Repository: oauth2-proxy/oauth2-proxy (go)

Issue:
isAjax doesn't work with multiple accepted mime types
<!--- Provide a general summary of the issue in the Title above -->

## Expected Behavior

`isAjax` in `oauthproxy.go` should be iterating through different mime types for the `Accept: ` field and return `true` if `application/json` is found. 

## Current Behavior

`isAjax` iterates over a single string. If this string matches `application/json` exactly, `isAjax` works as intended. With multiple mime types, as allowed by standards and [default for Axios](https://github.com/axios/axios/blob/b7e954eba3911874575ed241ec2ec38ff8af21bb/lib/defaults.js#L86), `isAjax` fails to find the correct mime type. The following test fails, proving the point.

```
func TestAjaxUnauthorizedRequestAccept1(t *testing.T) {
	header := make(http.Header)
	header.Add("Accept", "application/json, text/plain, */*")

	testAjaxUnauthorizedRequest(t, header)
}
```

## Possible Solution

Fix the loop to actually iterate over multiple mime types.

Pull request:
Adapt isAjax to support mimetype lists
<!--- Provide a general summary of your changes in the Title above -->

## Description

Fixes #988

## How Has This Been Tested?

Included a unit test

## Checklist:

<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->

- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [ ] I have created a feature (non-master) branch for my PR.


Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2272fb47..fc41907b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -100,6 +100,7 @@
 - [#750](https://github.com/oauth2-proxy/oauth2-proxy/pull/750) ci: Migrate to Github Actions (@shinebayar-g)
 - [#829](https://github.com/oauth2-proxy/oauth2-proxy/pull/820) Rename test directory to testdata (@johejo)
 - [#819](https://github.com/oauth2-proxy/oauth2-proxy/pull/819) Improve CI (@johejo)
+- [#989](https://github.com/oauth2-proxy/oauth2-proxy/pull/989) Adapt isAjax to support mimetype lists (@rassie)
 
 # v6.1.1
 
diff --git a/oauthproxy.go b/oauthproxy.go
index 74ed6dc0..cfba6934 100644
--- a/oauthproxy.go
+++ b/oauthproxy.go
@@ -1111,9 +1111,17 @@ func (p *OAuthProxy) addHeadersForProxying(rw http.ResponseWriter, req *http.Req
 func isAjax(req *http.Request) bool {
 	acceptValues := req.Header.Values("Accept")
 	const ajaxReq = applicationJSON
-	for _, v := range acceptValues {
-		if v == ajaxReq {
-			return true
+	// Iterate over multiple Accept headers, i.e.
+	// Accept: application/json
+	// Accept: text/plain
+	for _, mimeTypes := range acceptValues {
+		// Iterate over multiple mimetypes in a single header, i.e.
+		// Accept: application/json, text/plain, */*
+		for _, mimeType := range strings.Split(mimeTypes, ",") {
+			mimeType = strings.TrimSpace(mimeType)
+			if mimeType == ajaxReq {
+				return true
+			}
 		}
 	}
 	return false


Test patch:
diff --git a/oauthproxy_test.go b/oauthproxy_test.go
index 572e1ec9..52ffa2b3 100644
--- a/oauthproxy_test.go
+++ b/oauthproxy_test.go
@@ -1970,6 +1970,13 @@ func TestAjaxUnauthorizedRequest2(t *testing.T) {
 	testAjaxUnauthorizedRequest(t, header)
 }
 
+func TestAjaxUnauthorizedRequestAccept1(t *testing.T) {
+	header := make(http.Header)
+	header.Add("Accept", "application/json, text/plain, */*")
+
+	testAjaxUnauthorizedRequest(t, header)
+}
+
 func TestAjaxForbiddendRequest(t *testing.T) {
 	test, err := newAjaxRequestTest()
 	if err != nil {