@@ -8,13 +8,22 @@

  * Controller of the openshiftConsole

  */

 angular.module('openshiftConsole')

-  .controller('OAuthController', function ($location, $q, RedirectLoginService, DataService, AuthService, Logger) {

+  .controller('OAuthController', function ($scope, $location, $q, RedirectLoginService, DataService, AuthService, Logger) {

     var authLogger = Logger.get("auth");

+    // Initialize to a no-op function.

+    // Needed to let the view confirm a login when the state is unverified. 

+    $scope.completeLogin = function(){};

+    $scope.cancelLogin = function() {

+      $location.replace();

+      $location.url("./");

+    };

+

     RedirectLoginService.finish()

     .then(function(data) {

       var token = data.token;

       var then = data.then;

+      var verified = data.verified;

       var ttl = data.ttl;

       // Try to fetch the user

@@ -25,21 +34,41 @@ angular.module('openshiftConsole')

       .then(function(user) {

         // Set the new user and token in the auth service

         authLogger.log("OAuthController, got user", user);

-        AuthService.setUser(user, token, ttl);

-        // Redirect to original destination (or default to '/')

-        var destination = then || './';

-        if (URI(destination).is('absolute')) {

-          authLogger.log("OAuthController, invalid absolute redirect", destination);

-          destination = './';

+        $scope.completeLogin = function() {

+          // Persist the user

+          AuthService.setUser(user, token, ttl);

+          

+          // Redirect to original destination (or default to './')

+          var destination = then || './';

+          if (URI(destination).is('absolute')) {

+            authLogger.log("OAuthController, invalid absolute redirect", destination);

+            destination = './';

+          }

+          authLogger.log("OAuthController, redirecting", destination);

+          $location.replace();

+          $location.url(destination);

+        };

+        

+        if (verified) {

+          // Automatically complete

+          $scope.completeLogin();

+        } else {

+          // Require the UI to prompt

+          $scope.confirmUser = user;

+          

+          // Additionally, give the UI info about the user being overridden

+          var currentUser = AuthService.UserStore().getUser();

+          if (currentUser && currentUser.metadata.name !== user.metadata.name) {

+            $scope.overriddenUser = currentUser;

+          }

         }

-        authLogger.log("OAuthController, redirecting", destination);

-        $location.url(destination);

       })

       .catch(function(rejection) {

         // Handle an API error response fetching the user

         var redirect = URI('error').query({error: 'user_fetch_failed'}).toString();

         authLogger.error("OAuthController, error fetching user", rejection, "redirecting", redirect);

+        $location.replace();

         $location.url(redirect);

       });

@@ -51,6 +80,7 @@ angular.module('openshiftConsole')

         error_uri: rejection.error_uri || ""

       }).toString();

       authLogger.error("OAuthController, error", rejection, "redirecting", redirect);

+      $location.replace();

       $location.url(redirect);

     });

@@ -29,6 +29,70 @@ angular.module('openshiftConsole')

   this.$get = function($location, $q, Logger) {

     var authLogger = Logger.get("auth");

+    var getRandomInts = function(length) {

+      var randomValues;

+

+      if (window.crypto && window.Uint32Array) {

+        try {

+          var r = new Uint32Array(length);

+          window.crypto.getRandomValues(r);

+          randomValues = [];

+          for (var j=0; j < length; j++) {

+            randomValues.push(r[j]);

+          }

+        } catch(e) {

+          authLogger.debug("RedirectLoginService.getRandomInts: ", e);

+          randomValues = null;

+        }

+      }

+      

+      if (!randomValues) {

+        randomValues = [];

+        for (var i=0; i < length; i++) {

+          randomValues.push(Math.floor(Math.random() * 4294967296));

+        }

+      }

+      

+      return randomValues;

+    };

+    

+    var nonceKey = "RedirectLoginService.nonce";

