fix(cloudflare-auth-access-provider): change default names for custom variables
Signed-off-by: Jason Diaz G. <jason.rene.diaz.gonzalez@ericsson.com>
This commit is contained in:
@@ -27,8 +27,8 @@ export interface Config {
|
||||
token: string;
|
||||
subject: string;
|
||||
}>;
|
||||
customHeader?: string;
|
||||
customCookieAuthName?: string;
|
||||
jwtHeaderName?: string;
|
||||
authorizationCookieName?: string;
|
||||
};
|
||||
/**
|
||||
* The backstage token expiration.
|
||||
|
||||
@@ -240,13 +240,16 @@ describe('helpers', () => {
|
||||
});
|
||||
});
|
||||
|
||||
it('works for regular tokens, through custom header auth', async () => {
|
||||
it('works for regular tokens, through jwtHeaderName header', async () => {
|
||||
jest.useFakeTimers({
|
||||
now: 1600000004000,
|
||||
});
|
||||
|
||||
const helper = AuthHelper.fromConfig(
|
||||
new ConfigReader({ teamName: 'mock-team', customHeader: 'X-Auth-Token' }),
|
||||
new ConfigReader({
|
||||
teamName: 'mock-team',
|
||||
jwtHeaderName: 'X-Auth-Token',
|
||||
}),
|
||||
{ cache },
|
||||
);
|
||||
const token = await tokenFactory.userToken();
|
||||
@@ -282,18 +285,21 @@ describe('helpers', () => {
|
||||
expect(JSON.parse(cache.set.mock.calls[0][1] as string)).toEqual(expected);
|
||||
});
|
||||
|
||||
it('works for regular tokens, through custom cookie auth name', async () => {
|
||||
it('works for regular tokens, through authorizationCookieName cookie name', async () => {
|
||||
jest.useFakeTimers({
|
||||
now: 1600000004000,
|
||||
});
|
||||
|
||||
const helper = AuthHelper.fromConfig(
|
||||
new ConfigReader({ teamName: 'mock-team', customCookieAuthName: 'CF_Custom_Auth' }),
|
||||
new ConfigReader({
|
||||
teamName: 'mock-team',
|
||||
authorizationCookieName: 'CF_Auth',
|
||||
}),
|
||||
{ cache },
|
||||
);
|
||||
const token = await tokenFactory.userToken();
|
||||
const request = createRequest({
|
||||
cookies: { 'CF_Custom_Auth': token },
|
||||
cookies: { CF_Custom_Auth: token },
|
||||
});
|
||||
|
||||
const expected = {
|
||||
|
||||
@@ -40,9 +40,9 @@ export class AuthHelper {
|
||||
options?: { cache?: CacheService },
|
||||
): AuthHelper {
|
||||
const teamName = config.getString('teamName');
|
||||
const customHeader = config.getOptionalString('customHeader');
|
||||
const customCookieAuthName = config.getOptionalString(
|
||||
'customCookieAuthName',
|
||||
const jwtHeaderName = config.getOptionalString('jwtHeaderName');
|
||||
const authorizationCookieName = config.getOptionalString(
|
||||
'authorizationCookieName',
|
||||
);
|
||||
const serviceTokens = (
|
||||
config.getOptionalConfigArray('serviceTokens') ?? []
|
||||
@@ -62,8 +62,8 @@ export class AuthHelper {
|
||||
serviceTokens,
|
||||
keySet,
|
||||
options?.cache,
|
||||
customHeader,
|
||||
customCookieAuthName,
|
||||
jwtHeaderName,
|
||||
authorizationCookieName,
|
||||
);
|
||||
}
|
||||
|
||||
@@ -72,24 +72,24 @@ export class AuthHelper {
|
||||
private readonly serviceTokens: ServiceToken[],
|
||||
private readonly keySet: ReturnType<typeof createRemoteJWKSet>,
|
||||
private readonly cache?: CacheService,
|
||||
private readonly customHeader?: string,
|
||||
private readonly customCookieAuthName?: string,
|
||||
private readonly jwtHeaderName?: string,
|
||||
private readonly authorizationCookieName?: string,
|
||||
) {}
|
||||
|
||||
async authenticate(req: express.Request): Promise<CloudflareAccessResult> {
|
||||
// JWTs generated by Access are available in a request header as
|
||||
// Cf-Access-Jwt-Assertion and as cookies as CF_Authorization.
|
||||
let jwt = req.header(this.customHeader || CF_JWT_HEADER);
|
||||
let jwt = req.header(this.jwtHeaderName || CF_JWT_HEADER);
|
||||
if (!jwt) {
|
||||
jwt = req.cookies[this.customCookieAuthName || COOKIE_AUTH_NAME];
|
||||
jwt = req.cookies[this.authorizationCookieName || COOKIE_AUTH_NAME];
|
||||
}
|
||||
if (!jwt) {
|
||||
// Only throw if both are not provided by Cloudflare Access since either
|
||||
// can be used.
|
||||
throw new AuthenticationError(
|
||||
`Missing ${this.customHeader || CF_JWT_HEADER} and
|
||||
`Missing ${this.jwtHeaderName || CF_JWT_HEADER} and
|
||||
${
|
||||
this.customCookieAuthName || COOKIE_AUTH_NAME
|
||||
this.authorizationCookieName || COOKIE_AUTH_NAME
|
||||
} from Cloudflare Access`,
|
||||
);
|
||||
}
|
||||
@@ -171,10 +171,10 @@ export class AuthHelper {
|
||||
): Promise<CloudflareAccessIdentityProfile> {
|
||||
const headers = new Headers();
|
||||
// set both headers just the way inbound responses are set
|
||||
headers.set(this.customHeader || CF_JWT_HEADER, jwt);
|
||||
headers.set(this.jwtHeaderName || CF_JWT_HEADER, jwt);
|
||||
headers.set(
|
||||
'cookie',
|
||||
`${this.customCookieAuthName || COOKIE_AUTH_NAME}=${jwt}`,
|
||||
`${this.authorizationCookieName || COOKIE_AUTH_NAME}=${jwt}`,
|
||||
);
|
||||
try {
|
||||
const res = await fetch(
|
||||
|
||||
Reference in New Issue
Block a user