fix: response handling for session store (bearer + cookie)

pipeline/authn/authenticator_bearer_token.go

@@ -154,6 +154,10 @@ func (a *AuthenticatorBearerToken) Authenticate(r *http.Request, session *Authen
 		return helper.ErrForbidden.WithReasonf("The configured extra_from GJSON path returned an error on JSON output: %s", err.Error()).WithDebugf("GJSON path: %s\nBody: %s\nResult: %s", cf.ExtraFrom, body, extraRaw).WithTrace(err)
 	}
 
+	if len(subject) == 0 {
+		return errors.WithStack(helper.ErrForbidden.WithReasonf("Subject field from remote endpoint is empty."))
+	}
+
 	session.Subject = subject
 	session.Extra = extra
 	return nil

pipeline/authn/authenticator_bearer_token_test.go

@@ -203,6 +203,24 @@ func TestAuthenticatorBearerToken(t *testing.T) {
 					Subject: "123",
 				},
 			},
+			{
+				d: "should NOT pass Accept-Encoding",
+				r: &http.Request{Host: "some-host", Header: http.Header{"Authorization": {"bearer zyx"}, "Accept-Encoding": {"gzip"}}, URL: &url.URL{Path: "/users/123", RawQuery: "query=string"}, Method: "PUT"},
+				router: func(w http.ResponseWriter, r *http.Request) {
+					assert.Equal(t, r.Method, "PUT")
+					assert.Equal(t, "some-host", r.Header.Get("X-Forwarded-Host"))
+					assert.Equal(t, "bar", r.Header.Get("X-Foo"))
+					assert.Equal(t, r.Header.Get("Authorization"), "bearer zyx")
+					assert.Equal(t, "", r.Header.Get("Accept-Encoding"))
+					w.WriteHeader(200)
+					w.Write([]byte(`{"sub": "123"}`))
+				},
+				config:    []byte(`{"preserve_host": true, "additional_headers": {"X-Foo": "bar","X-Forwarded-For": "not-some-host"}}`),
+				expectErr: false,
+				expectSess: &AuthenticationSession{
+					Subject: "123",
+				},
+			},
 			{
 				d: "does not pass request body through to auth server",
 				r: &http.Request{
@@ -258,6 +276,19 @@ func TestAuthenticatorBearerToken(t *testing.T) {
 					Extra:   map[string]interface{}{"session": map[string]interface{}{"foo": "bar"}, "identity": map[string]interface{}{"id": "123"}},
 				},
 			},
+			{
+				d: "it should error when the subject is empty",
+				r: &http.Request{Header: http.Header{"Authorization": {"bearer token"}}, URL: &url.URL{Path: ""}},
+				setup: func(t *testing.T, m *httprouter.Router) {
+					m.GET("/", func(w http.ResponseWriter, _ *http.Request, _ httprouter.Params) {
+						w.WriteHeader(200)
+						w.Write([]byte(`{"identity": {"id": ""}, "session": {"foo": "bar"}}`))
+					})
+				},
+				config:     []byte(`{"subject_from": "identity.id", "extra_from": "@this"}`),
+				expectErr:  true,
+				expectSess: &AuthenticationSession{},
+			},
 			{
 				d: "should work with custom header forwarded",
 				r: &http.Request{Header: http.Header{"Authorization": {"bearer token"}, "X-User": {"123"}}, URL: &url.URL{Path: ""}},

pipeline/authn/authenticator_cookie_session.go

@@ -197,9 +197,9 @@ func forwardRequestToSessionStore(client *http.Client, r *http.Request, cf Authe
 			return json.RawMessage{}, errors.WithStack(herodot.ErrInternalServerError.WithReasonf("Unable to fetch cookie session context from remote: %+v", err))
 		}
 		return body, nil
-	} else {
-		return json.RawMessage{}, errors.WithStack(helper.ErrUnauthorized)
 	}
+
+	return json.RawMessage{}, errors.WithStack(helper.ErrUnauthorized)
 }
 
 func PrepareRequest(r *http.Request, cf AuthenticatorForwardConfig) (http.Request, error) {