+    var makeState = function(then) {

+      var nonce = String(new Date().getTime()) + "-" + getRandomInts(8).join("");

+      try {

+        window.localStorage[nonceKey] = nonce;

+      } catch(e) {

+        authLogger.log("RedirectLoginService.makeState, localStorage error: ", e);

+      }

+      return JSON.stringify({then: then, nonce:nonce});

+    };

+    var parseState = function(state) {

+      var retval = {

+        then: null,

+        verified: false

+      };

+

+      var nonce = "";

+      try {

+        nonce = window.localStorage[nonceKey];

+        window.localStorage.removeItem(nonceKey);

+      } catch(e) {

+        authLogger.log("RedirectLoginService.parseState, localStorage error: ", e);

+      }

+      

+      try {

+        var data = state ? JSON.parse(state) : {};

+        if (data && data.nonce && nonce && data.nonce === nonce) {

+          retval.verified = true;

+          retval.then = data.then;

+        }

+      } catch(e) {

+        authLogger.error("RedirectLoginService.parseState, state error: ", e);

+      }

+      authLogger.error("RedirectLoginService.parseState", retval);

+      return retval;

+    };

+

     return {

       // Returns a promise that resolves with {user:{...}, token:'...', ttl:X}, or rejects with {error:'...'[,error_description:'...',error_uri:'...']}

       login: function() {

@@ -49,7 +113,7 @@ angular.module('openshiftConsole')

         uri.query({

           client_id: _oauth_client_id,

           response_type: 'token',

-          state: returnUri.toString(),

+          state: makeState(returnUri.toString()),

           redirect_uri: _oauth_redirect_uri

         });

         authLogger.log("RedirectLoginService.login(), redirecting", uri.toString());

@@ -59,7 +123,7 @@ angular.module('openshiftConsole')

       },

       // Parses oauth callback parameters from window.location

-      // Returns a promise that resolves with {token:'...',then:'...'}, or rejects with {error:'...'[,error_description:'...',error_uri:'...']}

+      // Returns a promise that resolves with {token:'...',then:'...',verified:true|false}, or rejects with {error:'...'[,error_description:'...',error_uri:'...']}

       // If no token and no error is present, resolves with {}

       // Example error codes: https://tools.ietf.org/html/rfc6749#section-5.2

       finish: function() {

@@ -71,12 +135,12 @@ angular.module('openshiftConsole')

         var fragmentParams = new URI("?" + u.fragment()).query(true);

         authLogger.log("RedirectLoginService.finish()", queryParams, fragmentParams);

-       // Error codes can come in query params or fragment params

-       // Handle an error response from the OAuth server

+        // Error codes can come in query params or fragment params

+        // Handle an error response from the OAuth server

         var error = queryParams.error || fragmentParams.error;

-       if (error) {

-         var error_description = queryParams.error_description || fragmentParams.error_description;

-         var error_uri = queryParams.error_uri || fragmentParams.error_uri;

+        if (error) {

+          var error_description = queryParams.error_description || fragmentParams.error_description;

+          var error_uri = queryParams.error_uri || fragmentParams.error_uri;

           authLogger.log("RedirectLoginService.finish(), error", error, error_description, error_uri);

           return $q.reject({

             error: error,

@@ -85,13 +149,16 @@ angular.module('openshiftConsole')

           });

         }

+        var stateData = parseState(fragmentParams.state);

+        

         // Handle an access_token response

         if (fragmentParams.access_token && (fragmentParams.token_type || "").toLowerCase() === "bearer") {

           var deferred = $q.defer();

           deferred.resolve({

             token: fragmentParams.access_token,

             ttl: fragmentParams.expires_in,

-            then: fragmentParams.state

+            then: stateData.state,

+            verified: stateData.verified

           });

           return deferred.promise;

         }

@@ -2,12 +2,26 @@

 <div class="wrap no-sidebar">

   <div class="middle surface-shaded">

     <div class="container surface-shaded">

-      <div>

+      <div ng-if="!confirmUser">

         <h1 style="margin-top: 10px;">Logging in&hellip;</h1>

-        <div>

-          Please wait while you are logged in...

