mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-10-14 04:07:46 +00:00
Complete rebuild of the plugin
* Fix bug affecting Azure OIDC authentication ( and most likely others ) * Fixes issue #51 * Ensure that appended roles are unique. Update the documentation. * Improvements targetting possible memory usage spikes. * Additional fixes and cleanup * Refactoring code to fix the issues identified by the users. * Modernize run * Fieldalignment * Multiple changes to improve performance and reduce complexity. - Optimise the errors and recovery. - Deduplicate code in metadata cache. - Remove unused performance monitoring code. - Simplify session management and settings handling. * Fix claims issue. * Add ability to overwrite the default scopes in the settings file * Well.. that escalated quickly. Completely forgot that Traefik uses outdated Yaegi and requires compatibility with 1.20 ( pre-generic Go code ). * Bugfix #51: Ensures that user provided scopes overrides work. * fixup! Bugfix #51: Ensures that user provided scopes overrides work. * fixup! fixup! Bugfix #51: Ensures that user provided scopes overrides work. * Abstract the provider logic into a separate package. * Additional micro fixes and cleanups. * Simplify all the things. * fixup! Simplify all the things. * fixup! fixup! Simplify all the things. * fixup! fixup! fixup! Simplify all the things. * fixup! fixup! fixup! fixup! Simplify all the things. * ... * Cleanup tests. * fixup! Cleanup tests. * fixup! fixup! fixup! Cleanup tests. * fixup! fixup! fixup! fixup! Cleanup tests. * fixup! fixup! fixup! fixup! fixup! Cleanup tests. * Issue #53: Fix CSRF token handling in reverse proxy 1. ✅ HTTPS Detection Fixed (session.go:723) - Now uses X-Forwarded-Proto header instead of r.URL.Scheme - Properly detects HTTPS in reverse proxy environments 2. ✅ SameSite Cookie Attribute Fixed - Removed automatic SameSiteStrictMode for HTTPS (would break OAuth) - Keeps SameSiteLaxMode to allow OAuth callbacks from external domains - Only uses Strict for AJAX requests which don't involve OAuth redirects 3. ✅ Cookie Domain Handling Fixed - Now respects X-Forwarded-Host header for cookie domain - Ensures cookies are set for the public domain, not internal proxy domain 4. ✅ EnhanceSessionSecurity Properly Integrated - Function is now actually called during session save - Applies security enhancements without breaking OAuth flow Why Issue #53 Failed Before: 1. Cookies were not marked Secure in HTTPS environments (browser wouldn't send them back) 2. If they had been Secure with SameSite=Strict, Azure callbacks would still fail 3. Cookie domain might have been wrong (internal vs public domain) Why It Works Now: 1. Cookies are properly marked Secure for HTTPS 2. Uses SameSite=Lax to allow OAuth provider callbacks 3. Cookie domain uses public domain from X-Forwarded-Host 4. CSRF token persists through the entire OAuth flow * Next set of enhancements together with memory usage improvements. * Memory leak fixes and optimisations. * CSRF and Cookie Domain fixes * fixup! CSRF and Cookie Domain fixes * Metadata cache leak fix + profiling * fixup! Metadata cache leak fix + profiling * Memory leaks hunting, part 1337. * Further pursue of perfection. * fixup! Further pursue of perfection. * fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * Clear race conditions * fixup! Clear race conditions * Weekend fun with memory leaks * Splitting code into multiple files with reasonable testing coverage. ``` ok github.com/lukaszraczylo/traefikoidc 117.017s coverage: 72.6% of statements ok github.com/lukaszraczylo/traefikoidc/auth 0.505s coverage: 87.1% of statements ok github.com/lukaszraczylo/traefikoidc/circuit_breaker 0.283s coverage: 99.0% of statements github.com/lukaszraczylo/traefikoidc/config coverage: 0.0% of statements ok github.com/lukaszraczylo/traefikoidc/handlers 0.349s coverage: 98.2% of statements ok github.com/lukaszraczylo/traefikoidc/internal/providers (cached) coverage: 94.3% of statements ok github.com/lukaszraczylo/traefikoidc/middleware 0.808s coverage: 78.0% of statements ok github.com/lukaszraczylo/traefikoidc/recovery 0.653s coverage: 100.0% of statements ok github.com/lukaszraczylo/traefikoidc/session/chunking (cached) coverage: 87.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/core (cached) coverage: 85.6% of statements ok github.com/lukaszraczylo/traefikoidc/session/crypto (cached) coverage: 81.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/storage (cached) coverage: 93.5% of statements ok github.com/lukaszraczylo/traefikoidc/session/validators (cached) coverage: 98.8% of statements ```` * fixup! Splitting code into multiple files with reasonable testing coverage. * fixup! fixup! Splitting code into multiple files with reasonable testing coverage. * Weekend fun with further optimisations. * fixup! Weekend fun with further optimisations. * fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! fixup! fixup! Weekend fun with further optimisations. * Pre-release cleanup. * Enhance test coverage. * fixup! Enhance test coverage. * fixup! fixup! Enhance test coverage. * fixup! fixup! fixup! Enhance test coverage.
