Fix authentication bypass via User-Agent-based Health Check on proxy prefix paths

[hacktron-app-dev]

Description

This PR addresses a severe authentication bypass vulnerability (WEB-1062) in oauth2-proxy.

Root Cause

Under Nginx auth_request configuration, Nginx forwards subrequests to /oauth2/auth to verify if a client is authenticated. However, when health-check user agents (such as GoogleHC/1.0 or custom ping user agents) are enabled, the health check middleware intercepts any request with matching User-Agent headers, returning 200 OK ("OK") without calling the authentication handlers. If a malicious client crafts a request with a health check User-Agent, Nginx receives a 200 OK on /oauth2/auth and forwards the request to the protected upstream, bypassing authentication completely.

Solution

We modified the health check middleware to ensure that requests hitting the proxy prefix (e.g., /oauth2/...) are excluded from User-Agent-based health check matches. If a request is explicitly mapped to a health-check path (like /ping), it continues to function as before. However, any request pointing to paths starting with the configured ProxyPrefix will no longer be intercepted by a matching User-Agent.

Verification

• Reviewed all affected callers and ensured backwards compatibility.
• Added comprehensive unit and regression tests in pkg/middleware/healthcheck_test.go verifying:
  • Requests to /oauth2/auth with a health check User-Agent correctly fall through.
  • Escaped requests to /oauth2%2fauth with a health check User-Agent correctly fall through.
  • Custom proxy prefixes are correctly supported and protected against bypass.

---

Automated fix by Hacktron for finding: http://dev.app.hacktron.ai/testset/findings/0d7a0967-b73c-4628-9233-426599269658