github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-08-20 03:26:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,294 Commits 4 Branches 0 Tags
8fbd4656dbaa43d81ff6ac91c8c17f353ee0d0ff
Commit Graph
42 Commits
Author SHA1 Message Date
Trong Huu Nguyen 762b64eff5 fix(reverseproxy): strip incoming id-token header for unauthenticated requests 2025-04-28 10:50:12 +02:00
Trong Huu Nguyen 2e8c7075ff fix: set content-type header before status 2025-02-03 11:38:35 +01:00
Trong Huu Nguyenandsindrerh2 79ac15d455 feat(otel): consistency passthrough for spans and attributes 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-30 14:03:39 +01:00
Trong Huu Nguyenandsindrerh2 e6207fe3b4 feat(handler/reverseproxy): more spans 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-30 14:03:37 +01:00
Trong Huu Nguyenandsindrerh2 85230d5403 feat(session): add trace spans and attributes 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-30 14:03:35 +01:00
Trong Huu Nguyenandsindrerh2 a157a13b9c refactor(o11y): separate logging and otel packages 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-30 14:03:34 +01:00
Trong Huu Nguyenandsindrerh2 21b85c4b54 feat(handler/reverseproxy): add trace spans with attributes 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-30 14:03:34 +01:00
Trong Huu Nguyenandsindrerh2 13b11790fe feat(handler): log additional fields for errors and reverseproxy 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-30 14:03:31 +01:00
Sindre Rødseth HansenandTrong Huu Nguyen ca77435d6a feat(http): propagate traceparent for httpclient 
Co-authored-by: tronghn <trong.huu.nguyen@nav.no>
 2025-01-30 14:03:30 +01:00
Trong Huu Nguyen 39207677b5 feat(middleware/logentry): add fields for sec-fetch headers 2025-01-24 09:13:59 +01:00
Trong Huu Nguyenandsindrerh2 ab418c456c fix(handler/reverseproxy): add nil check for session 
Co-authored-by: sindrerh2 <sindre.rodseth.hansen@nav.no>
 2025-01-23 10:16:13 +01:00
Sindre Rødseth Hansenandtronghn 2feb6a3b77 feat: Add option for propagating id_token to upstream app 
Fixes #315

Co-authored-by: tronghn <trong.huu.nguyen@nav.no>
 2025-01-20 13:07:54 +01:00
Trong Huu Nguyen 155ebc745b docs: clarify forwarded headers 2024-08-23 13:56:21 +02:00
Trong Huu Nguyen 10e71a7bb5 feat(handler/reverseproxy): remove x-wonderwall headers 
The use of these headers in upstreams may be risky, espeically
if Wonderwall is accidentally misconfigured or disabled, or requests
are performed directly to the upstream circumventing Wonderwall.

We should prefer using a signed token or similar that can be verified by
the upstreams.
 2024-01-16 08:57:07 +01:00
Trong Huu Nguyen 40497da1b9 feat(handler/reverseproxy): filter relevant access requests 2023-12-20 15:41:29 +01:00
Trong Huu Nguyen e71e4a2fda feat(handler/reverseproxy): add toggle for access logs 2023-12-20 08:25:35 +01:00
Trong Huu Nguyen 50e53330b9 feat(handler/reverseproxy): remove unnecessary log fields 2023-12-19 12:05:01 +01:00
Trong Huu Nguyen c3904433f2 feat: log and propagate session metadata 
- stop using jti, use sid instead
- store amr and auth_time from id_token in session
- log more metadata on login callback
- log session id where possible
- propagate acr, amr, auth_time, sid to upstreams in headers
- log authenticated reverseproxy requests
 2023-12-19 08:46:02 +01:00
Trong Huu Nguyen 305ab1786d fix(reverseproxy/autologin): handle multiple accept headers 2023-10-16 12:01:15 +02:00
Trong Huu Nguyen c1bdb90566 feat(handler/reverseproxy): don't return json response after all 
Expose fewer interfaces; less maintenance and documentation needed.
 2023-10-04 10:01:03 +02:00
Trong Huu Nguyen 2e21dae33a feat(handler/reverseproxy): return json response for non-navigational autologin requests 2023-10-03 14:21:09 +02:00
Trong Huu Nguyen 7a72586ca8 refactor(autologin): return early if fetch metadata is set 2023-09-25 15:07:11 +02:00
Trong Huu Nguyen 337723150b fix(reverseproxy/autologin): skip cleaning redirect target 2023-09-25 14:13:15 +02:00
Trong Huu Nguyen 34d90d2c78 fix(autologin): do not return ambiguous 3xx redirect 
If autologin is enabled, check for headers that indicate that the request is a navigation request
and respond appropriately.