This commit is contained in:
@@ -0,0 +1,299 @@
|
||||
package httpclient
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestFactoryCreateClient(t *testing.T) {
|
||||
factory := NewFactory(nil)
|
||||
|
||||
// Test creating default client
|
||||
client, err := factory.CreateDefault()
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to create default client: %v", err)
|
||||
}
|
||||
if client == nil {
|
||||
t.Fatal("Expected non-nil client")
|
||||
}
|
||||
|
||||
// Test creating token client
|
||||
tokenClient, err := factory.CreateToken()
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to create token client: %v", err)
|
||||
}
|
||||
if tokenClient == nil {
|
||||
t.Fatal("Expected non-nil token client")
|
||||
}
|
||||
}
|
||||
|
||||
func TestFactoryCreateClientWithPreset(t *testing.T) {
|
||||
factory := NewFactory(nil)
|
||||
|
||||
testCases := []struct {
|
||||
name string
|
||||
clientType ClientType
|
||||
shouldFail bool
|
||||
}{
|
||||
{"Default", ClientTypeDefault, false},
|
||||
{"Token", ClientTypeToken, false},
|
||||
{"API", ClientTypeAPI, false},
|
||||
{"Proxy", ClientTypeProxy, false},
|
||||
{"Invalid", ClientType("invalid"), true},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
client, err := factory.CreateClientWithPreset(tc.clientType)
|
||||
if tc.shouldFail {
|
||||
if err == nil {
|
||||
t.Fatal("Expected error for invalid client type")
|
||||
}
|
||||
} else {
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to create %s client: %v", tc.clientType, err)
|
||||
}
|
||||
if client == nil {
|
||||
t.Fatal("Expected non-nil client")
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestFactoryValidateConfig(t *testing.T) {
|
||||
factory := NewFactory(nil)
|
||||
|
||||
testCases := []struct {
|
||||
name string
|
||||
config Config
|
||||
shouldFail bool
|
||||
}{
|
||||
{
|
||||
name: "Valid config",
|
||||
config: PresetConfigs[ClientTypeDefault],
|
||||
shouldFail: false,
|
||||
},
|
||||
{
|
||||
name: "Negative MaxIdleConns",
|
||||
config: Config{
|
||||
MaxIdleConns: -1,
|
||||
},
|
||||
shouldFail: true,
|
||||
},
|
||||
{
|
||||
name: "Excessive MaxIdleConns",
|
||||
config: Config{
|
||||
MaxIdleConns: 2000,
|
||||
},
|
||||
shouldFail: true,
|
||||
},
|
||||
{
|
||||
name: "Negative timeout",
|
||||
config: Config{
|
||||
Timeout: -1 * time.Second,
|
||||
},
|
||||
shouldFail: true,
|
||||
},
|
||||
{
|
||||
name: "Excessive timeout",
|
||||
config: Config{
|
||||
Timeout: 10 * time.Minute,
|
||||
},
|
||||
shouldFail: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
err := factory.ValidateConfig(&tc.config)
|
||||
if tc.shouldFail && err == nil {
|
||||
t.Fatal("Expected validation to fail")
|
||||
}
|
||||
if !tc.shouldFail && err != nil {
|
||||
t.Fatalf("Unexpected validation error: %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestTransportPoolConcurrency(t *testing.T) {
|
||||
pool := &TransportPool{
|
||||
transports: make(map[string]*sharedTransport),
|
||||
maxConns: 20,
|
||||
clientCount: 0,
|
||||
maxClients: 5,
|
||||
}
|
||||
|
||||
config := PresetConfigs[ClientTypeDefault]
|
||||
|
||||
var wg sync.WaitGroup
|
||||
numGoroutines := 10
|
||||
|
||||
// Test concurrent transport creation
|
||||
wg.Add(numGoroutines)
|
||||
for i := 0; i < numGoroutines; i++ {
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
transport := pool.GetOrCreateTransport(config)
|
||||
if transport != nil {
|
||||
// Simulate usage
|
||||
time.Sleep(10 * time.Millisecond)
|
||||
pool.Release(transport)
|
||||
}
|
||||
}()
|
||||
}
|
||||
wg.Wait()
|
||||
|
||||
// Verify client count is within limits
|
||||
clientCount := atomic.LoadInt32(&pool.clientCount)
|
||||
if clientCount > pool.maxClients {
|
||||
t.Fatalf("Client count %d exceeds max %d", clientCount, pool.maxClients)
|
||||
}
|
||||
}
|
||||
|
||||
func TestHTTPClientRequests(t *testing.T) {
|
