Limit redirect proxy handling to redirected responses

Kubernetes-commit: 1dae41c3609a35ec77c861e3663e4a6971ff94a6
kubernetes · Sep 17, 2022 · 14bc1be · 14bc1be
1 parent 8252641
commit 14bc1be
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 1 deletion.
diff --git a/pkg/util/proxy/upgradeaware.go b/pkg/util/proxy/upgradeaware.go
@@ -263,7 +263,7 @@ func (h *UpgradeAwareHandler) ServeHTTP(w http.ResponseWriter, req *http.Request
 		oldModifyResponse := proxy.ModifyResponse
 		proxy.ModifyResponse = func(response *http.Response) error {
 			code := response.StatusCode
-			if code >= 300 && code <= 399 {
+			if code >= 300 && code <= 399 && len(response.Header.Get("Location")) > 0 {
 				// close the original response
 				response.Body.Close()
 				msg := "the backend attempted to redirect this request, which is not permitted"

diff --git a/pkg/util/proxy/upgradeaware_test.go b/pkg/util/proxy/upgradeaware_test.go
@@ -710,6 +710,7 @@ func TestRejectForwardingRedirectsOption(t *testing.T) {
 		name                      string
 		rejectForwardingRedirects bool
 		serverStatusCode          int
+		redirect                  string
 		expectStatusCode          int
 		expectBody                []byte
 	}{
@@ -724,9 +725,25 @@ func TestRejectForwardingRedirectsOption(t *testing.T) {
 			name:                      "reject redirection enabled in proxy, backend server sending 301 response",
 			rejectForwardingRedirects: true,
 			serverStatusCode:          301,
+			redirect:                  "/",
 			expectStatusCode:          502,
 			expectBody:                []byte(`the backend attempted to redirect this request, which is not permitted`),
 		},
+		{
+			name:                      "reject redirection enabled in proxy, backend server sending 304 response with a location header",
+			rejectForwardingRedirects: true,
+			serverStatusCode:          304,
+			redirect:                  "/",
+			expectStatusCode:          502,
+			expectBody:                []byte(`the backend attempted to redirect this request, which is not permitted`),
+		},
+		{
+			name:                      "reject redirection enabled in proxy, backend server sending 304 response with no location header",
+			rejectForwardingRedirects: true,
+			serverStatusCode:          304,
+			expectStatusCode:          304,
+			expectBody:                []byte{}, // client doesn't read the body for 304 responses
+		},
 		{
 			name:                      "reject redirection disabled in proxy, backend server sending 200 response",
 			rejectForwardingRedirects: false,
@@ -738,6 +755,7 @@ func TestRejectForwardingRedirectsOption(t *testing.T) {
 			name:                      "reject redirection disabled in proxy, backend server sending 301 response",
 			rejectForwardingRedirects: false,
 			serverStatusCode:          301,
+			redirect:                  "/",
 			expectStatusCode:          301,
 			expectBody:                originalBody,
 		},
@@ -746,6 +764,9 @@ func TestRejectForwardingRedirectsOption(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			// Set up a backend server
 			backendServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if tc.redirect != "" {
+					w.Header().Set("Location", tc.redirect)
+				}
 				w.WriteHeader(tc.serverStatusCode)
 				w.Write(originalBody)
 			}))