-        </div>

+        <p>Please wait while you are logged in&hellip;</p>

       </div>

+      

+      <div ng-if="confirmUser && !overriddenUser">

+        <h1 style="margin-top: 10px;">Confirm Login</h1>

+        <p>You are being logged in as <code>{{confirmUser.metadata.name}}</code>.</p>

+        <button class="btn btn-lg btn-primary" type="button" ng-click="completeLogin();">Continue</button>

+        <button class="btn btn-lg btn-default" type="button" ng-click="cancelLogin();">Cancel</button>

+      </div>

+      

+      <div ng-if="confirmUser && overriddenUser">

+        <h1 style="margin-top: 10px;">Confirm User Change</h1>

+        <p>You are about to change users from <code>{{overriddenUser.metadata.name}}</code> to <code>{{confirmUser.metadata.name}}</code>.</p>

+        <p>If this is unexpected, click Cancel. This could be an attempt to trick you into acting as another user.</p>

+        <button class="btn btn-lg btn-danger" type="button" ng-click="completeLogin();">Switch Users</button>

+        <button class="btn btn-lg btn-primary" type="button" ng-click="cancelLogin();">Cancel</button>

+      </div>

+      

     </div>

   </div>

 </div>

@@ -2582,7 +2582,49 @@ return a && (b = a), b;

 }, this.OAuthRedirectURI = function(a) {

 return a && (c = a), c;

 }, this.$get = [ "$location", "$q", "Logger", function(d, e, f) {

-var g = f.get("auth");

+var g = f.get("auth"), h = function(a) {

+var b;

+if (window.crypto && window.Uint32Array) try {

+var c = new Uint32Array(a);

+window.crypto.getRandomValues(c), b = [];

+for (var d = 0; a > d; d++) b.push(c[d]);

+} catch (e) {

+g.debug("RedirectLoginService.getRandomInts: ", e), b = null;

+}

+if (!b) {

+b = [];

+for (var f = 0; a > f; f++) b.push(Math.floor(4294967296 * Math.random()));

+}

+return b;

+}, i = "RedirectLoginService.nonce", j = function(a) {

+var b = String(new Date().getTime()) + "-" + h(8).join("");

+try {

+window.localStorage[i] = b;

+} catch (c) {

+g.log("RedirectLoginService.makeState, localStorage error: ", c);

+}

+return JSON.stringify({

+then:a,

+nonce:b

+});

+}, k = function(a) {

+var b = {

+then:null,

+verified:!1

+}, c = "";

+try {

+c = window.localStorage[i], window.localStorage.removeItem(i);

+} catch (d) {

+g.log("RedirectLoginService.parseState, localStorage error: ", d);

+}

+try {

+var e = a ? JSON.parse(a) :{};

+e && e.nonce && c && e.nonce === c && (b.verified = !0, b.then = e.then);

+} catch (d) {

+g.error("RedirectLoginService.parseState, state error: ", d);

+}

+return g.error("RedirectLoginService.parseState", b), b;

+};

 return {

 login:function() {

 if ("" === a) return e.reject({

@@ -2601,7 +2643,7 @@ var f = e.defer(), h = new URI(b), i = new URI(d.url()).fragment("");

 return h.query({

 client_id:a,

 response_type:"token",

-state:i.toString(),

+state:j(i.toString()),

 redirect_uri:c

 }), g.log("RedirectLoginService.login(), redirecting", h.toString()), window.location.href = h.toString(), f.promise;

 },

@@ -2617,13 +2659,15 @@ error_description:h,

 error_uri:i

 });

 }

+var j = k(c.state);

 if (c.access_token && "bearer" === (c.token_type || "").toLowerCase()) {

-var j = e.defer();

