Complete rebuild of the plugin

* Fix bug affecting Azure OIDC authentication ( and most likely others ) * Fixes issue #51 * Ensure that appended roles are unique. Update the documentation. * Improvements targetting possible memory usage spikes. * Additional fixes and cleanup * Refactoring code to fix the issues identified by the users. * Modernize run * Fieldalignment * Multiple changes to improve performance and reduce complexity. - Optimise the errors and recovery. - Deduplicate code in metadata cache. - Remove unused performance monitoring code. - Simplify session management and settings handling. * Fix claims issue. * Add ability to overwrite the default scopes in the settings file * Well.. that escalated quickly. Completely forgot that Traefik uses outdated Yaegi and requires compatibility with 1.20 ( pre-generic Go code ). * Bugfix #51: Ensures that user provided scopes overrides work. * fixup! Bugfix #51: Ensures that user provided scopes overrides work. * fixup! fixup! Bugfix #51: Ensures that user provided scopes overrides work. * Abstract the provider logic into a separate package. * Additional micro fixes and cleanups. * Simplify all the things. * fixup! Simplify all the things. * fixup! fixup! Simplify all the things. * fixup! fixup! fixup! Simplify all the things. * fixup! fixup! fixup! fixup! Simplify all the things. * ... * Cleanup tests. * fixup! Cleanup tests. * fixup! fixup! fixup! Cleanup tests. * fixup! fixup! fixup! fixup! Cleanup tests. * fixup! fixup! fixup! fixup! fixup! Cleanup tests. * Issue #53: Fix CSRF token handling in reverse proxy 1. ✅ HTTPS Detection Fixed (session.go:723) - Now uses X-Forwarded-Proto header instead of r.URL.Scheme - Properly detects HTTPS in reverse proxy environments 2. ✅ SameSite Cookie Attribute Fixed - Removed automatic SameSiteStrictMode for HTTPS (would break OAuth) - Keeps SameSiteLaxMode to allow OAuth callbacks from external domains - Only uses Strict for AJAX requests which don't involve OAuth redirects 3. ✅ Cookie Domain Handling Fixed - Now respects X-Forwarded-Host header for cookie domain - Ensures cookies are set for the public domain, not internal proxy domain 4. ✅ EnhanceSessionSecurity Properly Integrated - Function is now actually called during session save - Applies security enhancements without breaking OAuth flow Why Issue #53 Failed Before: 1. Cookies were not marked Secure in HTTPS environments (browser wouldn't send them back) 2. If they had been Secure with SameSite=Strict, Azure callbacks would still fail 3. Cookie domain might have been wrong (internal vs public domain) Why It Works Now: 1. Cookies are properly marked Secure for HTTPS 2. Uses SameSite=Lax to allow OAuth provider callbacks 3. Cookie domain uses public domain from X-Forwarded-Host 4. CSRF token persists through the entire OAuth flow * Next set of enhancements together with memory usage improvements. * Memory leak fixes and optimisations. * CSRF and Cookie Domain fixes * fixup! CSRF and Cookie Domain fixes * Metadata cache leak fix + profiling * fixup! Metadata cache leak fix + profiling * Memory leaks hunting, part 1337. * Further pursue of perfection. * fixup! Further pursue of perfection. * fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! Further pursue of perfection. * Clear race conditions * fixup! Clear race conditions * Weekend fun with memory leaks * Splitting code into multiple files with reasonable testing coverage. ``` ok github.com/lukaszraczylo/traefikoidc 117.017s coverage: 72.6% of statements ok github.com/lukaszraczylo/traefikoidc/auth 0.505s coverage: 87.1% of statements ok github.com/lukaszraczylo/traefikoidc/circuit_breaker 0.283s coverage: 99.0% of statements github.com/lukaszraczylo/traefikoidc/config coverage: 0.0% of statements ok github.com/lukaszraczylo/traefikoidc/handlers 0.349s coverage: 98.2% of statements ok github.com/lukaszraczylo/traefikoidc/internal/providers (cached) coverage: 94.3% of statements ok github.com/lukaszraczylo/traefikoidc/middleware 0.808s coverage: 78.0% of statements ok github.com/lukaszraczylo/traefikoidc/recovery 0.653s coverage: 100.0% of statements ok github.com/lukaszraczylo/traefikoidc/session/chunking (cached) coverage: 87.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/core (cached) coverage: 85.6% of statements ok github.com/lukaszraczylo/traefikoidc/session/crypto (cached) coverage: 81.8% of statements ok github.com/lukaszraczylo/traefikoidc/session/storage (cached) coverage: 93.5% of statements ok github.com/lukaszraczylo/traefikoidc/session/validators (cached) coverage: 98.8% of statements ```` * fixup! Splitting code into multiple files with reasonable testing coverage. * fixup! fixup! Splitting code into multiple files with reasonable testing coverage. * Weekend fun with further optimisations. * fixup! Weekend fun with further optimisations. * fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! fixup! Weekend fun with further optimisations. * fixup! fixup! fixup! fixup! fixup! Weekend fun with further optimisations. * Pre-release cleanup. * Enhance test coverage. * fixup! Enhance test coverage. * fixup! fixup! Enhance test coverage. * fixup! fixup! fixup! Enhance test coverage.
2026-10-14 04:07:46 +00:00 · 2025-09-18 11:01:30 +01:00
parent 784b161732
commit 1b49e133da
181 changed files with 78067 additions and 8289 deletions
@@ -21,7 +21,7 @@ import (
 // TestJWTAlgorithmConfusionAttack tests if the plugin is vulnerable to JWT algorithm confusion attacks
 // where an attacker might try to switch from an asymmetric algorithm (RS256) to a symmetric one (HS256)
 func TestJWTAlgorithmConfusionAttack(t *testing.T) {
-	ts := &TestSuite{t: t}
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Create a standard JWT with RS256 algorithm
@@ -86,7 +86,7 @@ func TestJWTAlgorithmConfusionAttack(t *testing.T) {
 // TestJWTNoneAlgorithmAttack tests the plugin's resistance to the "none" algorithm attack
 // where an attacker removes the signature and sets the algorithm to "none"
 func TestJWTNoneAlgorithmAttack(t *testing.T) {
-	ts := &TestSuite{t: t}
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Create a standard JWT
@@ -150,7 +150,7 @@ func TestJWTNoneAlgorithmAttack(t *testing.T) {

