardAuth) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
logger.Debugf("Remote error %s. StatusCode: %d", fa.address, forwardResponse.StatusCode) logger.Debugf("Remote error %s. StatusCode: %d", fa.address, forwardResponse.StatusCode)
utils.CopyHeaders(rw.Header(), forwardResponse.Header) utils.CopyHeaders(rw.Header(), forwardResponse.Header)
utils.RemoveHeaders(rw.Header(), forward.HopHeaders...) utils.RemoveHeaders(rw.Header(), hopHeaders...)
// Grab the location header, if any. // Grab the location header, if any.
redirectURL, err := forwardResponse.Location() redirectURL, err := forwardResponse.Location()
@ -187,7 +199,7 @@ func (fa *forwardAuth) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
func writeHeader(req, forwardReq *http.Request, trustForwardHeader bool, allowedHeaders []string) { func writeHeader(req, forwardReq *http.Request, trustForwardHeader bool, allowedHeaders []string) {
utils.CopyHeaders(forwardReq.Header, req.Header) utils.CopyHeaders(forwardReq.Header, req.Header)
utils.RemoveHeaders(forwardReq.Header, forward.HopHeaders...) utils.RemoveHeaders(forwardReq.Header, hopHeaders...)
forwardReq.Header = filterForwardRequestHeaders(forwardReq.Header, allowedHeaders) forwardReq.Header = filterForwardRequestHeaders(forwardReq.Header, allowedHeaders)

16
pkg/middlewares/auth/forward_test.go
View file

@ -26,6 +26,7 @@ func TestForwardAuthFail(t *testing.T) {
}) })
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set(forward.ProxyAuthenticate, "test")
http.Error(w, "Forbidden", http.StatusForbidden) http.Error(w, "Forbidden", http.StatusForbidden)
})) }))
t.Cleanup(server.Close) t.Cleanup(server.Close)
@ -48,6 +49,7 @@ func TestForwardAuthFail(t *testing.T) {
err = res.Body.Close() err = res.Body.Close()
require.NoError(t, err) require.NoError(t, err)
assert.Equal(t, "test", res.Header.Get(forward.ProxyAuthenticate))
assert.Equal(t, "Forbidden\n", string(body)) assert.Equal(t, "Forbidden\n", string(body))
} }
@ -142,7 +144,7 @@ func TestForwardAuthRedirect(t *testing.T) {
func TestForwardAuthRemoveHopByHopHeaders(t *testing.T) { func TestForwardAuthRemoveHopByHopHeaders(t *testing.T) {
authTs := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { authTs := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
headers := w.Header() headers := w.Header()
for _, header := range forward.HopHeaders { for _, header := range hopHeaders {
if header == forward.TransferEncoding { if header == forward.TransferEncoding {
headers.Set(header, "chunked") headers.Set(header, "chunked")
} else { } else {
@ -367,11 +369,13 @@ func Test_writeHeader(t *testing.T) {
}, },
trustForwardHeader: false, trustForwardHeader: false,
expectedHeaders: map[string]string{ expectedHeaders: map[string]string{
"X-CustomHeader": "CustomHeader", "X-CustomHeader": "CustomHeader",
"X-Forwarded-Proto": "http", "X-Forwarded-Proto": "http",
"X-Forwarded-Host": "foo.bar", "X-Forwarded-Host": "foo.bar",
"X-Forwarded-Uri": "/path?q=1", "X-Forwarded-Uri": "/path?q=1",
"X-Forwarded-Method": "GET", "X-Forwarded-Method": "GET",
forward.ProxyAuthenticate: "ProxyAuthenticate",
forward.ProxyAuthorization: "ProxyAuthorization",
}, },
checkForUnexpectedHeaders: true, checkForUnexpectedHeaders: true,
}, },