mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-30 19:06:33 +02:00
8d1732582e
authenticate: unmarshal and verify state from jwt, instead of middleware
authorize: embed opa policy using statik
authorize: have IsAuthorized handle authorization for all routes
authorize: if no signing key is provided, one is generated
authorize: remove IsAdmin grpc endpoint
authorize/client: return authorize decision struct
cmd/pomerium: main logger no longer contains email and group
cryptutil: add ECDSA signing methods
dashboard: have impersonate form show up for all users, but have api gated by authz
docs: fix typo in signed jwt header
encoding/jws: remove unused es256 signer
frontend: namespace static web assets
internal/sessions: remove leeway to match authz policy
proxy: move signing functionality to authz
proxy: remove jwt attestation from proxy (authZ does now)
proxy: remove non-signed headers from headers
proxy: remove special handling of x-forwarded-host
sessions: do not verify state in middleware
sessions: remove leeway from state to match authz
sessions/{all}: store jwt directly instead of state
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
60 lines
2.4 KiB
Go
60 lines
2.4 KiB
Go
package httputil // import "github.com/pomerium/pomerium/internal/httputil"
|
|
|
|
// Pomerium headers contain information added to a request.
|
|
const (
|
|
// HeaderPomeriumResponse is set when pomerium itself creates a response,
|
|
// as opposed to the downstream application and can be used to distinguish
|
|
// between an application error, and a pomerium related error when debugging.
|
|
// Especially useful when working with single page apps (SPA).
|
|
HeaderPomeriumResponse = "x-pomerium-intercepted-response"
|
|
// HeaderPomeriumJWTAssertion is the header key containing JWT signed user details.
|
|
HeaderPomeriumJWTAssertion = "x-pomerium-jwt-assertion"
|
|
)
|
|
|
|
// HeadersContentSecurityPolicy are the content security headers added to the service's handlers
|
|
// by default includes profile photo exceptions for supported identity providers.
|
|
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
|
|
var HeadersContentSecurityPolicy = map[string]string{
|
|
"Content-Security-Policy": "default-src 'none'; style-src 'self'; img-src *;",
|
|
"Referrer-Policy": "Same-origin",
|
|
}
|
|
|
|
// Forward headers contains information from the client-facing side of proxy
|
|
// servers that is altered or lost when a proxy is involved in the path of the
|
|
// request.
|
|
//
|
|
// https://tools.ietf.org/html/rfc7239
|
|
// https://en.wikipedia.org/wiki/X-Forwarded-For
|
|
const (
|
|
HeaderForwardedFor = "X-Forwarded-For"
|
|
HeaderForwardedHost = "X-Forwarded-Host"
|
|
HeaderForwardedMethod = "X-Forwarded-Method" // traefik
|
|
HeaderForwardedPort = "X-Forwarded-Port"
|
|
HeaderForwardedProto = "X-Forwarded-Proto"
|
|
HeaderForwardedServer = "X-Forwarded-Server"
|
|
HeaderForwardedURI = "X-Forwarded-Uri" // traefik
|
|
HeaderOriginalMethod = "X-Original-Method" // nginx
|
|
HeaderOriginalURL = "X-Original-Url" // nginx
|
|
HeaderRealIP = "X-Real-Ip"
|
|
HeaderSentFrom = "X-Sent-From"
|
|
)
|
|
|
|
// HeadersXForwarded is the slice of the header keys used to contain information
|
|
// from the client-facing side of proxy servers that is altered or lost when a
|
|
// proxy is involved in the path of the request.
|
|
//
|
|
// https://tools.ietf.org/html/rfc7239
|
|
// https://en.wikipedia.org/wiki/X-Forwarded-For
|
|
var HeadersXForwarded = []string{
|
|
HeaderForwardedFor,
|
|
HeaderForwardedHost,
|
|
HeaderForwardedMethod,
|
|
HeaderForwardedPort,
|
|
HeaderForwardedProto,
|
|
HeaderForwardedServer,
|
|
HeaderForwardedURI,
|
|
HeaderOriginalMethod,
|
|
HeaderOriginalURL,
|
|
HeaderRealIP,
|
|
HeaderSentFrom,
|
|
}
|