 // TestJWTTokenTampering tests the plugin's ability to detect modifications to the JWT payload
 func TestJWTTokenTampering(t *testing.T) {
-	ts := &TestSuite{t: t}
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Create a standard JWT
@@ -215,7 +215,7 @@ func TestJWTTokenTampering(t *testing.T) {

 // TestJWTExpiredToken tests the plugin's handling of expired tokens
 func TestJWTExpiredToken(t *testing.T) {
-	ts := &TestSuite{t: t}
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Create a JWT that is already expired
@@ -248,7 +248,7 @@ func TestJWTExpiredToken(t *testing.T) {

 // TestJWTFutureToken tests the plugin's handling of tokens issued in the future
 func TestJWTFutureToken(t *testing.T) {
-	ts := &TestSuite{t: t}
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Create a JWT with a future issuance time
@@ -281,10 +281,13 @@ func TestJWTFutureToken(t *testing.T) {

 // TestJWTReplayAttack tests the plugin's protection against token replay attacks
 func TestJWTReplayAttack(t *testing.T) {
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
 	// Create a new instance for this test to avoid interference from global state
 	logger := NewLogger("debug")
-	tokenBlacklist := NewCache()
-	tokenCache := NewTokenCache()
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())

 	// Create keys
 	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
@@ -383,14 +386,14 @@ func TestJWTReplayAttack(t *testing.T) {

 // TestMissingClaims tests validation of tokens with missing required claims
 func TestMissingClaims(t *testing.T) {
-	ts := &TestSuite{t: t}
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Test cases for missing claims
 	testCases := []struct {
 		name          string
-		omittedClaims []string
 		expectedError string
+		omittedClaims []string
 	}{
 		{
 			name:          "Missing Issuer",
@@ -460,8 +463,11 @@ func TestMissingClaims(t *testing.T) {

 // TestSessionFixationAttack tests the plugin's resistance to session fixation attacks
 func TestSessionFixationAttack(t *testing.T) {
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
 	logger := NewLogger("debug")
-	sm, err := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, logger)
+	sm, err := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -479,8 +485,8 @@ func TestSessionFixationAttack(t *testing.T) {
 	// Set up the attacker's session with malicious data
 	attackerSession.SetAuthenticated(true)
 	attackerSession.SetEmail("[email protected]")
-	attackerSession.SetIDToken("fake-id-token")
-	attackerSession.SetAccessToken("fake-access-token")
+	attackerSession.SetIDToken(ValidIDToken)
+	attackerSession.SetAccessToken(ValidAccessToken)