-return j.resolve({

+var l = e.defer();

+return l.resolve({

 token:c.access_token,

 ttl:c.expires_in,

-then:c.state

-}), j.promise;

+then:j.state,

+verified:j.verified

+}), l.promise;

 }

 return e.reject({

 error:"invalid_request",

@@ -4924,35 +4968,43 @@ hideFilterWidget:!0

 }, c.get(a.project).then(_.spread(function(a, c) {

 b.project = a, b.projectContext = c;

 }));

-} ]), angular.module("openshiftConsole").controller("OAuthController", [ "$location", "$q", "RedirectLoginService", "DataService", "AuthService", "Logger", function(a, b, c, d, e, f) {

-var g = f.get("auth");

-c.finish().then(function(b) {

-var c = b.token, f = b.then, h = b.ttl, i = {

+} ]), angular.module("openshiftConsole").controller("OAuthController", [ "$scope", "$location", "$q", "RedirectLoginService", "DataService", "AuthService", "Logger", function(a, b, c, d, e, f, g) {

+var h = g.get("auth");

+a.completeLogin = function() {}, a.cancelLogin = function() {

+b.replace(), b.url("./");

+}, d.finish().then(function(c) {

+var d = c.token, g = c.then, i = c.verified, j = c.ttl, k = {

 errorNotification:!1,

 http:{

 auth:{

-token:c,

+token:d,

 triggerLogin:!1

 }

 }

 };

-g.log("OAuthController, got token, fetching user", i), d.get("users", "~", {}, i).then(function(b) {

-g.log("OAuthController, got user", b), e.setUser(b, c, h);

-var d = f || "./";

-URI(d).is("absolute") && (g.log("OAuthController, invalid absolute redirect", d), d = "./"), g.log("OAuthController, redirecting", d), a.url(d);

-})["catch"](function(b) {

+h.log("OAuthController, got token, fetching user", k), e.get("users", "~", {}, k).then(function(c) {

+if (h.log("OAuthController, got user", c), a.completeLogin = function() {

+f.setUser(c, d, j);

+var a = g || "./";

+URI(a).is("absolute") && (h.log("OAuthController, invalid absolute redirect", a), a = "./"), h.log("OAuthController, redirecting", a), b.replace(), b.url(a);

+}, i) a.completeLogin(); else {

+a.confirmUser = c;

+var e = f.UserStore().getUser();

+e && e.metadata.name !== c.metadata.name && (a.overriddenUser = e);

+}

+})["catch"](function(a) {

 var c = URI("error").query({

 error:"user_fetch_failed"

 }).toString();

-g.error("OAuthController, error fetching user", b, "redirecting", c), a.url(c);

+h.error("OAuthController, error fetching user", a, "redirecting", c), b.replace(), b.url(c);

 });

-})["catch"](function(b) {

+})["catch"](function(a) {

 var c = URI("error").query({

-error:b.error || "",

-error_description:b.error_description || "",

-error_uri:b.error_uri || ""

+error:a.error || "",

+error_description:a.error_description || "",

+error_uri:a.error_uri || ""

 }).toString();

-g.error("OAuthController, error", b, "redirecting", c), a.url(c);

+h.error("OAuthController, error", a, "redirecting", c), b.replace(), b.url(c);

 });

 } ]), angular.module("openshiftConsole").controller("ErrorController", [ "$scope", function(a) {

 var b = URI(window.location.href).query(!0), c = b.error;

@@ -14184,11 +14236,22 @@ var _scriptsTemplatesJs = []byte(`angular.module('openshiftConsoleTemplates', []