A navigation request is assumed to match all of the following:

- uses the GET HTTP method
- either:
  - a) sends the fetch metadata headers, specifically
    `Sec-Fetch-Mode=navigate` and `Sec-Fetch-Dest=document`, or (if
    unsupported by the browser)
  - b) sends the `Accept` header with a value that contains
    `text/html` (which most browsers do by default for navigation
    requests, the exception being IE8 AFAIK)

Non-navigation requests (e.g. fetch / xhr / ajax requests) will receive a
401 Unauthorized, with the Location header set to the login endpoint.
The redirect parameter is also set to point back to the URL found in the
Referer header (though with the scheme and host removed to only allow
redirects relative to the origin host.)

With this fix, autologin will also intercept requests other than GET.
This is to improve the security posture of upstreams that assume that autologin
enforces authentication for all methods.

Fixes #156.
 2023-09-22 14:51:35 +02:00
Trong Huu Nguyen b28c91c94c perf(all): use single Transport, set IdleConnTimeout 
Reduces IdleConnTimeout to 5 seconds. Reverse proxying to a server that
has a shorter keep-alive may cause "EOF" and "connection reset by peer"
issues as the connections may be closed by the upstream before our
client notices.
 2023-05-16 08:36:45 +02:00
Trong Huu Nguyen 97f0d078bf feat(handler): validate acr if configured, change auth status if invalid 2023-05-12 08:47:27 +02:00
Trong Huu Nguyen 0c531d9ec1 perf: increase max idle connections for http clients 2023-05-04 14:45:45 +02:00
Trong Huu Nguyen 59b2dd1d66 fix(handler/reverseproxy): only trigger acr step up for non-ignored autologin paths 2023-05-02 08:53:51 +02:00
Trong Huu Nguyen 3a239a95c3 feat(reverseproxy): validate acr and redirect if applicable 2023-04-29 11:54:53 +02:00
Trong Huu Nguyen 7c98fe161e refactor(handler/reverseproxy): retrieve both session and token 2023-04-29 11:17:00 +02:00
Trong Huu Nguyen 568f9f7683 feat(handler): use 302 instead of 303 for redirects 2023-04-29 08:42:29 +02:00
Trong Huu Nguyen bc651d9082 fix: use 303 instead of 307 for redirects 2023-04-28 01:30:17 +02:00
Trong Huu Nguyen 163d9e42ad fix(handler/reverseproxy): preserve inbound forwarded/x-forwarded headers 2023-04-12 15:05:55 +02:00
Trong Huu Nguyen 7a52b0d1a3 refactor(handler/reverseproxy): require GetAccessToken from source instead of obsolete session handler 2023-02-21 13:31:06 +01:00
Trong Huu Nguyen f4ae907a2b refactor(handler/reverseproxy): clean up error handling 2023-02-21 13:30:29 +01:00
Trong Huu Nguyen 2c5d964983 refactor(handler/reverseproxy): reduce log severity for cookie decrypt failures 2023-02-15 08:43:25 +01:00
Trong Huu Nguyen ea0756784d refactor(handler/reverseproxy): use ReverseProxy.Rewrite instead of Director 2023-02-10 14:58:17 +01:00
Trong Huu Nguyen 473e4a95a7 refactor: remove loginstatus 
Loginstatus is no longer needed with the SSO setup.
Fixes #50.
 2023-02-10 14:58:17 +01:00
Trong Huu Nguyen 5f74ee08bc refactor(url): extract utility functions 2023-02-10 14:58:12 +01:00
Trong Huu Nguyen 1fdbe75c9e feat(sso/proxy): implement login handler 2023-02-10 14:58:11 +01:00
Trong Huu Nguyen 61a7a8f161 refactor: clean up errors and reverseproxy logging 2023-02-10 14:57:53 +01:00
Trong Huu Nguyen f51fe97b23 refactor(handler): flatten handler modules 2023-02-10 14:57:48 +01:00