Specify headers to be stored in session

opensearch-project · Mar 7, 2020 · 09e12ca · 09e12ca
1 parent 6a03a8d
commit 09e12ca
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/lib/auth/types/AuthType.js b/lib/auth/types/AuthType.js
@@ -119,6 +119,7 @@ export default class AuthType {
                 authType: this.type,
                 authHeaderName: this.authHeaderName,
                 allowedHeaders: union(this.requestHeadersWhitelist, this.allowedAdditionalAuthHeaders),
+                headersToStoreInSession: this.allowedAdditionalAuthHeaders,
                 authenticateFunction: this.authenticate.bind(this),
                 validateAvailableTenants: this.validateAvailableTenants
             }

diff --git a/lib/session/sessionPlugin.js b/lib/session/sessionPlugin.js
@@ -17,6 +17,7 @@ internals.config = Joi.object({
     authType: Joi.string().allow(null),
     authHeaderName: Joi.string(),
     allowedHeaders: Joi.array().default([]),
+    headersToStoreInSession: Joi.array().default([]),
     authenticateFunction: Joi.func(),
     validateAvailableTenants: Joi.boolean().default(true),
     validateAvailableRoles: Joi.boolean().default(true)
@@ -119,7 +120,7 @@ const register = function (server, options) {
                 // If we used any additional auth headers when authenticating, we need to store them in the session
                 authResponse.session.additionalAuthHeaders = null;
                 if (Object.keys(additionalAuthHeaders).length) {
-                    authResponse.session.additionalAuthHeaders = additionalAuthHeaders;
+                    authResponse.session.additionalAuthHeaders = filterAuthHeaders(additionalAuthHeaders, settings.headersToStoreInSession);
                 }
 
                 request.cookieAuth.set(authResponse.session);