Fix and enhance path normalization

e2e/e2e_redis_test.go

@@ -83,7 +83,8 @@ var _ = Describe("Code Flow PKCE login/logout with mTLS REDIS", func() {
 	})
 
 	When("Peforming standard login", func() {
-		It("should login with user/password and logout successfully",
+		It(
+			"should login with user/password and logout successfully",
 			Label("code_flow", "pkce", "redis"),
 			func(_ context.Context) {
 				var err error
@@ -186,7 +187,8 @@ var _ = Describe("Code Flow PKCE login/logout with mTLS REDIS CLUSTER", func() {
 	})
 
 	When("Peforming standard login", func() {
-		It("should login with user/password and logout successfully",
+		It(
+			"should login with user/password and logout successfully",
 			Label("code_flow", "pkce", "redis_cluster"),
 			func(_ context.Context) {
 				var err error
@@ -289,7 +291,8 @@ var _ = Describe("Code Flow PKCE login/logout with mTLS REDIS SENTINEL", func()
 	})
 
 	When("Peforming standard login", func() {
-		It("should login with user/password and logout successfully",
+		It(
+			"should login with user/password and logout successfully",
 			Label("code_flow", "pkce", "redis_cluster"),
 			func(_ context.Context) {
 				var err error

e2e/e2e_root_test.go

@@ -105,7 +105,8 @@ var _ = Describe("Code Flow login/logout compression and encryption Auth Scheme
 	})
 
 	When("Performing standard login", func() {
-		It("should login with user/password and logout successfully",
+		It(
+			"should login with user/password and logout successfully",
 			Label("code_flow"),
 			Label("compression_auth_scheme"),
 			Label("auth_scheme_cookie"),

e2e/e2e_test.go

@@ -1,6 +1,5 @@
 package e2e_test
 
-//
 import (
 	"bytes"
 	"compress/flate"

e2e/e2e_uma_test.go

@@ -256,7 +256,8 @@ var _ = Describe("UMA Code Flow authorization with method scope", func() {
 				rClient.SetRedirectPolicy(resty.NoRedirectPolicy())
 				resp, _ = rClient.R().Get(proxyAddress + umaAllowedPath)
 				Expect(resp.StatusCode()).To(Equal(http.StatusSeeOther))
-			})
+			},
+		)
 	})
 })
 

e2e/e2e_websocket_test.go

@@ -85,7 +85,8 @@ var _ = Describe("NoRedirects Websocket login/logout", func() {
 	})
 
 	When("Performing standard login", func() {
-		It("should login with service account and logout successfully",
+		It(
+			"should login with service account and logout successfully",
 			Label("api_flow"),
 			Label("websocket"),
 			func(ctx context.Context) {
@@ -98,7 +99,8 @@ var _ = Describe("NoRedirects Websocket login/logout", func() {
 
 				rClient := resty.New()
 				hClient := rClient.SetTLSClientConfig(
-					&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13}).GetClient()
+					&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13},
+				).GetClient()
 				oidcLibCtx := context.WithValue(ctx, oauth2.HTTPClient, hClient)
 
 				respToken, err := conf.Token(oidcLibCtx)
@@ -150,7 +152,8 @@ var _ = Describe("NoRedirects Websocket login/logout", func() {
 	})
 
 	When("Performing websocket connection on http backend", func() {
-		It("websocket upgrade should fail",
+		It(
+			"websocket upgrade should fail",
 			Label("api_flow"),
 			Label("websocket_fail"),
 			func(ctx context.Context) {
@@ -163,7 +166,8 @@ var _ = Describe("NoRedirects Websocket login/logout", func() {
 
 				rClient := resty.New()
 				hClient := rClient.SetTLSClientConfig(
-					&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13}).GetClient()
+					&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13},
+				).GetClient()
 				oidcLibCtx := context.WithValue(ctx, oauth2.HTTPClient, hClient)
 
 				respToken, err := conf.Token(oidcLibCtx)
@@ -189,7 +193,8 @@ var _ = Describe("NoRedirects Websocket login/logout", func() {
 				rClient.SetTLSClientConfig(&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13})
 
 				request := rClient.SetRedirectPolicy(
-					resty.NoRedirectPolicy()).R().SetAuthToken(respToken.AccessToken)
+					resty.NoRedirectPolicy(),
+				).R().SetAuthToken(respToken.AccessToken)
 				resp, err := request.Get(proxyAddress)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(resp.StatusCode()).To(Equal(http.StatusOK))
@@ -271,7 +276,8 @@ var _ = Describe("Code Flow websocket login/logout", func() {
 	})
 
