tree 36884ae33dda52dad5da04881a13f4ed50115057
parent 6fef43842336d30e556c35798a30a2a5cf5d28ec
author Jonathan Amsterdam <jba@google.com> 1600869131 -0400
committer Jonathan Amsterdam <jba@google.com> 1600890384 +0000

internal/worker,middleware: validate IAP header

Validate the header that comes from the IAP. This ensures that
no one is accessing the server in a way that bypasses the IAP.

The worker will perform this validation, but only if
an env var is set, so it won't affect local testing and
we can turn it on or off easily.

Change-Id: I5932548d8a4ef0502f0c936b394f711ac310bcd3
Reviewed-on: https://go-review.googlesource.com/c/pkgsite/+/256759
Trust: Jonathan Amsterdam <jba@google.com>
Run-TryBot: Jonathan Amsterdam <jba@google.com>
TryBot-Result: kokoro <noreply+kokoro@google.com>
Reviewed-by: Julie Qiu <julie@golang.org>