     "<div class=\"wrap no-sidebar\">\n" +

     "<div class=\"middle surface-shaded\">\n" +

     "<div class=\"container surface-shaded\">\n" +

-    "<div>\n" +

+    "<div ng-if=\"!confirmUser\">\n" +

     "<h1 style=\"margin-top: 10px\">Logging in&hellip;</h1>\n" +

-    "<div>\n" +

-    "Please wait while you are logged in...\n" +

-    "</div>\n" +

+    "<p>Please wait while you are logged in&hellip;</p>\n" +

+    "</div>\n" +

+    "<div ng-if=\"confirmUser && !overriddenUser\">\n" +

+    "<h1 style=\"margin-top: 10px\">Confirm Login</h1>\n" +

+    "<p>You are being logged in as <code>{{confirmUser.metadata.name}}</code>.</p>\n" +

+    "<button class=\"btn btn-lg btn-primary\" type=\"button\" ng-click=\"completeLogin();\">Continue</button>\n" +

+    "<button class=\"btn btn-lg btn-default\" type=\"button\" ng-click=\"cancelLogin();\">Cancel</button>\n" +

+    "</div>\n" +

+    "<div ng-if=\"confirmUser && overriddenUser\">\n" +

+    "<h1 style=\"margin-top: 10px\">Confirm User Change</h1>\n" +

+    "<p>You are about to change users from <code>{{overriddenUser.metadata.name}}</code> to <code>{{confirmUser.metadata.name}}</code>.</p>\n" +

+    "<p>If this is unexpected, click Cancel. This could be an attempt to trick you into acting as another user.</p>\n" +

+    "<button class=\"btn btn-lg btn-danger\" type=\"button\" ng-click=\"completeLogin();\">Switch Users</button>\n" +

+    "<button class=\"btn btn-lg btn-primary\" type=\"button\" ng-click=\"cancelLogin();\">Cancel</button>\n" +

     "</div>\n" +

     "</div>\n" +

     "</div>\n" +

@@ -2,6 +2,7 @@ package paramtoken

 import (

 	"net/http"

+	"regexp"

 	"strings"

 	"github.com/openshift/origin/pkg/auth/authenticator"

@@ -26,6 +27,11 @@ func New(param string, auth authenticator.Token, removeParam bool) *Authenticato

 }

 func (a *Authenticator) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

+	// Only accept query param auth for websocket connections

+	if !isWebSocketRequest(req) {

+		return nil, false, nil

+	}

+

 	q := req.URL.Query()

 	token := strings.TrimSpace(q.Get(a.param))

 	if token == "" {

@@ -38,3 +44,13 @@ func (a *Authenticator) AuthenticateRequest(req *http.Request) (user.Info, bool,

 	}

 	return user, ok, err

 }

+

+var (

+	// connectionUpgradeRegex matches any Connection header value that includes upgrade

+	connectionUpgradeRegex = regexp.MustCompile("(^|.*,\\s*)upgrade($|\\s*,)")

+)

+

+// isWebSocketRequest returns true if the incoming request contains connection upgrade headers for WebSockets.

+func isWebSocketRequest(req *http.Request) bool {

+	return connectionUpgradeRegex.MatchString(strings.ToLower(req.Header.Get("Connection"))) && strings.ToLower(req.Header.Get("Upgrade")) == "websocket"

+}

@@ -5,15 +5,14 @@ import (

 	"strings"

 	kapi "k8s.io/kubernetes/pkg/api"

-	kapiserver "k8s.io/kubernetes/pkg/apiserver"

 )

 type openshiftAuthorizationAttributeBuilder struct {

 	contextMapper kapi.RequestContextMapper

-	infoResolver  *kapiserver.RequestInfoResolver

+	infoResolver  RequestInfoResolver

 }

-func NewAuthorizationAttributeBuilder(contextMapper kapi.RequestContextMapper, infoResolver *kapiserver.RequestInfoResolver) AuthorizationAttributeBuilder {

+func NewAuthorizationAttributeBuilder(contextMapper kapi.RequestContextMapper, infoResolver RequestInfoResolver) AuthorizationAttributeBuilder {

 	return &openshiftAuthorizationAttributeBuilder{contextMapper, infoResolver}

 }

new file mode 100644

@@ -0,0 +1,75 @@

+package authorizer

+

+import (

+	"net/http"