 	When("Performing standard websocket login", func() {
-		It("should login with user/password and logout successfully",
+		It(
+			"should login with user/password and logout successfully",
 			Label("code_flow"),
 			Label("basic_case"),
 			func(_ context.Context) {
@@ -345,7 +351,8 @@ var _ = Describe("Code Flow websocket login/logout", func() {
 	})
 
 	When("Performing websocket connection on http backend", func() {
-		It("websocket upgrade should fail",
+		It(
+			"websocket upgrade should fail",
 			Label("code_flow"),
 			Label("websocket"),
 			func(_ context.Context) {

pkg/config/core/resource_test.go

@@ -22,6 +22,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"github.com/gogatekeeper/gatekeeper/pkg/config/core"
+	"github.com/gogatekeeper/gatekeeper/pkg/constant"
 	"github.com/gogatekeeper/gatekeeper/pkg/utils"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -127,23 +128,23 @@ func TestResourceParseOk(t *testing.T) {
 		{
 			Option: "uri=/*|methods=any",
 			Resource: &core.Resource{
-				URL:     "/*",
+				URL:     constant.AllPath,
 				Methods: utils.AllHTTPMethods,
 			},
 			Ok: true,
 		},
 		{
 			Option: "uri=/*|methods=any",
 			Resource: &core.Resource{
-				URL:     "/*",
+				URL:     constant.AllPath,
 				Methods: utils.AllHTTPMethods,
 			},
 			Ok: true,
 		},
 		{
 			Option: "uri=/*|groups=admin,test",
 			Resource: &core.Resource{
-				URL:     "/*",
+				URL:     constant.AllPath,
 				Methods: utils.AllHTTPMethods,
 				Groups:  []string{"admin", "test"},
 			},
@@ -152,7 +153,7 @@ func TestResourceParseOk(t *testing.T) {
 		{
 			Option: "uri=/*|groups=admin",
 			Resource: &core.Resource{
-				URL:     "/*",
+				URL:     constant.AllPath,
 				Methods: utils.AllHTTPMethods,
 				Groups:  []string{"admin"},
 			},
@@ -161,7 +162,7 @@ func TestResourceParseOk(t *testing.T) {
 		{
 			Option: "uri=/*|require-any-role=true",
 			Resource: &core.Resource{
-				URL:            "/*",
+				URL:            constant.AllPath,
 				Methods:        utils.AllHTTPMethods,
 				RequireAnyRole: true,
 			},

pkg/constant/constant.go

@@ -144,6 +144,8 @@ const (
 	NegateRegexChar = "!"
 
 	IdentityHeaderEncoding = "UTF-8"
+
+	DoubleSlash = "//"
 )
 
 //nolint:gochecknoglobals

pkg/keycloak/config/config.go

@@ -147,6 +147,12 @@ type Config struct {
 	LogSamplingAfter                   int               `env:"LOG_SAMPLING_AFTER" json:"log-sampling-after" usage:"each n-th number message is logged, after initial messages logged" yaml:"log-sampling-after"`
 	OpenIDProviderRetryCount           int               `env:"OPENID_PROVIDER_RETRY_COUNT" json:"openid-provider-retry-count,omitempty" usage:"number of retries for retrieving openid configuration" yaml:"openid-provider-retry-count"`
 	OpenIDProviderTimeout              time.Duration     `env:"OPENID_PROVIDER_TIMEOUT" json:"openid-provider-timeout,omitempty" usage:"timeout for openid configuration on .well-known/openid-configuration" yaml:"openid-provider-timeout"`
+	NormalizePath                      bool              `env:"NORMALIZE_PATH" json:"normalize-path" usage:"normalizes path according RFC 3986, except slashes, at start of processing chain, used in internal chains" yaml:"normalize-path"`
+	NormalizePathUpstream              bool              `env:"NORMALIZE_PATH_UPSTREAM" json:"normalize-path-upstream" usage:"normalizes path for upstream according RFC 3986, except slashes" yaml:"normalize-path-upstream"`
+	MergeSlashes                       bool              `env:"MERGE_SLASHES" json:"merge-slashes" usage:"merges slashes at start of processing, at start of processing chain, used in internal chains" yaml:"merge-slashes"`
+	MergeSlashesUpstream               bool              `env:"MERGE_SLASHES_UPSTREAM" json:"merge-slashes-upstream" usage:"merges slashes for path to upstream" yaml:"merge-slashes-upstream"`
+	PathEscapedSlashes                 bool              `env:"PATH_ESCAPED_SLASHES" json:"path-escaped-slashes" usage:"escape slashes, means preserve hex encoding, at start of processing chain, used in internal chains" yaml:"path-escaped-slashes"`
+	PathEscapedSlashesUpstream         bool              `env:"PATH_ESCAPED_SLASHES_UPSTREAM" json:"path-escaped-slashes-upstream" usage:"escape slashes, means preserve hex encoding for path sent upstream" yaml:"path-escaped-slashes-upstream"`
 	EnableProfiling                    bool              `env:"ENABLE_PROFILING" json:"enable-profiling" usage:"switching on the golang profiling via pprof on /debug/pprof, /debug/pprof/heap etc" yaml:"enable-profiling"`
 	EnableIDPSessionCheck              bool              `env:"ENABLE_IDP_SESSION_CHECK" json:"enable-idp-session-check" usage:"during token validation it also checks if user session is still present, useful for multiapp logout" yaml:"enable-idp-session-check"`
 	EnabledSelfSignedTLS               bool              `env:"ENABLE_SELF_SIGNED_TLS" json:"enable-self-signed-tls" usage:"create self signed certificates for the proxy" yaml:"enable-self-signed-tls"`
@@ -283,6 +289,12 @@ func NewDefaultConfig() *Config {
 		OpaTimeout:                       constant.DefaultOpaTimeout,
 		LogSamplingInitial:               constant.DefaultLogSamplingInitial,
 		LogSamplingAfter:                 constant.DefaultLogSamplingAfter,
+		NormalizePath:                    true,
+		NormalizePathUpstream:            true,
+		MergeSlashes:                     true,
+		MergeSlashesUpstream:             true,
+		PathEscapedSlashes:               false,
+		PathEscapedSlashesUpstream:       false,
 	}
 }
 

