kaancfidan / bouncer Goto Github PK

• Dockerfile
• Github action to publish image

In the reverse proxy scenario, it might be useful for some users if bouncer also performed TLS termination.

TLS termination should be optional and should only be forced when a certificate is configured during deployment.

Wildcard based route configuration is prone to errors and security problems.

Implement a path tree-like configuration to setup route policies more explicitly.

https://github.com/lestrrat-go/jwx is an up-to-date alternative.

Config:

routePolicies:
 - path: /**
   allowAnonymous: true
 - path: /**
   methods: [DELETE]
   allowAnonymous: false

Expected behavior:
Only DELETE requests should be authenticated, all others pass anonymously.

Actual behavior:
DELETE also passes anonymously.

A few test cases that cover reading actual config files and respond to actual HTTP requests are needed.

When multiple route policies are matched to an anonymous request, if the most narrow path is allowed anonymously, the request should be allowed

gosec warning:

[/github/workspace/main.go:47] - G114 (CWE): Use of net/http serve function that has no support for setting timeouts (Confidence: HIGH, Severity: MEDIUM)
46:
47: err = http.ListenAndServe(f.listenAddress, nil)
48: log.Fatal(err)