feat: add handler for forward-auth

pkg/handler/handler.go

@@ -440,6 +440,29 @@ func (s *Standalone) sessionWriteMetadataResponse(w http.ResponseWriter, r *http
 	return json.NewEncoder(w).Encode(metadata)
 }
 
+func (s *Standalone) SessionForwardAuth(w http.ResponseWriter, r *http.Request) {
+	if !s.Config.Session.ForwardAuth {
+		http.NotFound(w, r)
+		return
+	}
+
+	_, err := s.SessionManager.GetOrRefresh(r)
+	if err != nil {
+		logger := mw.LogEntryFrom(r)
+		if errors.Is(err, session.ErrInvalidExternal) || errors.Is(err, session.ErrInvalid) || errors.Is(err, session.ErrNotFound) {
+			logger.Infof("session/forwardauth: %+v", err)
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+
+		logger.Warnf("session/forwardauth: %+v", err)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
 // Wildcard proxies all requests to an upstream server.
 func (s *Standalone) Wildcard(w http.ResponseWriter, r *http.Request) {
 	s.UpstreamProxy.Handler(s, w, r)

pkg/handler/handler_sso_proxy.go

@@ -190,6 +190,12 @@ func (s *SSOProxy) SessionRefresh(w http.ResponseWriter, r *http.Request) {
 	s.SSOServerReverseProxy.ServeHTTP(w, r)
 }
 
+func (s *SSOProxy) SessionForwardAuth(w http.ResponseWriter, r *http.Request) {
+	r.URL.Path = paths.OAuth2 + paths.Session + paths.ForwardAuth
+	removeMiddlewareHeaders(w)
+	s.SSOServerReverseProxy.ServeHTTP(w, r)
+}
+
 // Wildcard proxies all requests to an upstream server.
 func (s *SSOProxy) Wildcard(w http.ResponseWriter, r *http.Request) {
 	s.UpstreamProxy.Handler(s, w, r)

pkg/handler/handler_test.go

@@ -521,6 +521,33 @@ func TestSession_WithRefreshAuto(t *testing.T) {
 	assert.Greater(t, data.Tokens.NextAutoRefreshInSeconds, int64(1))
 }
 
+func TestSessionForwardAuth(t *testing.T) {
+	cfg := mock.Config()
+	cfg.Session.ForwardAuth = true
+	idp := mock.NewIdentityProvider(cfg)
+	defer idp.Close()
+
+	rpClient := idp.RelyingPartyClient()
+	noSessionResp := sessionForwardAuth(t, idp, rpClient)
+	assert.Equal(t, http.StatusUnauthorized, noSessionResp.StatusCode)
+
+	login(t, rpClient, idp)
+
+	resp := sessionForwardAuth(t, idp, rpClient)
+	assert.Equal(t, http.StatusNoContent, resp.StatusCode)
+}
+
+func TestSessionForwardAuth_Disabled(t *testing.T) {
+	cfg := mock.Config()
+	cfg.Session.ForwardAuth = false
+	idp := mock.NewIdentityProvider(cfg)
+	defer idp.Close()
+
+	rpClient := idp.RelyingPartyClient()
+	noSessionResp := sessionForwardAuth(t, idp, rpClient)
+	assert.Equal(t, http.StatusNotFound, noSessionResp.StatusCode)
+}
+
 func TestPing(t *testing.T) {
 	cfg := mock.Config()
 	idp := mock.NewIdentityProvider(cfg)
@@ -693,6 +720,13 @@ func sessionRefresh(t *testing.T, idp *mock.IdentityProvider, rpClient *http.Cli
 	return post(t, rpClient, sessionRefreshURL.String())
 }
 
+func sessionForwardAuth(t *testing.T, idp *mock.IdentityProvider, rpClient *http.Client) response {
+	sessionForwardAuthURL, err := url.Parse(idp.RelyingPartyServer.URL + "/oauth2/session/forwardauth")
+	assert.NoError(t, err)
+
+	return get(t, rpClient, sessionForwardAuthURL.String())
+}
+
 func waitForRefreshCooldownTimer(t *testing.T, idp *mock.IdentityProvider, rpClient *http.Client) {
 	timeout := time.After(5 * time.Second)
 	ticker := time.Tick(500 * time.Millisecond)