18F / hmacauth / 8

88%

Pull #4

travis-ci

Ensure the request body buffer is not exhausted

Was notified of the issue when @dlapiduz pinged me about POST requests
to https://tock.18f.gov/ resulting in 500s. Digging in the oauth2_proxy logs,
I noticed messages like this appearing before every 500:

```
2015/10/09 16:08:15 reverseproxy.go:184: http: proxy error: http: ContentLength=128 with Body length 0
```

Searching for that error string turned up:

https://stackoverflow.com/questions/23070876/reading-body-of-http-request-without-modifying-request-state

The issue was that reading from `http.Request.Body` to generate the request
signature was exhausting the `io.ReadCloser`. The solution was to read the
entire body into a new buffer, wrap that buffer in an `ioutil.NopCloser` and
assign it back to `http.Request.Body`, and then use that same buffer to
compute the signature.

The new assert statement in `TestRequestSignaturePost` reproduced the original
bug and verified the fix.

3 of 3 new or added lines in 1 file covered. (100.0%)

99 of 113 relevant lines covered (87.61%)

12.75 hits per line