oauth2-proxy/pkg/cookies/cookies_test.go

package cookies

import (
	"fmt"
	"net/http"
	"time"

	middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
	. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"
)

var _ = Describe("Cookie Tests", func() {
	Context("GetCookieDomain", func() {
		type getCookieDomainTableInput struct {
			host string
			// rawHost sets req.Host after the request is built, for values a
			// URL cannot carry, such as a host whose port part is not numeric.
			rawHost        string
			xForwardedHost string
			cookieDomains  []string
			expectedOutput string
		}

		DescribeTable("should return expected results",
			func(in getCookieDomainTableInput) {
				req, err := http.NewRequest(
					http.MethodGet,
					fmt.Sprintf("https://%s/%s", in.host, cookiePath),
					nil,
				)
				Expect(err).ToNot(HaveOccurred())

				if in.rawHost != "" {
					req.Host = in.rawHost
				}

				if in.xForwardedHost != "" {
					req.Header.Add("X-Forwarded-Host", in.xForwardedHost)
					req.RemoteAddr = "127.0.0.1:4180"
					trustedProxies, err := ip.ParseNetSet([]string{"127.0.0.1"})
					Expect(err).ToNot(HaveOccurred())

					req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{
						ReverseProxy:   true,
						TrustedProxies: trustedProxies,
					})
				}

				Expect(GetCookieDomain(req, in.cookieDomains)).To(Equal(in.expectedOutput))
			},
			Entry("a single exact match for the Host header", getCookieDomainTableInput{
				host:           "www.cookies.test",
				cookieDomains:  []string{"www.cookies.test"},
				expectedOutput: "www.cookies.test",
			}),
			Entry("a single exact match for the X-Forwarded-Host header", getCookieDomainTableInput{
				host:           "backend.cookies.internal",
				xForwardedHost: "www.cookies.test",
				cookieDomains:  []string{"www.cookies.test"},
				expectedOutput: "www.cookies.test",
			}),
			Entry("a single suffix match for the Host header", getCookieDomainTableInput{
				host:           "www.cookies.test",
				cookieDomains:  []string{".cookies.test"},
				expectedOutput: ".cookies.test",
			}),
			Entry("a single suffix match for the X-Forwarded-Host header", getCookieDomainTableInput{
				host:           "backend.cookies.internal",
				xForwardedHost: "www.cookies.test",
				cookieDomains:  []string{".cookies.test"},
				expectedOutput: ".cookies.test",
			}),
			Entry("the first match is used", getCookieDomainTableInput{
				host:           "www.cookies.test",
				cookieDomains:  []string{"www.cookies.test", ".cookies.test"},
				expectedOutput: "www.cookies.test",
			}),
			Entry("the only match is used", getCookieDomainTableInput{
				host:           "www.cookies.test",
				cookieDomains:  []string{".cookies.wrong", ".cookies.test"},
				expectedOutput: ".cookies.test",
			}),
			Entry("blank is returned for no matches", getCookieDomainTableInput{
				host:           "www.cookies.test",
				cookieDomains:  []string{".cookies.wrong", ".cookies.false"},
				expectedOutput: "",
			}),
			Entry("a Host header carrying a port", getCookieDomainTableInput{
				host:           "www.cookies.test:443",
				cookieDomains:  []string{".cookies.test"},
				expectedOutput: ".cookies.test",
			}),
			Entry("an X-Forwarded-Host header carrying a port", getCookieDomainTableInput{
				host:           "backend.cookies.internal",
				xForwardedHost: "www.cookies.test:443",
				cookieDomains:  []string{".cookies.test"},
				expectedOutput: ".cookies.test",
			}),
			Entry("a non-standard port", getCookieDomainTableInput{
				host:           "www.cookies.test:8443",
				cookieDomains:  []string{".cookies.test"},
				expectedOutput: ".cookies.test",
			}),
			Entry("a host with a port that matches no domain", getCookieDomainTableInput{
				host:           "www.example.com:443",
				cookieDomains:  []string{".cookies.test"},
				expectedOutput: "",
			}),
			Entry("a Host header whose port part looks like a cookie domain", getCookieDomainTableInput{
				host:           "backend.cookies.internal",
				rawHost:        "evil.com:.cookies.test",
				cookieDomains:  []string{".cookies.test"},
				expectedOutput: "",
			}),
			Entry("a Host header whose port part ends in a cookie domain", getCookieDomainTableInput{
				host:           "backend.cookies.internal",
				rawHost:        "evil.com:443.cookies.test",
				cookieDomains:  []string{".cookies.test"},
				expectedOutput: "",
			}),
			Entry("an X-Forwarded-Host header whose port part looks like a cookie domain", getCookieDomainTableInput{
				host:           "backend.cookies.internal",
				xForwardedHost: "evil.com:.cookies.test",
				cookieDomains:  []string{".cookies.test"},
				expectedOutput: "",
			}),
			Entry("an X-Forwarded-Host header whose port part ends in a cookie domain", getCookieDomainTableInput{
				host:           "backend.cookies.internal",
				xForwardedHost: "evil.com:443.cookies.test",
				cookieDomains:  []string{".cookies.test"},
				expectedOutput: "",
			}),
		)
	})

	Context("MakeCookieFromOptions", func() {
		type makeCookieFromOptionsTableInput struct {
			host           string
			opts           CookieOptions
			now            time.Time
			expectedOutput int
		}

		validName := "_oauth2_proxy"
		domains := []string{"www.cookies.test"}

		now := time.Now()
		var expectedMaxAge int

		DescribeTable("should return cookies with or without expiration",
			func(in makeCookieFromOptionsTableInput) {
				req, err := http.NewRequest(
					http.MethodGet,
					fmt.Sprintf("https://%s/%s", in.host, cookiePath),
					nil,
				)
				Expect(err).ToNot(HaveOccurred())

				Expect(MakeCookieFromOptions(req, &in.opts).MaxAge).To(Equal(in.expectedOutput))
			},
			Entry("persistent cookie", makeCookieFromOptionsTableInput{
				host: "www.cookies.test",
				opts: CookieOptions{
					Name:       validName,
					Value:      "1",
					Domains:    domains,
					Expiration: 15 * time.Minute,
					SameSite:   "",
					Path:       "",
					HTTPOnly:   false,
					Secure:     true,
				},
				now:            now,
				expectedOutput: int((15 * time.Minute).Seconds()),
			}),
			Entry("persistent cookie to be cleared", makeCookieFromOptionsTableInput{
				host: "www.cookies.test",
				opts: CookieOptions{
					Name:       validName,
					Value:      "1",
					Domains:    domains,
					Expiration: time.Hour * -1,
					SameSite:   "",
					Path:       "",
					HTTPOnly:   false,
					Secure:     true,
				},
				now:            now,
				expectedOutput: -1,
			}),
			Entry("session cookie", makeCookieFromOptionsTableInput{
				host: "www.cookies.test",
				opts: CookieOptions{
					Name:       validName,
					Value:      "1",
					Domains:    domains,
					Expiration: 0,
					SameSite:   "",
					Path:       "",
					HTTPOnly:   false,
					Secure:     true,
				},
				now:            now,
				expectedOutput: expectedMaxAge,
			}),
		)
	})
})