public_git/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2026-10-18 22:41:04 +02:00
Code Issues Projects Releases Wiki Activity

fix: use GetSecret() in ticket.go makeCookie to respect cookie-secret-file (#3228)

Browse Source 
* fix: use GetSecret() in ticket.go makeCookie

The makeCookie method in ticket.go was using t.options.Secret directly, which
meant cookie-secret-file was not being respected. Updated to use GetSecret()
which handles both cookie-secret and cookie-secret-file properly.

Also added test coverage for cookie-secret-file functionality.

Fixes #3224

Signed-off-by: stagswtf <142280349+stagswtf@users.noreply.github.com>

* docs: update CHANGELOG.md for cookie-secret-file fix

Signed-off-by: stagswtf <142280349+stagswtf@users.noreply.github.com>

* correct PR link and undo file formatting

Signed-off-by: stagswtf <142280349+stagswtf@users.noreply.github.com>

* fix: error wrapping

Signed-off-by: Jan Larwig <jan@larwig.com>

---------

Signed-off-by: stagswtf <142280349+stagswtf@users.noreply.github.com>
Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
This commit is contained in:
stagswtf
2025-10-28 08:37:25 +01:00
committed by GitHub
co-authored by Jan Larwig
parent c0a087d7f2
commit 51e80f24ef
3 changed files with 48 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sessions/persistence/ticket.go
+8 -3
View File
@@ -233,12 +233,17 @@ func (t *ticket) clearCookie(rw http.ResponseWriter, req *http.Request) {
// makeCookie makes a cookie, signing the value if present
func (t *ticket) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) (*http.Cookie, error) {
if value != "" {
var err error
value, err = encryption.SignedValue(t.options.Secret, t.options.Name, []byte(value), now)
secret, err := t.options.GetSecret()
if err != nil {
return nil, err
return nil, fmt.Errorf("retrieving secret failed: %w", err)
}
value, err = encryption.SignedValue(secret, t.options.Name, []byte(value), now)
if err != nil {
return nil, fmt.Errorf("signing cookie value failed: %w", err)
}
}
return cookies.MakeCookieFromOptions(
req,
t.options.Name,