mirror of
https://github.com/oauth2-proxy/oauth2-proxy.git
synced 2026-10-18 04:41:19 +02:00
kirilju
8f8d1f4eb3
* Strip the port from the request host when matching cookie domains GetCookieDomain suffix-matches the request host against each configured cookie domain. When a reverse proxy rewrites the Host header to the upstream's address, that host arrives as "host:port" and never matches, so the request falls through to the "did not match any of the specific cookie domains" warning and the shortest configured domain is used. One way to hit this is Traefik's Errors middleware: it fetches a page from a Service on port 443 with passHostHeader disabled, and forwards the Host as "<host>:443". The request reaches oauth2-proxy correctly and the resulting cookie is still usable, but every such request logs an error that suggests a misconfiguration when none exists. warnInvalidDomain, a few lines below in the same file, already calls net.SplitHostPort on the host before comparing it to the cookie domain. This makes GetCookieDomain consistent with it. Tests cover a Host header with a port, an X-Forwarded-Host header with a port, a non-standard port, and a host with a port that matches no configured domain. Signed-off-by: Kiril Jurbinsky <kiril@instaffo.com> * chore: add changelog entry for #3546 Signed-off-by: Kiril Jurbinsky <kiril@instaffo.com> * test: keep the new port entries at the end of the table The port cases were inserted between the Host and X-Forwarded-Host variants of the existing suffix-match case, which split a pair that reads as one. Move them after the last existing entry instead. Signed-off-by: Kiril Jurbinsky <kiril@instaffo.com> * test: pin that a port part can no longer match a cookie domain SplitHostPort does not require the port to be numeric, so a host such as "evil.com:.cookies.test" used to suffix-match a configured cookie domain through its port part, and the cookie was then set for that domain. Matching now runs against the host alone, so it does not. Covers both the Host header and X-Forwarded-Host, since GetRequestHost returns one or the other into the same comparison. A Host of this shape cannot be expressed through the request URL, because http.NewRequest rejects it as an invalid port, so the table gains a rawHost field that assigns req.Host after the request is built. That is how a server populates it from the wire, and pkg/upstream and pkg/middleware already set req.Host the same way in their tests. Thanks to @Lrifton92 for spotting this. Signed-off-by: Kiril Jurbinsky <kiril@instaffo.com> --------- Signed-off-by: Kiril Jurbinsky <kiril@instaffo.com>
110 lines
2.9 KiB
Go
110 lines
2.9 KiB
Go
package cookies
|
|
|
|
import (
|
|
"fmt"
|
|
"net"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
|
|
requestutil "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests/util"
|
|
)
|
|
|
|
type CookieOptions struct {
|
|
Name string
|
|
Value string
|
|
Domains []string
|
|
Expiration time.Duration
|
|
SameSite string
|
|
Path string
|
|
HTTPOnly bool
|
|
Secure bool
|
|
}
|
|
|
|
// MakeCookieFromOptions constructs a cookie based on the given *options.CookieOptions,
|
|
// value and creation time
|
|
func MakeCookieFromOptions(req *http.Request, opts *CookieOptions) *http.Cookie {
|
|
domain := GetCookieDomain(req, opts.Domains)
|
|
// If nothing matches, create the cookie with the shortest domain
|
|
if domain == "" && len(opts.Domains) > 0 {
|
|
logger.Errorf("Warning: request host %q did not match any of the specific cookie domains of %q",
|
|
requestutil.GetRequestHost(req),
|
|
strings.Join(opts.Domains, ","),
|
|
)
|
|
domain = opts.Domains[len(opts.Domains)-1]
|
|
}
|
|
|
|
c := &http.Cookie{
|
|
Name: opts.Name,
|
|
Value: opts.Value,
|
|
Path: opts.Path,
|
|
Domain: domain,
|
|
HttpOnly: opts.HTTPOnly,
|
|
Secure: opts.Secure,
|
|
SameSite: ParseSameSite(opts.SameSite),
|
|
}
|
|
|
|
if opts.Expiration > time.Duration(0) {
|
|
c.MaxAge = int(opts.Expiration.Seconds())
|
|
} else if opts.Expiration < time.Duration(0) {
|
|
c.MaxAge = -1
|
|
}
|
|
|
|
warnInvalidDomain(c, req)
|
|
|
|
return c
|
|
}
|
|
|
|
// GetCookieDomain returns the correct cookie domain given a list of domains
|
|
// by checking the X-Fowarded-Host and host header of an an http request
|
|
func GetCookieDomain(req *http.Request, cookieDomains []string) string {
|
|
host := requestutil.GetRequestHost(req)
|
|
// Strip any port before matching. A reverse proxy that rewrites the Host
|
|
// header to the upstream's address (for example Traefik's Errors
|
|
// middleware pointing at a Service on port 443) sends "host:port", which
|
|
// would never suffix-match a configured domain. warnInvalidDomain below
|
|
// already normalises the host this way.
|
|
if h, _, err := net.SplitHostPort(host); err == nil {
|
|
host = h
|
|
}
|
|
for _, domain := range cookieDomains {
|
|
if strings.HasSuffix(host, domain) {
|
|
return domain
|
|
}
|
|
}
|
|
return ""
|
|
}
|
|
|
|
// ParseSameSite a valid http.SameSite value from a user supplied string for use of making cookies.
|
|
func ParseSameSite(v string) http.SameSite {
|
|
switch v {
|
|
case "lax":
|
|
return http.SameSiteLaxMode
|
|
case "strict":
|
|
return http.SameSiteStrictMode
|
|
case "none":
|
|
return http.SameSiteNoneMode
|
|
case "":
|
|
return 0
|
|
default:
|
|
panic(fmt.Sprintf("Invalid value for SameSite: %s", v))
|
|
}
|
|
}
|
|
|
|
// warnInvalidDomain logs a warning if the request host and cookie domain are
|
|
// mismatched.
|
|
func warnInvalidDomain(c *http.Cookie, req *http.Request) {
|
|
if c.Domain == "" {
|
|
return
|
|
}
|
|
|
|
host := requestutil.GetRequestHost(req)
|
|
if h, _, err := net.SplitHostPort(host); err == nil {
|
|
host = h
|
|
}
|
|
if !strings.HasSuffix(host, c.Domain) {
|
|
logger.Errorf("Warning: request host is %q but using configured cookie domain of %q", host, c.Domain)
|
|
}
|
|
}
|