mirror of
https://github.com/git-pkgs/proxy.git
synced 2026-11-09 07:39:19 -05:00
aa0b543ae8Handlers set the configured upstream auth header on the request itself before handing it to the client. When upstream redirected to another host, Go's client copied that header to the next hop: it strips only Authorization and Cookie, so a "header" type credential such as X-JFrog-Art-Api reached the redirect target. The auth transport already applies credentials per hop, scoped to each hop's URL. - Remove Proxy.applyUpstreamAuth and Proxy.AuthForURL; auth comes only from the transport - Add a server test that redirects a header-authenticated upstream to another host and asserts the header stays with the upstream - Wire handler tests' auth through the transport, as the server does
21 lines
592 B
Go
21 lines
592 B
Go
package handler
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
upstreamhttp "github.com/git-pkgs/proxy/internal/httpclient"
|
|
)
|
|
|
|
// authorizeUpstream sends authorization on every upstream request the way the
|
|
// server does: through the auth transport, which scopes it to each hop.
|
|
func authorizeUpstream(proxy *Proxy, authorization string) {
|
|
base := proxy.HTTPClient.Transport
|
|
if base == nil {
|
|
base = http.DefaultTransport
|
|
}
|
|
client := *proxy.HTTPClient
|
|
client.Transport = upstreamhttp.NewTransport(base, func(string) (string, string) {
|
|
return "Authorization", authorization
|
|
})
|
|
proxy.HTTPClient = &client
|
|
}
|