Handle set-cookie process

Author: andrewheberle

README.md

@@ -102,9 +102,16 @@ backend be_protected
 	# set up spoe filter
 	filter spoe engine auth-request config /usr/local/etc/haproxy/spoe.cfg
 
-	# send to spoe and act on response
+	# send to spoe
 	http-request send-spoe-group auth-request auth-request-group
+
+  # perform redirect and set cookie if the response was a redirect with a cookie
+  http-request return status 302 hdr location %[var(txn.auth_request.response_location)] hdr set-cookie %[var(req.auth_request.response_cookie)] if { var(txn.auth_request.response_redirect) -m bool } !{ var(txn.auth_request.response_successful) -m bool } { var(req.auth_request.response_cookie) -m found }
+
+  # perform a redirect only if no cookie was provided
 	http-request redirect location %[var(txn.auth_request.response_location)] if { var(txn.auth_request.response_redirect) -m bool } !{ var(txn.auth_request.response_successful) -m bool }
+
+  # deny request otherwise
 	http-request deny if !{ var(txn.auth_request.response_successful) -m bool }
 
         # have your server(s) here

examples/haproxy.cfg

@@ -65,7 +65,14 @@ backend be_protected
 
 	# send to spoe and act on response
 	http-request send-spoe-group auth-request auth-request-group
+
+	# perform redirect and set cookie if the response was a redirect with a cookie
+	http-request return status 302 hdr location %[var(txn.auth_request.response_location)] hdr set-cookie %[var(req.auth_request.response_cookie)] if { var(txn.auth_request.response_redirect) -m bool } !{ var(txn.auth_request.response_successful) -m bool } { var(req.auth_request.response_cookie) -m found }
+
+	# perform a redirect only if no cookie was provided
 	http-request redirect location %[var(txn.auth_request.response_location)] if { var(txn.auth_request.response_redirect) -m bool } !{ var(txn.auth_request.response_successful) -m bool }
+
+	# deny request otherwise
 	http-request deny if !{ var(txn.auth_request.response_successful) -m bool }
 
 	# Return some content for successful auth

pkg/auth/auth.go

@@ -114,14 +114,6 @@ func (auth *AuthHandler) Handler(req *request.Request) {
 			}
 		}
 
-		// set cookie if present
-		if cookies := res.Cookies(); len(cookies) == 1 {
-			if v := cookies[0].String(); v != "" {
-				req.Actions.SetVar(action.ScopeRequest, "response_cookie.name", cookies[0].Name)
-				req.Actions.SetVar(action.ScopeRequest, "response_cookie.value", v)
-			}
-		}
-
 		logger.Info("message handled")
 		return
 	}
@@ -137,6 +129,16 @@ func (auth *AuthHandler) Handler(req *request.Request) {
 			req.Actions.SetVar(action.ScopeTransaction, "response_redirect", true)
 			req.Actions.SetVar(action.ScopeTransaction, "response_location", location)
 		}
+
+		logger = logger.With("cookies", len(res.Cookies()))
+
+		// set cookie if present
+		if cookies := res.Cookies(); len(cookies) == 1 {
+			if v := cookies[0].String(); v != "" {
+				logger = logger.With("response_cookie", v)
+				req.Actions.SetVar(action.ScopeRequest, "response_cookie", v)
+			}
+		}
 	}
 
 	// all other responses