public_git/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2026-09-30 03:31:27 +02:00
Code Issues Projects Releases Wiki Activity

Move Logging to Middleware Package (#1070)

Browse Source 
* Use a specialized ResponseWriter in middleware

* Track User & Upstream in RequestScope

* Wrap responses in our custom ResponseWriter

* Add tests for logging middleware

* Inject upstream metadata into request scope

* Use custom ResponseWriter only in logging middleware

* Assume RequestScope is never nil
This commit is contained in:
Nick Meves
2021-03-06 17:27:16 +00:00
committed by GitHub
parent 220b3708fc
commit 602dac7852
16 changed files with 337 additions and 266 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/upstream/file.go
+7 -1
View File
@@ -4,6 +4,8 @@ import (
"net/http"
"runtime"
"strings"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
)
const fileScheme = "file"
@@ -37,6 +39,10 @@ type fileServer struct {
// ServeHTTP proxies requests to the upstream provider while signing the
// request headers
func (u *fileServer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
rw.Header().Set("GAP-Upstream-Address", u.upstream)
scope := middleware.GetRequestScope(req)
// If scope is nil, this will panic.
// A scope should always be injected before this handler is called.
scope.Upstream = u.upstream
u.handler.ServeHTTP(rw, req)
}
pkg/upstream/file_test.go
+6 -1
View File
@@ -7,6 +7,7 @@ import (
"net/http/httptest"
"os"
middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
. "github.com/onsi/ginkgo"
. "github.com/onsi/ginkgo/extensions/table"
. "github.com/onsi/gomega"
@@ -42,10 +43,14 @@ var _ = Describe("File Server Suite", func() {
DescribeTable("fileServer ServeHTTP",
func(requestPath string, expectedResponseCode int, expectedBody string) {
req := httptest.NewRequest("", requestPath, nil)
req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{})
rw := httptest.NewRecorder()
handler.ServeHTTP(rw, req)
Expect(rw.Header().Get("GAP-Upstream-Address")).To(Equal(id))
scope := middlewareapi.GetRequestScope(req)
Expect(scope.Upstream).To(Equal(id))
Expect(rw.Code).To(Equal(expectedResponseCode))
Expect(rw.Body.String()).To(Equal(expectedBody))
},
pkg/upstream/http.go
+7 -1
View File
@@ -8,6 +8,7 @@ import (
"strings"
"github.com/mbland/hmacauth"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
"github.com/yhat/wsutil"
)
@@ -76,7 +77,12 @@ type httpUpstreamProxy struct {
// ServeHTTP proxies requests to the upstream provider while signing the
// request headers
func (h *httpUpstreamProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
rw.Header().Set("GAP-Upstream-Address", h.upstream)
scope := middleware.GetRequestScope(req)
// If scope is nil, this will panic.
// A scope should always be injected before this handler is called.
scope.Upstream = h.upstream
// TODO (@NickMeves) - Deprecate GAP-Signature & remove GAP-Auth
if h.auth != nil {
req.Header.Set("GAP-Auth", rw.Header().Get("GAP-Auth"))
h.auth.SignRequest(req)
pkg/upstream/http_test.go
+21 -15
View File
@@ -13,7 +13,9 @@ import (
"strings"
"time"
middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/middleware"
. "github.com/onsi/ginkgo"
. "github.com/onsi/ginkgo/extensions/table"
. "github.com/onsi/gomega"
@@ -36,6 +38,7 @@ var _ = Describe("HTTP Upstream Suite", func() {
signatureData *options.SignatureData
existingHeaders map[string]string
expectedResponse testHTTPResponse
expectedUpstream string
errorHandler ProxyErrorHandler
}
@@ -50,6 +53,7 @@ var _ = Describe("HTTP Upstream Suite", func() {
req.Header.Add(key, value)
}
req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{})
rw := httptest.NewRecorder()
flush := options.Duration(1 * time.Second)
@@ -71,6 +75,9 @@ var _ = Describe("HTTP Upstream Suite", func() {
Expect(rw.Code).To(Equal(in.expectedResponse.code))
scope := middlewareapi.GetRequestScope(req)
Expect(scope.Upstream).To(Equal(in.expectedUpstream))
// Delete extra headers that aren't relevant to tests
testSanitizeResponseHeader(rw.Header())
Expect(rw.Header()).To(Equal(in.expectedResponse.header))
@@ -97,7 +104,6 @@ var _ = Describe("HTTP Upstream Suite", func() {
expectedResponse: testHTTPResponse{
code: 200,
header: map[string][]string{
gapUpstream: {"default"},
contentType: {applicationJSON},
},
request: testHTTPRequest{
@@ -109,6 +115,7 @@ var _ = Describe("HTTP Upstream Suite", func() {
