buzzfeed / sso

sso, aka S.S.Octopus, aka octoboi, is a single sign-on solution for securing internal services
MIT License
3.09k stars 186 forks source link

Unable to proxy server-sent events (SSE) / event stream #232

Open MrSaints opened 5 years ago

MrSaints commented 5 years ago

Describe the bug

The SSO proxy does not handle upstream server-sent events (SSE) / text/event-stream. SSO proxy attempts to handle the request before failing with: ReverseProxy read error during body copy: context deadline exceeded.

A workaround for now is setting a low flush interval:

# upstream_configs.yml
    - service: myservice
      default:
        from: myservice.sso.mydomain.com
        to: http://myservice.mynamespace.svc.cluster.local
        # HACK: to handle `text/event-stream` (SSE)
        # See also: https://github.com/golang/go/issues/27816
        options:
          flush_interval: 100ms

A potential fix is probably to flush immediately if the content-type matches text/event-stream: https://github.com/golang/go/commit/5440bfc2ea8c0a4c78d5161605659c07ea10e37a#diff-d863507a61be206d112f6e00e6d812a2R342

To Reproduce Steps to reproduce the behavior:

  1. Load a page that leverages EventSource to receive automatic updates from a "server" behind SSO proxy (in our case, we are proxying https://argoproj.github.io/argo/ UI)
  2. Wait for automatic updates
  3. Check console, and network logs
  4. Request to the server would have timed out

Expected behavior

Any automatic updates (real-time) should be received on the client side.

Screenshots

N/A

Desktop (please complete the following information):

Smartphone (please complete the following information):

N/A

Additional context

We are using buzzfeed/sso:v1.2.0 on Kubernetes 1.13.

The problem is likely related to https://github.com/golang/go/issues/27816. Though, when we recompiled SSO proxy with the latest version of Go (which should have the fix for the linked issue), the problem still persisted.

willejs commented 5 years ago

I actually encountered the same issue in oauth2_proxy and think i made a similar patch which may have worked. https://github.com/bitly/oauth2_proxy/issues/266