3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-06-26 14:38:09 +02:00
Code Issues Projects Releases Packages Wiki Activity

forward-auth: fix special character support for nginx (#1578)

Browse source
This commit is contained in:
bobby 2020-11-12 10:10:57 -08:00 • committed by GitHub
parent eb19d6e125
commit c199909032
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 17 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.devcontainer/envs/nginx.yaml
View file

@ -1,7 +1,7 @@
version: "3" version: "3"
services: services:
nginx: nginx:
image: nginx image: openresty/openresty
restart: unless-stopped restart: unless-stopped
ports: ports:
- "80:80" - "80:80"

11
authorize/grpc.go
View file

@ -48,7 +48,7 @@ func (a *Authorize) Check(ctx context.Context, in *envoy_service_auth_v2.CheckRe
fwdAuthURI := getForwardAuthURL(hreq) fwdAuthURI := getForwardAuthURL(hreq)
in.Attributes.Request.Http.Scheme = fwdAuthURI.Scheme in.Attributes.Request.Http.Scheme = fwdAuthURI.Scheme
in.Attributes.Request.Http.Host = fwdAuthURI.Host in.Attributes.Request.Http.Host = fwdAuthURI.Host
in.Attributes.Request.Http.Path = fwdAuthURI.Path in.Attributes.Request.Http.Path = fwdAuthURI.EscapedPath()
if fwdAuthURI.RawQuery != "" { if fwdAuthURI.RawQuery != "" {
in.Attributes.Request.Http.Path += "?" + fwdAuthURI.RawQuery in.Attributes.Request.Http.Path += "?" + fwdAuthURI.RawQuery
} }
@ -194,8 +194,13 @@ func getForwardAuthURL(r *http.Request) *url.URL {
Path: r.Header.Get(httputil.HeaderForwardedURI), Path: r.Header.Get(httputil.HeaderForwardedURI),
} }
} }
// todo(bdd): handle httputil.HeaderOriginalURL which incorporates originalURL := r.Header.Get(httputil.HeaderOriginalURL)
// path and query params if originalURL != "" {
k, _ := urlutil.ParseAndValidateURL(originalURL)
if k != nil {
u = k
}
}
return u return u
} }

5
examples/nginx/httpbin.conf
View file

@ -37,7 +37,8 @@ server {
client_max_body_size 1m; client_max_body_size 1m;
# Pass the extracted client certificate to the auth provider # Pass the extracted client certificate to the auth provider
set $target http://pomerium/verify?uri=$scheme://$http_host$request_uri;
set $target http://pomerium/verify?uri=$scheme://$http_host$request_uri&rd=$pass_access_scheme://$http_host$escaped_request_uri;
proxy_pass $target; proxy_pass $target;
} }
@ -45,7 +46,7 @@ server {
internal; internal;
add_header Set-Cookie $auth_cookie; add_header Set-Cookie $auth_cookie;
return 302 return 302
https://fwdauth.localhost.pomerium.io/?uri=$scheme://$host$request_uri; https://fwdauth.localhost.pomerium.io/?uri=$scheme://$host$request_uri&rd=$pass_access_scheme://$http_host$escaped_request_uri;
} }
location / { location / {

2
examples/nginx/proxy.conf
View file

@ -19,6 +19,8 @@ proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection ""; proxy_set_header Connection "";
set_escape_uri $escaped_request_uri $request_uri;
# proxy_set_header X-Request-ID $req_id; # proxy_set_header X-Request-ID $req_id;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-For $remote_addr;

7
proxy/forward_auth.go
View file

@ -16,7 +16,6 @@ import (
// see : https://www.pomerium.io/configuration/#forward-auth // see : https://www.pomerium.io/configuration/#forward-auth
func (p *Proxy) registerFwdAuthHandlers() http.Handler { func (p *Proxy) registerFwdAuthHandlers() http.Handler {
r := httputil.NewRouter() r := httputil.NewRouter()
// NGNIX's forward-auth capabilities are split across two settings: // NGNIX's forward-auth capabilities are split across two settings:
// `auth-url` and `auth-signin` which correspond to `verify` and `auth-url` // `auth-url` and `auth-signin` which correspond to `verify` and `auth-url`
// //
@ -46,9 +45,9 @@ func (p *Proxy) registerFwdAuthHandlers() http.Handler {
r.Handle("/", httputil.HandlerFunc(p.startAuthN)). r.Handle("/", httputil.HandlerFunc(p.startAuthN)).
Queries(urlutil.QueryForwardAuthURI, "{uri}") Queries(urlutil.QueryForwardAuthURI, "{uri}")
// nginx 2 / traefik 1: verify and then start authenticate flow // otherwise, send a 200 OK for any other route.
r.Handle("/", httputil.HandlerFunc(p.allowUpstream)) // these routes do _not_ enforce authZ, they are helper routes.
r.NotFoundHandler = httputil.HandlerFunc(p.allowUpstream)
return r return r
} }