sykkro / bearer-auth Goto Github PK

Currently, all logs print to stdout and there is no way to configure verbosity level.

We should allow a user to configure the level of logging via environment variable/yaml config.

What?

Add optional cookie validations for traefik-forward-auth integration. 🔐

Why?

Currently, we're blindly trusting the X-Forwarded-User (or similar name) header to map the provided user to a to-be-impersonated account. This makes the middleware susceptible to unauthorised user impersonation if other containers in the cluster query the endpoint with a simple forged header.
In deployments where bearer-auth is to be chained with traefik-forward-auth, we should do our best to mitigate this attack vector by hardening user impersonation, which can be done by applying some validations over authenticated cookies in the input request.

How?

To be further elaborated, but if cookie validation is enabled we'd probably need to mirror one or more of the following configurations from traefik-forward-auth:

• --cookie-domain
• --insecure-cookie
• --cookie-name
• secret

Then, for each request with authenticated users, we could retrieve the cookie and validate it according to the original implementation.