bitly / oauth2_proxy

A reverse proxy that provides authentication with Google, Github or other provider
MIT License
5.1k stars 1.21k forks source link

OAuth 2 proxy redirects POST request which have // in path #179

Open pawanrawal opened 8 years ago

pawanrawal commented 8 years ago

I have OAuth 2 proxy which has Grafana as an upstream.

Grafana web makes a POST call to a url like this localhost:4180/api/datasources/proxy/2//_msearch?search_type=count . Since the path has a // before _msearch, oauth2_proxy immediately returns a 301 and sends a GET request to the same url which fails my request. Any reason why this might be happening ?

jehiah commented 8 years ago

@pawanrawal hmm... This certainly sounds like path normalization, but i'm not sure where that would be happening. Can you share some logs that might show this happening?

sjoerdmulder commented 8 years ago

I'm also experiencing this issue. Somehow double slashes causes redirects instead of just proxying to upstream

BTW found this that might be related https://groups.google.com/forum/#!topic/golang-nuts/zWPOOJjCgNQ

tekmaven commented 8 years ago

This is a problem. The proxy should not "normalize" urls.

The POST request gets 301 redirected and then a GET request is issued with no payload. This breaks Grafana and potentially other apps where there is "improper" urls generated with double slashes.

tekmaven commented 8 years ago

The good news is, Grafana has fixed this problem for the next release.

https://github.com/grafana/grafana/pull/5536

pmbauer commented 8 years ago

The source of this is deep in golang's ServeMux

https://github.com/golang/go/blame/6a982c390138fb2af49f85c4aeea2bce3222eb20/src/net/http/server.go#L1985 https://github.com/golang/go/blame/6a982c390138fb2af49f85c4aeea2bce3222eb20/src/net/http/server.go#L1941 https://github.com/golang/go/blob/4054769a31f66039f5fd74ca3164e9233f724da8/src/path/path.go#L69

kholloway commented 7 years ago

This affects anyone using Oauth2_proxy in front of Mesos/Marathon also.. :(

https://github.com/mesosphere/marathon/issues/3966

troxor commented 7 years ago

RabbitMQ Management plugin is also affected :( :(