public_git/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2026-10-18 04:41:19 +02:00
Code Issues Projects Releases Wiki Activity

fix: self signed certificate handling

Browse Source
This commit is contained in:
tuunit
2024-10-05 17:29:37 +02:00
parent cda641473f
commit 8fd7312a90
2 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/validation/options.go
+7 -6
View File
@@ -13,6 +13,7 @@ import (
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
)
@@ -30,20 +31,20 @@ func Validate(o *options.Options) error {
msgs = parseSignatureKey(o, msgs)
if o.SSLInsecureSkipVerify {
insecureTransport := &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
}
http.DefaultClient = &http.Client{Transport: insecureTransport}
transport := requests.DefaultTransport.Next.(*http.Transport).Clone()
transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
requests.DefaultHTTPClient = &http.Client{Transport: transport}
} else if len(o.Providers[0].CAFiles) > 0 {
pool, err := util.GetCertPool(o.Providers[0].CAFiles, o.Providers[0].UseSystemTrustStore)
if err == nil {
transport := http.DefaultTransport.(*http.Transport).Clone()
transport := requests.DefaultTransport.Next.(*http.Transport).Clone()
transport.TLSClientConfig = &tls.Config{
RootCAs: pool,
MinVersion: tls.VersionTLS12,
}
http.DefaultClient = &http.Client{Transport: transport}
requests.DefaultHTTPClient = &http.Client{Transport: transport}
} else {
msgs = append(msgs, fmt.Sprintf("unable to load provider CA file(s): %v", err))
}