Sign upstream requests with a verifiable digital signature.

buzzfeed · katzdm · Nov 27, 2018 · katzdm · Nov 27, 2018 · katzdm
diff --git a/internal/proxy/request_signer.go b/internal/proxy/request_signer.go
diff --git a/internal/proxy/oauthproxy.go b/internal/proxy/oauthproxy.go
+// used to sign each request.
+func (p *OAuthProxy) Certs(rw http.ResponseWriter, _ *http.Request) {
+	rw.WriteHeader(http.StatusOK)
+	fmt.Fprint(rw, p.publicCertsJSON)
diff --git a/internal/proxy/oauthproxy.go b/internal/proxy/oauthproxy.go
diff --git a/internal/proxy/oauthproxy.go b/internal/proxy/oauthproxy.go
diff --git a/internal/proxy/request_signer.go b/internal/proxy/request_signer.go
diff --git a/internal/proxy/oauthproxy.go b/internal/proxy/oauthproxy.go
diff --git a/internal/proxy/request_signer.go b/internal/proxy/request_signer.go
+//      hash value received through the `Octoboi-Signature` of the request.
+//
+//  Any requests failing this check should be considered tampered with, and rejected.
+func (signer RequestSigner) Sign(req *http.Request) error {
diff --git a/internal/proxy/request_signer.go b/internal/proxy/request_signer.go