proxy

Documentation

Overview

Package proxy accepts externally asserted identities only from explicitly trusted requests. Trusted network placement alone is insufficient if the upstream forwards spoofed headers.

Index

• type Authenticator
  • func (a Authenticator[User]) Authenticate(r *http.Request) (User, error)
  • func (a Authenticator[User]) Validate() error
• type Resolver
• type TrustFunc
  • func TrustCIDRs(cidrs []string) (TrustFunc, error)

Types

type Authenticator

type Authenticator[User any] struct {
	// Trust validates the immediate upstream. Nil denies all requests.
	Trust TrustFunc
	// Resolve maps the external identity into a local user.
	Resolve Resolver[User]
	// UsernameHeaders are tried in order until a nonempty value is found.
	UsernameHeaders []string
	// EmailHeaders are optional email-identity header names.
	EmailHeaders []string
	// DisplayNameHeaders are optional human-readable name headers.
	DisplayNameHeaders []string
	// GroupHeaders contain optional comma-separated group names.
	GroupHeaders []string
	// Issuer is a stable deployment-specific namespace for asserted users.
	Issuer string
}

Authenticator enforces an ingress trust boundary before reading identity headers.

func (Authenticator[User]) Authenticate

func (a Authenticator[User]) Authenticate(r *http.Request) (User, error)

Authenticate converts trusted headers into a verified external identity.

func (Authenticator[User]) Validate

func (a Authenticator[User]) Validate() error

Validate checks that ingress trust and identity resolution are explicitly configured.

type Resolver

type Resolver[User any] func(context.Context, auth.ExternalIdentity) (User, error)

Resolver maps a verified external identity into an application-owned user.

type TrustFunc

type TrustFunc func(*http.Request) bool

TrustFunc returns true only when a request came through a verified ingress. The ingress must strip client-supplied identity headers and set its own.

func TrustCIDRs

func TrustCIDRs(cidrs []string) (TrustFunc, error)

TrustCIDRs checks the immediate TCP peer against nonempty trusted network ranges. It never trusts Forwarded or X-Forwarded-For. The ingress must strip and replace identity headers.