Skip to content

Commit 0c210f1

Browse files
zhaohuabingzhaohuabing
authored
Add nonce support to the oauth2 example verifications (#129)
Signed-off-by: Huabing Zhao <[email protected]>
1 parent 86c9924 commit 0c210f1

File tree

2 files changed

+84
-21
lines changed

2 files changed

+84
-21
lines changed

‎single-page-app/docker-compose.yml

+6
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,12 @@ services:
4444
- ${SECRETS_PATH:-./secrets}:/etc/envoy/secrets
4545
- ${XDS_PATH:-./xds}:/var/lib/envoy
4646
- ${UI_PATH:-./ui}/dist:/var/www/html
47+
healthcheck:
48+
test: ["CMD", "curl", "-f", "http://localhost:10001"]
49+
interval: 1s
50+
timeout: 1s
51+
retries: 5
52+
start_period: 1s
4753

4854
myhub:
4955
build:

‎single-page-app/verify.sh

+78-21
Original file line numberDiff line numberDiff line change
@@ -118,29 +118,66 @@ test_auth () {
118118
"${proxy_scheme}://localhost:${proxy_port}" \
119119
"${curl_args[@]}"
120120

121+
# To enhance security,the nonce will always be used in the OAuth2 flow once PR https://github.com/envoyproxy/envoy/pull/35919 is merged.
122+
# Nonce-less verification will remain for backward compatibility with previous releases.
123+
# TODO: zhaohuabing - Remove the nonce-less verification after a reasonable transition period, such as one year.
124+
run_log "Check whether the nonce is used in the OAuth2 filter"
125+
SUPPORT_NONCE="false"
126+
LOCATION=$(_curl "${curl_args[@]}" --head "${proxy_scheme}://localhost:${proxy_port}/login" | grep location)
127+
if [[ "$LOCATION" == *"nonce%3D"* ]]; then
128+
SUPPORT_NONCE="true"
129+
fi
130+
121131
run_log "Inititiate login"
122132
responds_with_header \
123133
"HTTP/1.1 302 Found" \
124134
"${proxy_scheme}://localhost:${proxy_port}/login" \
125135
"${curl_args[@]}"
126-
responds_with_header \
127-
"location: http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Flogin" \
128-
"${proxy_scheme}://localhost:${proxy_port}/login" \
129-
"${curl_args[@]}"
136+
if [[ "$SUPPORT_NONCE" == "true" ]]; then
137+
responds_with_header \
138+
"location: http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=url%3D${proxy_scheme}%253A%252F%252Flocalhost%253A${proxy_port}%252Flogin%26nonce%3D" \
139+
"${proxy_scheme}://localhost:${proxy_port}/login" \
140+
"${curl_args[@]}"
141+
responds_with_header \
142+
"set-cookie: OauthNonce=" \
143+
"${proxy_scheme}://localhost:${proxy_port}/login" \
144+
"${curl_args[@]}"
145+
else
146+
responds_with_header \
147+
"location: http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Flogin" \
148+
"${proxy_scheme}://localhost:${proxy_port}/login" \
149+
"${curl_args[@]}"
150+
fi
130151

131152
run_log "Fetch the myhub authorization page"
132-
responds_with_header \
133-
"HTTP/1.1 302 Found" \
134-
"http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Flogin" \
135-
"${curl_args[@]}"
136-
responds_with_header \
137-
"Location: ${proxy_scheme}://localhost:${proxy_port}/authorize?code=" \
138-
"http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Flogin" \
139-
"${curl_args[@]}"
153+
if [[ "$SUPPORT_NONCE" == "true" ]]; then
154+
responds_with_header \
155+
"HTTP/1.1 302 Found" \
156+
"http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=url%3D${proxy_scheme}%253A%252F%252Flocalhost%253A${proxy_port}%252Flogin%26nonce%3D12345678" \
157+
"${curl_args[@]}"
158+
responds_with_header \
159+
"Location: ${proxy_scheme}://localhost:${proxy_port}/authorize?code=" \
160+
"http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=url%3D${proxy_scheme}%253A%252F%252Flocalhost%253A${proxy_port}%252Flogin%26nonce%3D12345678" \
161+
"${curl_args[@]}"
162+
else
163+
responds_with_header \
164+
"HTTP/1.1 302 Found" \
165+
"http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Flogin" \
166+
"${curl_args[@]}"
167+
responds_with_header \
168+
"Location: ${proxy_scheme}://localhost:${proxy_port}/authorize?code=" \
169+
"http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Flogin" \
170+
"${curl_args[@]}"
171+
fi
140172