RequestURI: "http://example.localhost/foo",
},
},
expectedUpstream: "default",
}),
Entry("request a path with encoded slashes", &httpUpstreamTableInput{
id: "encodedSlashes",
@@ -120,7 +127,6 @@ var _ = Describe("HTTP Upstream Suite", func() {
expectedResponse: testHTTPResponse{
code: 200,
header: map[string][]string{
gapUpstream: {"encodedSlashes"},
contentType: {applicationJSON},
},
request: testHTTPRequest{
@@ -132,6 +138,7 @@ var _ = Describe("HTTP Upstream Suite", func() {
RequestURI: "http://example.localhost/foo%2fbar/?baz=1",
},
},
expectedUpstream: "encodedSlashes",
}),
Entry("when the request has a body", &httpUpstreamTableInput{
id: "requestWithBody",
@@ -143,7 +150,6 @@ var _ = Describe("HTTP Upstream Suite", func() {
expectedResponse: testHTTPResponse{
code: 200,
header: map[string][]string{
gapUpstream: {"requestWithBody"},
contentType: {applicationJSON},
},
request: testHTTPRequest{
@@ -157,6 +163,7 @@ var _ = Describe("HTTP Upstream Suite", func() {
RequestURI: "http://example.localhost/withBody",
},
},
expectedUpstream: "requestWithBody",
}),
Entry("when the upstream is unavailable", &httpUpstreamTableInput{
id: "unavailableUpstream",
@@ -166,12 +173,11 @@ var _ = Describe("HTTP Upstream Suite", func() {
body: []byte{},
errorHandler: nil,
expectedResponse: testHTTPResponse{
code: 502,
header: map[string][]string{
gapUpstream: {"unavailableUpstream"},
},
code: 502,
header: map[string][]string{},
request: testHTTPRequest{},
},
expectedUpstream: "unavailableUpstream",
}),
Entry("when the upstream is unavailable and an error handler is set", &httpUpstreamTableInput{
id: "withErrorHandler",
@@ -184,13 +190,12 @@ var _ = Describe("HTTP Upstream Suite", func() {
rw.Write([]byte("error"))
},
expectedResponse: testHTTPResponse{
code: 502,
header: map[string][]string{
gapUpstream: {"withErrorHandler"},
},
code: 502,
header: map[string][]string{},
raw: "error",
request: testHTTPRequest{},
},
expectedUpstream: "withErrorHandler",
}),
Entry("with a signature", &httpUpstreamTableInput{
id: "withSignature",
@@ -207,7 +212,6 @@ var _ = Describe("HTTP Upstream Suite", func() {
code: 200,
header: map[string][]string{
contentType: {applicationJSON},
gapUpstream: {"withSignature"},
},
request: testHTTPRequest{
Method: "GET",
@@ -221,6 +225,7 @@ var _ = Describe("HTTP Upstream Suite", func() {
RequestURI: "http://example.localhost/withSignature",
},
},
expectedUpstream: "withSignature",
}),
Entry("with existing headers", &httpUpstreamTableInput{
id: "existingHeaders",
@@ -236,7 +241,6 @@ var _ = Describe("HTTP Upstream Suite", func() {
expectedResponse: testHTTPResponse{
code: 200,
header: map[string][]string{
gapUpstream: {"existingHeaders"},
contentType: {applicationJSON},
},
request: testHTTPRequest{
@@ -251,11 +255,13 @@ var _ = Describe("HTTP Upstream Suite", func() {
RequestURI: "http://example.localhost/existingHeaders",
},
},
expectedUpstream: "existingHeaders",
}),
)
It("ServeHTTP, when not passing a host header", func() {
req := httptest.NewRequest("", "http://example.localhost/foo", nil)
req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{})
rw := httptest.NewRecorder()
flush := options.Duration(1 * time.Second)
@@ -383,7 +389,8 @@ var _ = Describe("HTTP Upstream Suite", func() {
Expect(err).ToNot(HaveOccurred())
handler := newHTTPUpstreamProxy(upstream, u, nil, nil)
proxyServer = httptest.NewServer(handler)
proxyServer = httptest.NewServer(middleware.NewScope(false)(handler))
})
AfterEach(func() {
@@ -414,7 +421,6 @@ var _ = Describe("HTTP Upstream Suite", func() {
response, err := http.Get(fmt.Sprintf("http://%s", proxyServer.Listener.Addr().String()))
Expect(err).ToNot(HaveOccurred())
Expect(response.StatusCode).To(Equal(200))
Expect(response.Header.Get(gapUpstream)).To(Equal("websocketProxy"))
})
})
})
pkg/upstream/proxy_test.go
+23 -18
View File
@@ -7,6 +7,7 @@ import (
"net/http"
"net/http/httptest"
middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
. "github.com/onsi/ginkgo"
. "github.com/onsi/ginkgo/extensions/table"
@@ -64,17 +65,24 @@ var _ = Describe("Proxy Suite", func() {
type proxyTableInput struct {
target string
response testHTTPResponse
upstream string
}
DescribeTable("Proxy ServerHTTP",
DescribeTable("Proxy ServeHTTP",
func(in *proxyTableInput) {
req := httptest.NewRequest("", in.target, nil)
req := middlewareapi.AddRequestScope(