pkg/keycloak/proxy/server.go

@@ -337,7 +337,15 @@ func (r *OauthProxy) useDefaultStack(
 	}
 
 	// @step: enable the entrypoint middleware
-	engine.Use(gmiddleware.EntrypointMiddleware(r.Log))
+	engine.Use(gmiddleware.EntrypointMiddleware(
+		r.Log,
+		r.Config.NormalizePath,
+		r.Config.NormalizePathUpstream,
+		r.Config.MergeSlashes,
+		r.Config.MergeSlashesUpstream,
+		r.Config.PathEscapedSlashes,
+		r.Config.PathEscapedSlashesUpstream,
+	))
 
 	if r.Config.NoProxy {
 		engine.Use(gmiddleware.ForwardAuthMiddleware(r.Log, r.Config.OAuthURI))
@@ -726,15 +734,16 @@ func (r *OauthProxy) CreateReverseProxy() error {
 			}
 
 			eng.Get(constant.CallbackURL, oauthCallbackHand)
-			eng.Get(constant.ExpiredURL, handlers.ExpirationHandler(
-				r.Log,
-				r.Provider,
-				r.Config.ClientID,
-				r.Config.SkipAccessTokenClientIDCheck,
-				r.Config.SkipAccessTokenIssuerCheck,
-				getIdentity,
-				r.Config.CookieAccessName,
-			),
+			eng.Get(
+				constant.ExpiredURL, handlers.ExpirationHandler(
+					r.Log,
+					r.Provider,
+					r.Config.ClientID,
+					r.Config.SkipAccessTokenClientIDCheck,
+					r.Config.SkipAccessTokenIssuerCheck,
+					getIdentity,
+					r.Config.CookieAccessName,
+				),
 			)
 
 			if r.Config.EnableLogoutAuth {
@@ -887,7 +896,8 @@ func (r *OauthProxy) CreateReverseProxy() error {
 		if r.Config.EnableLoA && res.NoRedirect {
 			r.Log.Warn(
 				"disabling LoA for resource, no-redirect=true for resource",
-				zap.String("resource", res.URL))
+				zap.String("resource", res.URL),
+			)
 		}
 
 		var loAMid func(http.Handler) http.Handler
@@ -943,7 +953,8 @@ func (r *OauthProxy) CreateReverseProxy() error {
 
 				r.Log.Warn(
 					"disabling EnableUma for resource, no-redirect=true for resource",
-					zap.String("resource", res.URL))
+					zap.String("resource", res.URL),
+				)
 			}
 
 			authzMiddleware := authorizationMiddleware(

pkg/proxy/cookie/cookies.go

@@ -177,7 +177,7 @@ func (cm *Manager) DropStateParameterCookie(req *http.Request, wrt http.Response
 		wrt.WriteHeader(http.StatusInternalServerError)
 	}
 
-	requestURI := req.URL.RequestURI()
+	requestURI := req.URL.RawPath
 
 	if cm.NoProxy && !cm.NoRedirects {
 		xReqURI := req.Header.Get(constant.HeaderXForwardedURI)