Request ID Logging (#1087)

* Add RequestID to the RequestScope

* Expose RequestID to auth & request loggers

* Use the RequestID in templated HTML pages

* Allow customizing the RequestID header

* Document new Request ID support

* Add more cases to scope/requestID tests

* Split Get vs Generate RequestID funtionality

* Add {{.RequestID}} to the request logger tests

* Move RequestID management to RequestScope

* Use HTML escape instead of sanitization for Request ID rendering

pkg/middleware/scope.go

@@ -3,18 +3,31 @@ package middleware
 import (
 	"net/http"
 
+	"github.com/google/uuid"
 	"github.com/justinas/alice"
 	middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
 )
 
-func NewScope(reverseProxy bool) alice.Constructor {
+func NewScope(reverseProxy bool, idHeader string) alice.Constructor {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 			scope := &middlewareapi.RequestScope{
 				ReverseProxy: reverseProxy,
+				RequestID:    genRequestID(req, idHeader),
 			}
 			req = middlewareapi.AddRequestScope(req, scope)
 			next.ServeHTTP(rw, req)
 		})
 	}
 }
+
+// genRequestID sets a request-wide ID for use in logging or error pages.
+// If a RequestID header is set, it uses that. Otherwise, it generates a random
+// UUID for the lifespan of the request.
+func genRequestID(req *http.Request, idHeader string) string {
+	rid := req.Header.Get(idHeader)
+	if rid != "" {
+		return rid
+	}
+	return uuid.New().String()
+}