upstream/traefik
1
0
Fork 0
mirror of https://github.com/traefik/traefik.git synced 2026-06-08 16:22:52 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Clear Ssl-Client-* headers when no client certificate is present

Browse source
This commit is contained in:
Gina A. 2026-06-02 10:40:06 +02:00 committed by GitHub
parent 9a276c3aeb
commit a669522eca
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 24 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
pkg/middlewares/ingressnginx/authtlspasscertificatetoupstream/auth_tls_pass_certificate_to_upstream.go
View file

@ -65,6 +65,10 @@ func (p *authTLSPassCertificateToUpstream) ServeHTTP(rw http.ResponseWriter, req
if req.TLS == nil || len(req.TLS.PeerCertificates) == 0 {
logger.Debug().Msg("Tried to extract a certificate on a request without mutual TLS")
req.Header.Set(sslClientVerify, "NONE")
// Prevent client-supplied values from reaching the upstream on the no-mTLS path.
req.Header.Del(sslClientCert)
req.Header.Del(sslClientSubjectDN)
req.Header.Del(sslClientIssuerDN)
p.next.ServeHTTP(rw, req)
return
}

20
pkg/middlewares/ingressnginx/authtlspasscertificatetoupstream/auth_tls_pass_certificate_to_upstream_test.go
View file

@ -360,6 +360,26 @@ func TestAuthTLSPassCertificateToUpstream(t *testing.T) {
}
}
func TestAuthTLSNoMTLSClearsCertHeaders(t *testing.T) {
config := dynamic.AuthTLSPassCertificateToUpstream{
ClientAuthType: tls.VerifyClientCertIfGiven,
}
handler, err := NewAuthTLSPassCertificateToUpstream(t.Context(), next, config, "test")
require.NoError(t, err)
req := testhelpers.MustNewRequest(http.MethodGet, "http://example.com/foo", nil)
req.Header.Set(sslClientCert, "client-cert")
req.Header.Set(sslClientSubjectDN, "CN=client")
req.Header.Set(sslClientIssuerDN, "CN=client-CA")
handler.ServeHTTP(httptest.NewRecorder(), req)
assert.Equal(t, "NONE", req.Header.Get(sslClientVerify))
assert.Empty(t, req.Header.Get(sslClientCert))
assert.Empty(t, req.Header.Get(sslClientSubjectDN))
assert.Empty(t, req.Header.Get(sslClientIssuerDN))
}
func buildTLSWith(certContents []string) *cryptoTLS.ConnectionState {
var peerCertificates []*x509.Certificate