v0.34.15

src/proxy/forward_entry.rs

@@ -2,9 +2,13 @@ async fn forward(
     State(state): State<Arc<App>>,
     Extension(peer): Extension<PeerAddr>,
     Extension(local): Extension<LocalAddr>,
-    request: Request,
+    mut request: Request,
 ) -> Response {
-    forward_request(state, peer, local, request).await
+    let cookies = crate::auth_provider::CookieSink::default();
+    request.extensions_mut().insert(cookies.clone());
+    let mut response = forward_request(state, peer, local, request).await;
+    cookies.apply(&mut response);
+    response
 }
 
 async fn forward_request(
@@ -197,7 +201,7 @@ async fn forward_request(
         tls,
         &original_host,
         request.uri(),
-        frontend.is_some_and(|frontend| frontend.tinyauth.is_some()),
+        frontend.is_some_and(|frontend| frontend.auth_provider.is_some()),
         request
             .extensions()
             .get::<Arc<crate::forwarding::PeerFormatting>>()
@@ -464,6 +468,18 @@ async fn forward_request(
         .filter(|route| route.error_fallback.is_some())
         .map(|_| ErrorFallbackRequest::capture(&request, &snapshot));
     let admin_cookie = headers::strip_admin_cookie(request.headers_mut());
+
+    if let Some(auth) = frontend.and_then(|frontend| frontend.auth_provider.as_ref()) {
+        if auth.reserved_path(&path) {
+            return match auth.serve_reserved(request, &context, &state.shutdown) {
+                Some(response) => response.await,
+                None => error(
+                    StatusCode::BAD_GATEWAY,
+                    "RustProxy: authentication route unavailable\n",
+                ),
+            };
+        }
+    }
     let basic_identity = if let Some(auth) = frontend.and_then(|f| f.basic_auth.as_ref()) {
         match auth
             .authorize(
@@ -487,14 +503,20 @@ async fn forward_request(
             "RustProxy: WebSocket access is disabled for this host\n",
         );
     }
-    let identity = if let Some(auth) = frontend.and_then(|f| f.tinyauth.as_ref()) {
+    let identity = if let Some(auth) = frontend.and_then(|f| f.auth_provider.as_ref()) {
         auth.strip_identity(request.headers_mut());
+        let cookies = request
+            .extensions()
+            .get::<crate::auth_provider::CookieSink>()
+            .cloned()
+            .unwrap_or_default();
         match auth
             .authorize(
                 request.headers(),
                 request.method(),
                 &context,
                 &state.shutdown,
+                &cookies,
             )
             .await
         {