-
Notifications
You must be signed in to change notification settings - Fork 72
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Configure oauth-proxy with random cookie secret
The oauth-proxy uses the cookie secret as a key to sign and validate session cookies. This change generates a random 32 byte key and stores it in the skupper-console-session secret to be used by the proxy for this purpose. Signed-off-by: Christian Kruse <christian@c-kruse.com> Improve error handling per review Signed-off-by: Christian Kruse <christian@c-kruse.com>
- Loading branch information
Showing
6 changed files
with
215 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| package kube | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "crypto/rand" | ||
| "fmt" | ||
| "io" | ||
| "testing" | ||
|
|
||
| "github.com/skupperproject/skupper/api/types" | ||
| "gotest.tools/assert" | ||
| ) | ||
|
|
||
| func TestGenerateConsoleSessionCredentials(t *testing.T) { | ||
| zeros := bytes.NewReader(make([]byte, 128)) | ||
| const zerosEncoded = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" | ||
|
|
||
| exampleText := "GenerateConsoleSessionCredentials" | ||
| exampleTextEncoded := "R2VuZXJhdGVDb25zb2xlU2Vzc2lvbkNyZWRlbnRpYWw=" | ||
|
|
||
| testcases := []struct { | ||
| Input io.Reader | ||
| CheckData func(map[string][]byte) error | ||
| }{ | ||
| { | ||
| Input: zeros, | ||
| CheckData: func(data map[string][]byte) error { | ||
| if string(data["session_secret"]) != zerosEncoded { | ||
| return fmt.Errorf("session secret should have been %q but got %v", zerosEncoded, data) | ||
| } | ||
| return nil | ||
| }, | ||
| }, | ||
| { | ||
| Input: nil, | ||
| CheckData: func(data map[string][]byte) error { | ||
| if len(data["session_secret"]) != 44 { | ||
| return fmt.Errorf("session secret should have been 44 bytes long but got %v", data) | ||
| } | ||
| return nil | ||
| }, | ||
| }, | ||
| { | ||
| Input: rand.Reader, | ||
| CheckData: func(data map[string][]byte) error { | ||
| if len(data["session_secret"]) != 44 { | ||
| return fmt.Errorf("session secret should have been 44 bytes long but got %v", data) | ||
| } | ||
| return nil | ||
| }, | ||
| }, | ||
| { | ||
| Input: bytes.NewReader([]byte(exampleText)), | ||
| CheckData: func(data map[string][]byte) error { | ||
| if string(data["session_secret"]) != exampleTextEncoded { | ||
| return fmt.Errorf("session secret should have been %q but got %v", exampleTextEncoded, data) | ||
| } | ||
| return nil | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| for _, tc := range testcases { | ||
| t.Run("", func(t *testing.T) { | ||
| creds, err := GenerateConsoleSessionCredentials(tc.Input) | ||
| assert.Assert(t, err) | ||
| assert.Equal(t, creds.Name, types.ConsoleSessionSecret) | ||
| assert.Assert(t, tc.CheckData(creds.Data)) | ||
| }) | ||
| } | ||
| } |