search

thomseddon / traefik-forward-auth

Minimal forward authentication service that provides Google/OpenID oauth based login and authentication for the traefik reverse proxy
MIT License
2.18k stars 412 forks source link

Avoid modifying method on HEAD requests #353

Open bltavares opened 1 year ago

bltavares commented 1 year ago

Traefik sends a forward auth request for every request, including HEAD methods, in order to validate if a request can continue.

Due to Go HTTP client being strict to the HTTP SPEC, the response of a HEAD does not include a body, while Traefik expects a validation response to be embedded, causing errors.

To mitigate this, when a X-Forwarded-Method is set as HEAD, we'll avoid modifying the HTTP Method response in order to send a body back, allowing head requests to by validated.

This is necessary even if an allow rule is set, otherwhise it will fail as well.

Mitagates: https://github.com/thomseddon/traefik-forward-auth/issues/156

rsch136 commented 2 months ago

Hi! I am facing exactly the problem described in #156. Does anything speak against merging this PR?