Skip to content
This repository has been archived by the owner on Jan 24, 2019. It is now read-only.

No errors logged when Set-cookie header is not sent in response due to an invalid cookie #264

Closed
rmtobin opened this issue Jun 9, 2016 · 0 comments · Fixed by #278
Closed

Comments

@rmtobin
Copy link

rmtobin commented Jun 9, 2016

oauth2_proxy currently will silently fail to complete authentication if an invalid cookie name is set, perpetually redirecting the user back to the login screen with no errors logged.

This seems to be due to the behavior of Go's http.SetCookie method which according to the docs: The provided cookie must have a valid Name. Invalid cookies may be silently dropped.. Since oauth2_proxy's authentication relies on setting a cookie, there should be validation that the MakeCookie method makes a valid cookie, and subsequently, that the Set-Cookie header is actually included in the response headers.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Development

Successfully merging a pull request may close this issue.

1 participant