feat: add support for bearer tokens in websocket protocols

[CrimsonFez]

This is a simple change that enables us to extract the JWT from the WebSocket protocols as defined here kubernetes/kubernetes#47740. This satisfies #499.

Let me know if any changes are needed.

Thank you!

[oliverbaehler]

HI! You need to sign off your commits and gpg sign them as well :)

[CrimsonFez]

Should now be correct

[prometherion]

Maybe the suggested code is incorrect, but we cannot return an empty token, otherwise the following calls would inherit the capsule-proxy one leading to a potential privilege escalation.

[CrimsonFez]

You have a good point.
However, I believe that later parts of the code check if the token string is empty and return an error stating that we cannot authenticate anonymous users.

[prometherion]

@CrimsonFez you're right, touché!

Given the increased complexity it would be good if we could return an error and make it visible in the logs: we can achieve that with panic which is not ideal per se, or rather, by returning a second return such as the error.

[prometherion]

LGTM, happy to get this merged, just ensure the changes comply with the linters:

make golint

[prometherion]

Super happy getting this merged, thanks a lot! 🚀

[prometherion]

Ah, golangci-lint complains about minor style stuff: this should be the latest round, please @CrimsonFez, may I ask you to amend it?

You can test with golangci-lint by issuing make golint

[CrimsonFez]

Sure thing. I thought I got it all ;(

[CrimsonFez]

Thanks for cleaning that up! I don't always have a lot of time to do stuff. Very much appreciated!

[prometherion]

It's team work, thanks, mate!

…

On Thu, Nov 14, 2024, 20:19 CrimsonFez ***@***.***> wrote: Thanks for cleaning that up! I don't always have a lot of time to do stuff. Very much appreciated! — Reply to this email directly, view it on GitHub <#533 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACJ7S3QWGKNQ2EID52MI3Q32ATZSTAVCNFSM6AAAAABPCMEBZOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINZXGIZDKOJSHE> . You are receiving this because you modified the open/close state.Message ID: ***@***.***>