Why does louketo send User Agents to the authorization server with 307?

[ackerleytng]

Summary

Was testing a protected endpoint using POST, and I was redirected to /oauth/authorize on louketo with a 307, and then subsequently redirected to my authorization server (Keycloak) with a 307.

Environment

Looking at

louketo-proxy/handlers.go

Line 70 in f623dee

func (r *oauthProxy) oauthAuthorizationHandler(w http.ResponseWriter, req *http.Request) {

(Not environment specific)

Expected Results

I thought we should be sending User-Agents to the authorization server with a 303, as 303 hints the User-Agent to use a GET (https://tools.ietf.org/html/rfc2616#section-10.3.4)

I think the method itself isn't so much of an issue, but sending a 307 suggests that the User-Agent can repeat the original request on the new URI, which might leak something to the authorization provider.

Actual Results

Louketo tries to send the User-Agent to the authorization server with a 307.

Steps to reproduce

Set up louketo to proxy a protected endpoint and try POSTing to an endpoint requiring authentication

Additional Information

Related question: In redirectToAuthorization, why is the default 307? I was thinking that there isn't really a reason to have 307, since 307 would encourage the User-Agent to repeat the original request on the new URI, with the original method and data, etc, which probably isn't necessary since louketo's /oauth/authorize endpoint isn't going to make use of all that.

[abstractj]

@ackerleytng thanks for reporting this, it should be fixed here #628. Please review, whenever you have some time.

[ackerleytng]

Thanks @abstractj , it looks great! I've also left a comment on your PR.