 	// Save the session to get cookies
 	if err := attackerSession.Save(req, resp); err != nil {
@@ -510,7 +516,34 @@ func TestSessionFixationAttack(t *testing.T) {
 		w.WriteHeader(http.StatusOK)
 	})

+	// Create keys for JWT verification
+	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("Failed to generate RSA key: %v", err)
+	}
+	rsaPublicKey := &rsaPrivateKey.PublicKey
+
+	// Create JWK
+	jwk := JWK{
+		Kty: "RSA",
+		Kid: "test-key-id",
+		Alg: "RS256",
+		N:   base64.RawURLEncoding.EncodeToString(rsaPublicKey.N.Bytes()),
+		E:   base64.RawURLEncoding.EncodeToString([]byte{1, 0, 1}), // 65537 in bytes
+	}
+	jwks := &JWKSet{
+		Keys: []JWK{jwk},
+	}
+
+	// Create mock JWK cache
+	mockJWKCache := &MockJWKCache{
+		JWKS: jwks,
+		Err:  nil,
+	}
+
 	// Create the TraefikOidc middleware
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())
 	tOidc := &TraefikOidc{
 		next:               nextHandler,
 		name:               "test",
@@ -519,8 +552,10 @@ func TestSessionFixationAttack(t *testing.T) {
 		issuerURL:          "https://test-issuer.com",
 		clientID:           "test-client-id",
 		clientSecret:       "test-client-secret",
-		tokenBlacklist:     NewCache(),
-		tokenCache:         NewTokenCache(),
+		jwkCache:           mockJWKCache,
+		jwksURL:            "https://test-jwks-url.com",
+		tokenBlacklist:     tokenBlacklist,
+		tokenCache:         tokenCache,
 		limiter:            rate.NewLimiter(rate.Every(time.Second), 10),
 		logger:             logger,
 		allowedUserDomains: map[string]struct{}{"example.com": {}},
@@ -528,7 +563,13 @@ func TestSessionFixationAttack(t *testing.T) {
 		httpClient:         &http.Client{},
 		initComplete:       make(chan struct{}),
 		sessionManager:     sm,
+		extractClaimsFunc:  extractClaims,
 	}
+
+	// Set up the token verifier and JWT verifier
+	tOidc.jwtVerifier = tOidc
+	tOidc.tokenVerifier = tOidc
+
 	close(tOidc.initComplete)

 	// Now create a victim's request with the attacker's cookies
@@ -582,7 +623,7 @@ func TestSessionFixationAttack(t *testing.T) {
 // TestCSRFProtection tests CSRF protection in POST requests
 func TestCSRFProtection(t *testing.T) {
 	logger := NewLogger("debug")
-	sm, err := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, logger)
+	sm, err := NewSessionManager("test-secret-key-that-is-at-least-32-bytes", false, "", logger)
 	if err != nil {
 		t.Fatalf("Failed to create session manager: %v", err)
 	}
@@ -765,10 +806,13 @@ func TestCSRFProtection(t *testing.T) {

 // TestTokenBlacklisting tests the token blacklisting mechanism
 func TestTokenBlacklisting(t *testing.T) {
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
 	// Create a new instance for this test to avoid interference from global state
 	logger := NewLogger("debug")
-	tokenBlacklist := NewCache()
-	tokenCache := NewTokenCache()
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())

 	// Create keys
 	rsaPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
@@ -853,7 +897,7 @@ func TestTokenBlacklisting(t *testing.T) {

 // TestDifferentSigningAlgorithms tests that the plugin properly handles different signing algorithms
 func TestDifferentSigningAlgorithms(t *testing.T) {
-	ts := &TestSuite{t: t}
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Test cases for different algorithms - the implementation actually supports multiple algorithms
@@ -1154,7 +1198,7 @@ func createECJWK(privateKey *ecdsa.PrivateKey, alg, kid string) JWK {

 // TestMalformedTokens tests the plugin's handling of malformed tokens
 func TestMalformedTokens(t *testing.T) {
-	ts := &TestSuite{t: t}
+	ts := NewTestSuite(t)
 	ts.Setup()

 	testCases := []struct {
@@ -1217,23 +1261,28 @@ func TestMalformedTokens(t *testing.T) {

