From abf235dac63e691319bdab080cc82885ab7248a0 Mon Sep 17 00:00:00 2001 From: Trong Huu Nguyen Date: Wed, 21 May 2025 15:15:43 +0200 Subject: [PATCH] feat(handler): attach token in forward-auth response Co-authored-by: Thomas Krampl --- pkg/handler/handler.go | 9 ++++++++- pkg/handler/handler_test.go | 5 +++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/pkg/handler/handler.go b/pkg/handler/handler.go index bf0000e..f8206f0 100644 --- a/pkg/handler/handler.go +++ b/pkg/handler/handler.go @@ -505,7 +505,7 @@ func (s *Standalone) SessionForwardAuth(w http.ResponseWriter, r *http.Request) return } - _, err := s.GetSession(r) + sess, err := s.GetSession(r) if err != nil { logger := mw.LogEntryFrom(r) if errors.Is(err, session.ErrInvalidExternal) || errors.Is(err, session.ErrInvalid) { @@ -525,6 +525,13 @@ func (s *Standalone) SessionForwardAuth(w http.ResponseWriter, r *http.Request) return } + tok, err := sess.AccessToken() + if err != nil { + w.WriteHeader(http.StatusUnauthorized) + return + } + + w.Header().Set("X-Wonderwall-Forward-Auth-Token", tok) w.WriteHeader(http.StatusNoContent) } diff --git a/pkg/handler/handler_test.go b/pkg/handler/handler_test.go index 7a726ae..610fb18 100644 --- a/pkg/handler/handler_test.go +++ b/pkg/handler/handler_test.go @@ -329,11 +329,13 @@ func TestSessionForwardAuth(t *testing.T) { rpClient := idp.RelyingPartyClient() noSessionResp := sessionForwardAuth(t, idp, rpClient) assert.Equal(t, http.StatusUnauthorized, noSessionResp.StatusCode) + assert.Empty(t, noSessionResp.Headers.Get("X-Wonderwall-Forward-Auth-Token")) login(t, rpClient, idp) resp := sessionForwardAuth(t, idp, rpClient) assert.Equal(t, http.StatusNoContent, resp.StatusCode) + assert.NotEmpty(t, resp.Headers.Get("X-Wonderwall-Forward-Auth-Token")) } func TestSessionForwardAuth_Disabled(t *testing.T) { @@ -345,6 +347,7 @@ func TestSessionForwardAuth_Disabled(t *testing.T) { rpClient := idp.RelyingPartyClient() noSessionResp := sessionForwardAuth(t, idp, rpClient) assert.Equal(t, http.StatusNotFound, noSessionResp.StatusCode) + assert.Empty(t, noSessionResp.Headers.Get("X-Wonderwall-Forward-Auth-Token")) } func TestPing(t *testing.T) { @@ -579,6 +582,7 @@ func waitForRefreshCooldownTimer(t *testing.T, idp *mock.IdentityProvider, rpCli type response struct { Body string + Headers http.Header Location *url.URL StatusCode int } @@ -621,6 +625,7 @@ func request(t *testing.T, client *http.Client, method, url string, headers ...h return response{ Body: body(t, resp), + Headers: resp.Header, Location: location, StatusCode: resp.StatusCode, }