Merge pull request #69 from DiamondJoseph/user-x-forwarded-url

Use x-forwarded cookies to get original path for OIDC authentication …

CHANGELOG.md

@@ -1,5 +1,8 @@
 # Change Log
 
+## [1.4.8] - 2024-01-12
+- Optionally use `x-forwarded-` cookies when reconstructing redirect path for OIDC
+
 ## [1.4.7] - 2023-10-12
 - Add option to define package name parameter in OPA Config
 

fastapi_opa/auth/auth_oidc.py

@@ -26,10 +26,36 @@
 
 @dataclass
 class OIDCConfig:
+    """
+    Configuration for the OIDC flow.
+
+        PARAMETERS
+        ----------
+        app_uri: str
+            Unused
+        client_id: str
+            The OIDC client id of the service, to be passed with the
+            redirect to the OIDC provider
+        client_secret: str
+            The OIDC client secret, to be passed with the access_token
+            request from the middleware to the OIDC provider
+        scope: str, default="openid email profile"
+            Space seperated list of scopes to request from the OIDC provider
+        trust_x_headers: bool, default=False
+            Whether to trust incoming `x-forwarded-` headers when constructing
+            the redirect to pass to the OIDC provider.
+            The constructed redirect may have to match with a matcher regex
+            configured with the OIDC provider for the client-id.
+            However with a wildcard client-id this may open pathways for
+            malicious injection of headers as part of a cross-site attack,
+            and so defaults to false.
+    """
+
     app_uri: str
     client_id: str
     client_secret: str
     scope: str = field(default="openid email profile")
+    trust_x_headers: bool = field(default=False)
 
     # provide either well_known or all the other values
     well_known_endpoint: str = field(default="")
@@ -81,8 +107,12 @@ async def authenticate(
     ) -> Union[RedirectResponse, Dict]:
         callback_uri = urlunparse(
             [
-                request.url.scheme,
-                request.url.netloc,
+                request.headers.get("x-forwarded-proto", request.url.scheme)
+                if self.config.trust_x_headers
+                else request.url.scheme,
+                request.headers.get("x-forwarded-host", request.url.netloc)
+                if self.config.trust_x_headers
+                else request.url.netloc,
                 request.url.path,
                 "",
                 "",

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "fastapi-opa"
-version = "1.4.7"
+version = "1.4.8"
 description = "Fastapi OPA middleware incl. auth flow."
 authors = ["Matthias Osswald <info@busykoala.io>"]
 license = "GPL-3.0-or-later"

tests/test_oidc_auth.py

@@ -10,6 +10,9 @@
 from cryptography.hazmat.primitives._serialization import PublicFormat
 from freezegun import freeze_time
 from mock import Mock
+from starlette.datastructures import URL
+from starlette.datastructures import Headers
+from starlette.requests import Request
 
 from fastapi_opa.auth.auth_oidc import OIDCAuthentication
 from fastapi_opa.auth.exceptions import OIDCException
@@ -32,6 +35,25 @@ def test_auth_redirect_uri(mocker):
     assert expected_url == response
 
 
+@pytest.mark.asyncio
+async def test_auth_redirect_uri_from_headers(mocker):
+    call_uri = "http://fastapi-app.busykoala.ch/test/path"
+    headers = {"x-forwarded-proto": "https", "x-forwarded-host": "foo.bar.ch"}
+    with mocker.patch(
+        "fastapi_opa.auth.auth_oidc.requests.get",
+        return_value=oidc_well_known_response(),
+    ):
+        config = oidc_config()
+        config.trust_x_headers = True
+        oidc = OIDCAuthentication(config)
+    request: Request = Request({"type": "http", "query_string": ""})
+    request._headers = Headers(headers)
+    request._url = URL(call_uri)
+    response = await oidc.authenticate(request)
+    expected_url = "http://keycloak.busykoala.ch/auth/realms/example-realm/protocol/openid-connect/auth?response_type=code&scope=openid%20email%20profile&client_id=example-client&redirect_uri=https%3A//foo.bar.ch/test/path"  # noqa
+    assert expected_url == response.headers["location"]
+
+
 def test_get_auth_token(mocker):
     with mocker.patch(
         "fastapi_opa.auth.auth_oidc.requests.get",