+

+	kapi "k8s.io/kubernetes/pkg/api"

+	kapiserver "k8s.io/kubernetes/pkg/apiserver"

+	"k8s.io/kubernetes/pkg/util/sets"

+)

+

+type browserSafeRequestInfoResolver struct {

+	// infoResolver is used to determine info for the request

+	infoResolver RequestInfoResolver

+

+	// contextMapper is used to look up the context corresponding to a request

+	// to obtain the user associated with the request

+	contextMapper kapi.RequestContextMapper

+

+	// list of groups, any of which indicate the request is authenticated

+	authenticatedGroups sets.String

+}

+

+func NewBrowserSafeRequestInfoResolver(contextMapper kapi.RequestContextMapper, authenticatedGroups sets.String, infoResolver RequestInfoResolver) RequestInfoResolver {

+	return &browserSafeRequestInfoResolver{

+		contextMapper:       contextMapper,

+		authenticatedGroups: authenticatedGroups,

+		infoResolver:        infoResolver,

+	}

+}

+

+func (a *browserSafeRequestInfoResolver) GetRequestInfo(req *http.Request) (kapiserver.RequestInfo, error) {

+	requestInfo, err := a.infoResolver.GetRequestInfo(req)

+	if err != nil {

+		return requestInfo, err

+	}

+

+	if !requestInfo.IsResourceRequest {

+		return requestInfo, nil

+	}

+

+	isProxyVerb := requestInfo.Verb == "proxy"

+	isProxySubresource := requestInfo.Subresource == "proxy"

+

+	if !isProxyVerb && !isProxySubresource {

+		// Requests to non-proxy resources don't expose HTML or HTTP-handling user content to browsers

+		return requestInfo, nil

+	}

+

+	if len(req.Header.Get("X-CSRF-Token")) > 0 {

+		// Browsers cannot set custom headers on direct requests

+		return requestInfo, nil

+	}

+

+	if ctx, hasContext := a.contextMapper.Get(req); hasContext {

+		user, hasUser := kapi.UserFrom(ctx)

+		if hasUser && a.authenticatedGroups.HasAny(user.GetGroups()...) {

+			// An authenticated request indicates this isn't a browser page load.

+			// Browsers cannot make direct authenticated requests.

+			// This depends on the API not enabling basic or cookie-based auth.

+			return requestInfo, nil

+		}

+

+	}

+

+	// TODO: compare request.Host to a list of hosts allowed for the requestInfo.Namespace (e.g. <namespace>.proxy.example.com)

+

+	if isProxyVerb {

+		requestInfo.Verb = "unsafeproxy"

+	}

+	if isProxySubresource {

+		requestInfo.Subresource = "unsafeproxy"

+	}

+

+	return requestInfo, nil

+}

new file mode 100644

@@ -0,0 +1,147 @@

+package authorizer

+

+import (

+	"net/http"

+	"testing"

+

+	kapi "k8s.io/kubernetes/pkg/api"

+	kapiserver "k8s.io/kubernetes/pkg/apiserver"

+	"k8s.io/kubernetes/pkg/auth/user"

+	"k8s.io/kubernetes/pkg/util/sets"

+)

+

+func TestUpstreamInfoResolver(t *testing.T) {

+	subresourceRequest, _ := http.NewRequest("GET", "/api/v1/namespaces/myns/pods/mypod/proxy", nil)

+	proxyRequest, _ := http.NewRequest("GET", "/api/v1/proxy/nodes/mynode", nil)

+

+	testcases := map[string]struct {

+		Request             *http.Request

+		ExpectedVerb        string

+		ExpectedSubresource string

+	}{

+		"unsafe proxy subresource": {

+			Request:             subresourceRequest,

+			ExpectedVerb:        "get",

+			ExpectedSubresource: "proxy", // should be "unsafeproxy" or similar once check moves upstream

