forwardauth: Fix case when copy_headers is omitted (#4856)

See https://caddy.community/t/using-forward-auth-and-writing-my-own-authenticator-in-php/16410, apparently it didn't work when `copy_headers` wasn't used. This is because we were skipping adding a handler to the routes in the "good response handler", but this causes the logic in `reverseproxy.go` to ignore the response handler since it's empty. Instead, we can just always put in the `header` handler, even with an empty `Set` operation, it's just a no-op, but it fixes that condition in the proxy code.
This commit is contained in:
Francis Lavoie 2022-06-28 21:23:30 -04:00 committed by GitHub
parent 10f85558ea
commit 58e05cab15
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -185,32 +185,34 @@ func parseCaddyfile(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error)
},
Routes: []caddyhttp.Route{},
}
if len(headersToCopy) > 0 {
handler := &headers.Handler{
Request: &headers.HeaderOps{
Set: http.Header{},
},
}
for from, to := range headersToCopy {
handler.Request.Set[to] = []string{
"{http.reverse_proxy.header." + from + "}",
}
}
goodResponseHandler.Routes = append(
goodResponseHandler.Routes,
caddyhttp.Route{
HandlersRaw: []json.RawMessage{caddyconfig.JSONModuleObject(
handler,
"handler",
"headers",
nil,
)},
},
)
handler := &headers.Handler{
Request: &headers.HeaderOps{
Set: http.Header{},
},
}
// the list of headers to copy may be empty, but that's okay; we
// need at least one handler in the routes for the response handling
// logic in reverse_proxy to not skip this entry as empty.
for from, to := range headersToCopy {
handler.Request.Set[to] = []string{
"{http.reverse_proxy.header." + from + "}",
}
}
goodResponseHandler.Routes = append(
goodResponseHandler.Routes,
caddyhttp.Route{
HandlersRaw: []json.RawMessage{caddyconfig.JSONModuleObject(
handler,
"handler",
"headers",
nil,
)},
},
)
// note that when a response has any other status than 2xx, then we
// use the reverse proxy's default behaviour of copying the response
// back to the client, so we don't need to explicitly add a response