 // TestRateLimiting tests the rate limiting functionality to prevent brute force attacks
 func TestRateLimiting(t *testing.T) {
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
 	// Create a fresh instance for this test to avoid affecting other tests with rate limiting
 	logger := NewLogger("debug")

 	// Create a new test suite for this test only
-	ts := &TestSuite{t: t}
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Create a separate TraefikOidc instance with a very restrictive rate limiter
 	// This prevents the global instance from being rate-limited
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())
 	tOidc := &TraefikOidc{
 		issuerURL:      "https://test-issuer.com",
 		clientID:       "test-client-id",
 		clientSecret:   "test-client-secret",
 		jwkCache:       ts.mockJWKCache,
 		jwksURL:        "https://test-jwks-url.com",
-		tokenBlacklist: NewCache(),
-		tokenCache:     NewTokenCache(),
+		tokenBlacklist: tokenBlacklist,
+		tokenCache:     tokenCache,
 		// Allow only 2 requests per 10 seconds
 		limiter:            rate.NewLimiter(rate.Every(10*time.Second), 2),
 		logger:             logger,
@@ -1314,7 +1363,10 @@ func TestRateLimiting(t *testing.T) {
 // TestAuthorizationHeaderBypass tests that the plugin correctly handles attempts to bypass
 // authorization by directly providing an Authorization header
 func TestAuthorizationHeaderBypass(t *testing.T) {
-	ts := &TestSuite{t: t}
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Create a test next handler that would indicate successful authentication
@@ -1324,6 +1376,8 @@ func TestAuthorizationHeaderBypass(t *testing.T) {
 	})

 	// Create the TraefikOidc instance
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())
 	tOidc := &TraefikOidc{
 		next:               nextHandler,
 		name:               "test",
@@ -1334,8 +1388,8 @@ func TestAuthorizationHeaderBypass(t *testing.T) {
 		clientSecret:       "test-client-secret",
 		jwkCache:           ts.mockJWKCache,
 		jwksURL:            "https://test-jwks-url.com",
-		tokenBlacklist:     NewCache(),
-		tokenCache:         NewTokenCache(),
+		tokenBlacklist:     tokenBlacklist,
+		tokenCache:         tokenCache,
 		limiter:            rate.NewLimiter(rate.Every(time.Second), 10),
 		logger:             NewLogger("debug"),
 		allowedUserDomains: map[string]struct{}{"example.com": {}},
@@ -1386,7 +1440,7 @@ func TestAuthorizationHeaderBypass(t *testing.T) {

 // TestEmptyAudience tests tokens with empty audience claim
 func TestEmptyAudience(t *testing.T) {
-	ts := &TestSuite{t: t}
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Create a JWT with empty audience
@@ -1419,7 +1473,7 @@ func TestEmptyAudience(t *testing.T) {

 // TestEmptyIssuer tests tokens with empty issuer claim
 func TestEmptyIssuer(t *testing.T) {
-	ts := &TestSuite{t: t}
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Create a JWT with empty issuer
@@ -1452,7 +1506,10 @@ func TestEmptyIssuer(t *testing.T) {

 // TestInvalidRedirectURI tests the plugin's handling of invalid redirect URIs
 func TestInvalidRedirectURI(t *testing.T) {
-	ts := &TestSuite{t: t}
+	// Create cleanup helper
+	tc := newTestCleanup(t)
+
+	ts := NewTestSuite(t)
 	ts.Setup()

 	// Create a test request with an invalid redirect URI
@@ -1494,6 +1551,8 @@ func TestInvalidRedirectURI(t *testing.T) {
 	})

 	// Create the TraefikOidc instance
+	tokenBlacklist := tc.addCache(NewCache())
+	tokenCache := tc.addTokenCache(NewTokenCache())
 	tOidc := &TraefikOidc{
 		next:               nextHandler,
 		name:               "test",
@@ -1504,8 +1563,8 @@ func TestInvalidRedirectURI(t *testing.T) {
 		clientSecret:       "test-client-secret",
 		jwkCache:           ts.mockJWKCache,
 		jwksURL:            "https://test-jwks-url.com",
-		tokenBlacklist:     NewCache(),
-		tokenCache:         NewTokenCache(),
+		tokenBlacklist:     tokenBlacklist,
+		tokenCache:         tokenCache,
 		limiter:            rate.NewLimiter(rate.Every(time.Second), 10),
 		logger:             NewLogger("debug"),
 		allowedUserDomains: map[string]struct{}{"example.com": {}},