+		},

+		"unsafe proxy verb": {

+			Request:      proxyRequest,

+			ExpectedVerb: "proxy", // should be "unsafeproxy" or similar once check moves upstream

+		},

+	}

+

+	for k, tc := range testcases {

+		resolver := &kapiserver.RequestInfoResolver{

+			APIPrefixes:          sets.NewString("api", "osapi", "oapi", "apis"),

+			GrouplessAPIPrefixes: sets.NewString("api", "osapi", "oapi"),

+		}

+

+		info, err := resolver.GetRequestInfo(tc.Request)

+		if err != nil {

+			t.Errorf("%s: unexpected error: %v", k, err)

+			continue

+		}

+

+		if info.Verb != tc.ExpectedVerb {

+			t.Errorf("%s: expected verb %s, got %s. If kapiserver.RequestInfoResolver now adjusts attributes for proxy safety, investigate removing the NewBrowserSafeRequestInfoResolver wrapper.", k, tc.ExpectedVerb, info.Verb)

+		}

+		if info.Subresource != tc.ExpectedSubresource {

+			t.Errorf("%s: expected verb %s, got %s. If kapiserver.RequestInfoResolver now adjusts attributes for proxy safety, investigate removing the NewBrowserSafeRequestInfoResolver wrapper.", k, tc.ExpectedSubresource, info.Subresource)

+		}

+	}

+}

+

+func TestBrowserSafeRequestInfoResolver(t *testing.T) {

+	testcases := map[string]struct {

+		RequestInfo kapiserver.RequestInfo

+		Context     kapi.Context

+		Host        string

+		Headers     http.Header

+

+		ExpectedVerb        string

+		ExpectedSubresource string

+	}{

+		"non-resource": {

+			RequestInfo:  kapiserver.RequestInfo{IsResourceRequest: false, Verb: "GET"},

+			ExpectedVerb: "GET",

+		},

+

+		"non-proxy": {

+			RequestInfo:         kapiserver.RequestInfo{IsResourceRequest: true, Verb: "get", Resource: "pods", Subresource: "logs"},

+			ExpectedVerb:        "get",

+			ExpectedSubresource: "logs",

+		},

+

+		"unsafe proxy subresource": {

+			RequestInfo:         kapiserver.RequestInfo{IsResourceRequest: true, Verb: "get", Resource: "pods", Subresource: "proxy"},

+			ExpectedVerb:        "get",

+			ExpectedSubresource: "unsafeproxy",

+		},

+		"unsafe proxy verb": {

+			RequestInfo:  kapiserver.RequestInfo{IsResourceRequest: true, Verb: "proxy", Resource: "nodes"},

+			ExpectedVerb: "unsafeproxy",

+		},

+		"unsafe proxy verb anonymous": {

+			Context:      kapi.WithUser(kapi.NewContext(), &user.DefaultInfo{Name: "system:anonymous", Groups: []string{"system:unauthenticated"}}),

+			RequestInfo:  kapiserver.RequestInfo{IsResourceRequest: true, Verb: "proxy", Resource: "nodes"},

+			ExpectedVerb: "unsafeproxy",

+		},

+

+		"proxy subresource authenticated": {

+			Context:             kapi.WithUser(kapi.NewContext(), &user.DefaultInfo{Name: "bob", Groups: []string{"system:authenticated"}}),

+			RequestInfo:         kapiserver.RequestInfo{IsResourceRequest: true, Verb: "get", Resource: "pods", Subresource: "proxy"},

+			ExpectedVerb:        "get",

+			ExpectedSubresource: "proxy",

+		},

+		"proxy subresource custom header": {

+			RequestInfo:         kapiserver.RequestInfo{IsResourceRequest: true, Verb: "get", Resource: "pods", Subresource: "proxy"},