httptest.NewRequest("", in.target, nil),
&middlewareapi.RequestScope{},
)
rw := httptest.NewRecorder()
// Don't mock the remote Address
req.RemoteAddr = ""
upstreamServer.ServeHTTP(rw, req)
scope := middlewareapi.GetRequestScope(req)
Expect(scope.Upstream).To(Equal(in.upstream))
Expect(rw.Code).To(Equal(in.response.code))
// Delete extra headers that aren't relevant to tests
@@ -99,7 +107,6 @@ var _ = Describe("Proxy Suite", func() {
response: testHTTPResponse{
code: 200,
header: map[string][]string{
gapUpstream: {"http-backend"},
contentType: {applicationJSON},
},
request: testHTTPRequest{
@@ -114,6 +121,7 @@ var _ = Describe("Proxy Suite", func() {
RequestURI: "http://example.localhost/http/1234",
},
},
upstream: "http-backend",
}),
Entry("with a request to the File backend", &proxyTableInput{
target: "http://example.localhost/files/foo",
@@ -121,31 +129,29 @@ var _ = Describe("Proxy Suite", func() {
code: 200,
header: map[string][]string{
contentType: {textPlainUTF8},
gapUpstream: {"file-backend"},
},
raw: "foo",
},
upstream: "file-backend",
}),
Entry("with a request to the Static backend", &proxyTableInput{
target: "http://example.localhost/static/bar",
response: testHTTPResponse{
code: 200,
header: map[string][]string{
gapUpstream: {"static-backend"},
},
raw: "Authenticated",
code: 200,
header: map[string][]string{},
raw: "Authenticated",
},
upstream: "static-backend",
}),
Entry("with a request to the bad HTTP backend", &proxyTableInput{
target: "http://example.localhost/bad-http/bad",
response: testHTTPResponse{
code: 502,
header: map[string][]string{
gapUpstream: {"bad-http-backend"},
},
code: 502,
header: map[string][]string{},
// This tests the error handler
raw: "Proxy Error",
},
upstream: "bad-http-backend",
}),
Entry("with a request to the to an unregistered path", &proxyTableInput{
target: "http://example.localhost/unregistered",
@@ -161,12 +167,11 @@ var _ = Describe("Proxy Suite", func() {
Entry("with a request to the to backend registered to a single path", &proxyTableInput{
target: "http://example.localhost/single-path",
response: testHTTPResponse{
code: 200,
header: map[string][]string{
gapUpstream: {"single-path-backend"},
},
raw: "Authenticated",
code: 200,
header: map[string][]string{},
raw: "Authenticated",
},
upstream: "single-path-backend",
}),
Entry("with a request to the to a subpath of a backend registered to a single path", &proxyTableInput{
target: "http://example.localhost/single-path/unregistered",
pkg/upstream/static.go
+12 -2
View File
@@ -3,6 +3,9 @@ package upstream
import (
"fmt"
"net/http"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
)
const defaultStaticResponseCode = 200
@@ -24,9 +27,16 @@ type staticResponseHandler struct {
// ServeHTTP serves a static response.
func (s *staticResponseHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
rw.Header().Set("GAP-Upstream-Address", s.upstream)
scope := middleware.GetRequestScope(req)
// If scope is nil, this will panic.
// A scope should always be injected before this handler is called.
scope.Upstream = s.upstream
rw.WriteHeader(s.code)
fmt.Fprintf(rw, "Authenticated")
_, err := fmt.Fprintf(rw, "Authenticated")
if err != nil {
logger.Errorf("Error writing static response: %v", err)
}
}
// derefStaticCode returns the derefenced value, or the default if the value is nil
pkg/upstream/static_test.go
+6 -1
View File
@@ -6,6 +6,7 @@ import (
"net/http"
"net/http/httptest"
middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
. "github.com/onsi/ginkgo"
. "github.com/onsi/ginkgo/extensions/table"
. "github.com/onsi/gomega"
@@ -40,10 +41,14 @@ var _ = Describe("Static Response Suite", func() {
handler := newStaticResponseHandler(id, code)
req := httptest.NewRequest("", in.requestPath, nil)
req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{})
rw := httptest.NewRecorder()
handler.ServeHTTP(rw, req)
Expect(rw.Header().Get("GAP-Upstream-Address")).To(Equal(id))
scope := middlewareapi.GetRequestScope(req)
Expect(scope.Upstream).To(Equal(id))
Expect(rw.Code).To(Equal(in.expectedCode))
Expect(rw.Body.String()).To(Equal(in.expectedBody))
},
pkg/upstream/upstream_suite_test.go
-1
View File
@@ -59,7 +59,6 @@ const (
acceptEncoding = "Accept-Encoding"
applicationJSON = "application/json"
textPlainUTF8 = "text/plain; charset=utf-8"
gapUpstream = "Gap-Upstream-Address"
gapAuth = "Gap-Auth"
gapSignature = "Gap-Signature"
)