141173
run_log "Return to the app and receive creds"
142-
CODE=$(_curl "${curl_args[@]}" --head "http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Flogin" | grep Location | cut -d= -f2 | cut -d\& -f1)
143-
RESPONSE=$(_curl "${curl_args[@]}" --head "${proxy_scheme}://localhost:${proxy_port}/authorize?code=$CODE&state=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Flogin")
174+
if [[ "$SUPPORT_NONCE" == "true" ]]; then
175+
CODE=$(_curl "${curl_args[@]}" --head "http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=url%3D${proxy_scheme}%253A%252F%252Flocalhost%253A${proxy_port}%252Flogin%26nonce%3D12345678" | grep Location | cut -d= -f2 | cut -d\& -f1)
176+
RESPONSE=$(_curl "${curl_args[@]}" --cookie "OauthNonce=12345678" --head "${proxy_scheme}://localhost:${proxy_port}/authorize?code=$CODE&state=url%3D${proxy_scheme}%253A%252F%252Flocalhost%253A${proxy_port}%252Flogin%26nonce%3D12345678")
177+
else
178+
CODE=$(_curl "${curl_args[@]}" --head "http://localhost:${PORT_MYHUB}/authorize?client_id=0123456789&redirect_uri=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Fauthorize&response_type=code&scope=user%3Aemail&state=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Flogin" | grep Location | cut -d= -f2 | cut -d\& -f1)
179+
RESPONSE=$(_curl "${curl_args[@]}" --head "${proxy_scheme}://localhost:${proxy_port}/authorize?code=$CODE&state=${proxy_scheme}%3A%2F%2Flocalhost%3A${proxy_port}%2Flogin")
180+
fi
144181
echo "$RESPONSE" | grep "HTTP/1.1 302 Found"
145182
echo "$RESPONSE" | grep "location: ${proxy_scheme}://localhost:${proxy_port}/login"
146183
echo "$RESPONSE" | grep "set-cookie: OauthHMAC="
@@ -289,16 +326,36 @@ run_log "Inititiate dev login (Github)"
289326
responds_with_header \
290327
"HTTP/1.1 302 Found" \
291328
"http://localhost:${PORT_DEV_PROXY}/login"
292-
responds_with_header \
293-
"location: https://github.com/login/oauth/authorize?client_id=XXX&redirect_uri=http%3A%2F%2Flocalhost%3A${PORT_DEV_PROXY}%2Fauthorize&response_type=code&scope=user%3Aemail&state=http%3A%2F%2Flocalhost%3A${PORT_DEV_PROXY}%2Flogin" \
294-
"http://localhost:${PORT_DEV_PROXY}/login"
329+
if [[ "$SUPPORT_NONCE" == "true" ]]; then
330+
responds_with_header \
331+
"location: https://github.com/login/oauth/authorize?client_id=XXX&redirect_uri=http%3A%2F%2Flocalhost%3A${PORT_DEV_PROXY}%2Fauthorize&response_type=code&scope=user%3Aemail&state=url%3Dhttp%253A%252F%252Flocalhost%253A${PORT_DEV_PROXY}%252Flogin%26nonce%3D" \
332+
"http://localhost:${PORT_DEV_PROXY}/login"
333+
responds_with_header \
334+
"set-cookie: OauthNonce=" \
335+
"http://localhost:${PORT_DEV_PROXY}/login"
336+
else
337+
responds_with_header \
338+
"location: https://github.com/login/oauth/authorize?client_id=XXX&redirect_uri=http%3A%2F%2Flocalhost%3A${PORT_DEV_PROXY}%2Fauthorize&response_type=code&scope=user%3Aemail&state=http%3A%2F%2Flocalhost%3A${PORT_DEV_PROXY}%2Flogin" \
339+
"http://localhost:${PORT_DEV_PROXY}/login"
340+
fi
295341

296342
run_log "Test production app (Github)"
297343
responds_with \
298344
"Envoy single page app example" \
299345
"https://localhost:${PORT_PROXY}" \
300346
-k
301-
responds_with_header \
302-
"location: https://github.com/login/oauth/authorize?client_id=XXX&redirect_uri=https%3A%2F%2Flocalhost%3A${PORT_PROXY}%2Fauthorize&response_type=code&scope=user%3Aemail&state=https%3A%2F%2Flocalhost%3A${PORT_PROXY}%2Flogin" \
303-
"https://localhost:${PORT_PROXY}/login" \
304-
-k
347+
if [[ "$SUPPORT_NONCE" == "true" ]]; then
348+
responds_with_header \
349+
"location: https://github.com/login/oauth/authorize?client_id=XXX&redirect_uri=https%3A%2F%2Flocalhost%3A${PORT_PROXY}%2Fauthorize&response_type=code&scope=user%3Aemail&state=url%3Dhttps%253A%252F%252Flocalhost%253A${PORT_PROXY}%252Flogin%26nonce%3D" \
350+
"https://localhost:${PORT_PROXY}/login" \
351+
-k
352+
responds_with_header \
353+
"set-cookie: OauthNonce=" \
354+
"https://localhost:${PORT_PROXY}/login" \
355+
-k
356+
else
357+
responds_with_header \
358+
"location: https://github.com/login/oauth/authorize?client_id=XXX&redirect_uri=https%3A%2F%2Flocalhost%3A${PORT_PROXY}%2Fauthorize&response_type=code&scope=user%3Aemail&state=https%3A%2F%2Flocalhost%3A${PORT_PROXY}%2Flogin" \
359+
"https://localhost:${PORT_PROXY}/login" \
360+
-k
361+
fi

0 commit comments

Comments
 (0)