+			Headers:             http.Header{"X-Csrf-Token": []string{"1"}},

+			ExpectedVerb:        "get",

+			ExpectedSubresource: "proxy",

+		},

+	}

+

+	for k, tc := range testcases {

+		resolver := NewBrowserSafeRequestInfoResolver(

+			&testContextMapper{tc.Context},

+			sets.NewString("system:authenticated"),

+			&testInfoResolver{tc.RequestInfo},

+		)

+

+		req, _ := http.NewRequest("GET", "/", nil)

+		req.Host = tc.Host

+		req.Header = tc.Headers

+

+		info, err := resolver.GetRequestInfo(req)

+		if err != nil {

+			t.Errorf("%s: unexpected error: %v", k, err)

+			continue

+		}

+

+		if info.Verb != tc.ExpectedVerb {

+			t.Errorf("%s: expected verb %s, got %s", k, tc.ExpectedVerb, info.Verb)

+		}

+		if info.Subresource != tc.ExpectedSubresource {

+			t.Errorf("%s: expected verb %s, got %s", k, tc.ExpectedSubresource, info.Subresource)

+		}

+	}

+}

+

+type testContextMapper struct {

+	context kapi.Context

+}

+

+func (t *testContextMapper) Get(req *http.Request) (kapi.Context, bool) {

+	return t.context, t.context != nil

+}

+func (t *testContextMapper) Update(req *http.Request, ctx kapi.Context) error {

+	return nil

+}

+

+type testInfoResolver struct {

+	info kapiserver.RequestInfo

+}

+

+func (t *testInfoResolver) GetRequestInfo(req *http.Request) (kapiserver.RequestInfo, error) {

+	return t.info, nil

+}

@@ -4,6 +4,7 @@ import (

 	"net/http"

 	kapi "k8s.io/kubernetes/pkg/api"

+	kapiserver "k8s.io/kubernetes/pkg/apiserver"

 	"k8s.io/kubernetes/pkg/auth/user"

 	"k8s.io/kubernetes/pkg/util/sets"

 )

@@ -17,6 +18,10 @@ type AuthorizationAttributeBuilder interface {

 	GetAttributes(request *http.Request) (AuthorizationAttributes, error)

 }

+type RequestInfoResolver interface {

+	GetRequestInfo(req *http.Request) (kapiserver.RequestInfo, error)

+}

+

 type AuthorizationAttributes interface {

 	GetVerb() string

 	GetAPIVersion() string

@@ -375,7 +375,16 @@ func newAuthorizer(policyClient policyclient.ReadOnlyPolicyClient, projectReques

 }

 func newAuthorizationAttributeBuilder(requestContextMapper kapi.RequestContextMapper) authorizer.AuthorizationAttributeBuilder {

-	authorizationAttributeBuilder := authorizer.NewAuthorizationAttributeBuilder(requestContextMapper, &apiserver.RequestInfoResolver{APIPrefixes: sets.NewString("api", "osapi", "oapi", "apis"), GrouplessAPIPrefixes: sets.NewString("api", "osapi", "oapi")})

+	// Default API request resolver

+	requestInfoResolver := &apiserver.RequestInfoResolver{APIPrefixes: sets.NewString("api", "osapi", "oapi", "apis"), GrouplessAPIPrefixes: sets.NewString("api", "osapi", "oapi")}

+	// Wrap with a resolver that detects unsafe requests and modifies verbs/resources appropriately so policy can address them separately

+	browserSafeRequestInfoResolver := authorizer.NewBrowserSafeRequestInfoResolver(

+		requestContextMapper,

+		sets.NewString(bootstrappolicy.AuthenticatedGroup),

+		requestInfoResolver,

+	)

+

+	authorizationAttributeBuilder := authorizer.NewAuthorizationAttributeBuilder(requestContextMapper, browserSafeRequestInfoResolver)

 	return authorizationAttributeBuilder

 }