||||
// Create test server
|
||||
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
w.Write([]byte("test response"))
|
||||
}))
|
||||
defer server.Close()
|
||||
|
||||
factory := NewFactory(nil)
|
||||
client, err := factory.CreateDefault()
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to create client: %v", err)
|
||||
}
|
||||
|
||||
// Make request
|
||||
resp, err := client.Get(server.URL)
|
||||
if err != nil {
|
||||
t.Fatalf("Request failed: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("Expected status 200, got %d", resp.StatusCode)
|
||||
}
|
||||
}
|
||||
|
||||
func TestClientWithCookieJar(t *testing.T) {
|
||||
config := PresetConfigs[ClientTypeToken]
|
||||
if !config.UseCookieJar {
|
||||
t.Skip("Token client should have cookie jar enabled")
|
||||
}
|
||||
|
||||
factory := NewFactory(nil)
|
||||
client, err := factory.CreateToken()
|
||||
if err != nil {
|
||||
t.Fatalf("Failed to create token client: %v", err)
|
||||
}
|
||||
|
||||
if client.Jar == nil {
|
||||
t.Fatal("Expected cookie jar to be set")
|
||||
}
|
||||
}
|
||||
|
||||
func TestTransportPoolCleanup(t *testing.T) {
|
||||
pool := &TransportPool{
|
||||
transports: make(map[string]*sharedTransport),
|
||||
maxConns: 20,
|
||||
clientCount: 0,
|
||||
maxClients: 5,
|
||||
}
|
||||
|
||||
config := PresetConfigs[ClientTypeDefault]
|
||||
|
||||
// Create transport
|
||||
transport := pool.GetOrCreateTransport(config)
|
||||
if transport == nil {
|
||||
t.Fatal("Failed to create transport")
|
||||
}
|
||||
|
||||
// Release transport
|
||||
pool.Release(transport)
|
||||
|
||||
// Simulate idle time
|
||||
pool.mu.Lock()
|
||||
for _, shared := range pool.transports {
|
||||
shared.lastUsed = time.Now().Add(-11 * time.Minute)
|
||||
atomic.StoreInt32(&shared.refCount, 0)
|
||||
}
|
||||
pool.mu.Unlock()
|
||||
|
||||
// Run cleanup
|
||||
pool.cleanupIdle()
|
||||
|
||||
// Verify transport was removed
|
||||
pool.mu.RLock()
|
||||
count := len(pool.transports)
|
||||
pool.mu.RUnlock()
|
||||
|
||||
if count != 0 {
|
||||
t.Fatalf("Expected 0 transports after cleanup, got %d", count)
|
||||
}
|
||||
}
|
||||
|
||||
func TestGlobalFactorySingleton(t *testing.T) {
|
||||
factory1 := GetGlobalFactory(nil)
|
||||
factory2 := GetGlobalFactory(nil)
|
||||
|
||||
if factory1 != factory2 {
|
||||
t.Fatal("Expected singleton factory instances to be the same")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCompatibilityFunctions(t *testing.T) {
|
||||
// Test CreateDefaultHTTPClient
|
||||
defaultClient := CreateDefaultHTTPClient()
|
||||
if defaultClient == nil {
|
||||
t.Fatal("Expected non-nil default client")
|
||||
}
|
||||
|
||||
// Test CreateTokenHTTPClient
|
||||
tokenClient := CreateTokenHTTPClient()
|
||||
if tokenClient == nil {
|
||||
t.Fatal("Expected non-nil token client")
|
||||
}
|
||||
|
||||
// Test CreateHTTPClientWithConfig
|
||||
config := PresetConfigs[ClientTypeAPI]
|
||||
apiClient := CreateHTTPClientWithConfig(config)
|
||||
if apiClient == nil {
|
||||
t.Fatal("Expected non-nil API client")
|
||||
}
|
||||
}
|
||||
|
||||
func BenchmarkFactoryCreateClient(b *testing.B) {
|
||||
factory := NewFactory(nil)
|
||||
|
||||
b.ResetTimer()
|
||||
b.RunParallel(func(pb *testing.PB) {
|
||||
for pb.Next() {
|
||||
client, err := factory.CreateDefault()
|
||||
if err != nil || client == nil {
|
||||
b.Fatal("Failed to create client")
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func BenchmarkTransportPoolGetOrCreate(b *testing.B) {
|
||||
pool := GetGlobalTransportPool()
|
||||
config := PresetConfigs[ClientTypeDefault]
|
||||
|
||||
b.ResetTimer()
|
||||
b.RunParallel(func(pb *testing.PB) {
|
||||
for pb.Next() {
|
||||
transport := pool.GetOrCreateTransport(config)
|
||||
if transport != nil {
|
||||
pool.Release(transport)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
Reference in New Issue
Block a user