-
Notifications
You must be signed in to change notification settings - Fork 969
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: respect return_to in OIDC API flow error case (#3893)
* fix: respect return_to in OIDC API flow error case This fix ensures that we redirect the user to the return_to URL when an error occurs during the OIDC login for native flows. Native flows are initialized through the API, and the browser URL is retrieved from a 422 response after a POST to submit the login flow. Successful OIDC flows already returned the `code` to the `return_to` URL. Now, unsuccessful flows return the `flow` with the current flow ID (which might have changed), so that the caller can retrieve the full flow and act accordingly. * fix: ignore trivvy CVE report Bump in distroless is still open
- Loading branch information
Showing
5 changed files
with
70 additions
and
21 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,3 @@ | ||
| CVE-2022-30065 | ||
| CVE-2024-2961 | ||
| CVE-2023-2650 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -184,7 +184,7 @@ func TestStrategy(t *testing.T) { | |
| return res, body | ||
| } | ||
|
|
||
| makeAPICodeFlowRequest := func(t *testing.T, provider, action string) (returnToCode string) { | ||
| makeAPICodeFlowRequest := func(t *testing.T, provider, action string) (returnToURL *url.URL) { | ||
| res, err := testhelpers.NewDebugClient(t).Post(action, "application/json", strings.NewReader(fmt.Sprintf(`{ | ||
| "method": "oidc", | ||
| "provider": %q | ||
|
|
@@ -197,13 +197,10 @@ func TestStrategy(t *testing.T) { | |
| res, err = testhelpers.NewClientWithCookieJar(t, nil, true).Get(changeLocation.RedirectBrowserTo) | ||
| require.NoError(t, err) | ||
|
|
||
| returnToURL := res.Request.URL | ||
| returnToURL = res.Request.URL | ||
| assert.True(t, strings.HasPrefix(returnToURL.String(), returnTS.URL+"/app_code")) | ||
|
|
||
| code := returnToURL.Query().Get("code") | ||
| assert.NotEmpty(t, code, "code query param was empty in the return_to URL") | ||
|
|
||
| return code | ||
| return returnToURL | ||
| } | ||
|
|
||
| exchangeCodeForToken := func(t *testing.T, codes sessiontokenexchange.Codes) (codeResponse session.CodeExchangeResponse, err error) { | ||
|
|
@@ -553,12 +550,15 @@ func TestStrategy(t *testing.T) { | |
| t.Run("suite=API with session token exchange code", func(t *testing.T) { | ||
| scope = []string{"openid"} | ||
|
|
||
| loginOrRegister := func(t *testing.T, id uuid.UUID, code string) { | ||
| loginOrRegister := func(t *testing.T, flowID uuid.UUID, code string) { | ||
| _, err := exchangeCodeForToken(t, sessiontokenexchange.Codes{InitCode: code}) | ||
| require.Error(t, err) | ||
|
|
||
| action := assertFormValues(t, id, "valid") | ||
| returnToCode := makeAPICodeFlowRequest(t, "valid", action) | ||
| action := assertFormValues(t, flowID, "valid") | ||
| returnToURL := makeAPICodeFlowRequest(t, "valid", action) | ||
| returnToCode := returnToURL.Query().Get("code") | ||
| assert.NotEmpty(t, code, "code query param was empty in the return_to URL") | ||
|
|
||
| codeResponse, err := exchangeCodeForToken(t, sessiontokenexchange.Codes{ | ||
| InitCode: code, | ||
| ReturnToCode: returnToCode, | ||
|
|
@@ -568,11 +568,11 @@ func TestStrategy(t *testing.T) { | |
| assert.NotEmpty(t, codeResponse.Token) | ||
| assert.Equal(t, subject, gjson.GetBytes(codeResponse.Session.Identity.Traits, "subject").String()) | ||
| } | ||
| register := func(t *testing.T) { | ||
| performRegistration := func(t *testing.T) { | ||
| f := newAPIRegistrationFlow(t, returnTS.URL+"?return_session_token_exchange_code=true&return_to=/app_code", 1*time.Minute) | ||
| loginOrRegister(t, f.ID, f.SessionTokenExchangeCode) | ||
| } | ||
| login := func(t *testing.T) { | ||
| performLogin := func(t *testing.T) { | ||
| f := newAPILoginFlow(t, returnTS.URL+"?return_session_token_exchange_code=true&return_to=/app_code", 1*time.Minute) | ||
| loginOrRegister(t, f.ID, f.SessionTokenExchangeCode) | ||
| } | ||
|
|
@@ -582,23 +582,48 @@ func TestStrategy(t *testing.T) { | |
| first, then func(*testing.T) | ||
| }{{ | ||
| name: "login-twice", | ||
| first: login, then: login, | ||
| first: performLogin, then: performLogin, | ||
| }, { | ||
| name: "login-then-register", | ||
| first: login, then: register, | ||
| first: performLogin, then: performRegistration, | ||
| }, { | ||
| name: "register-then-login", | ||
| first: register, then: login, | ||
| first: performRegistration, then: performLogin, | ||
| }, { | ||
| name: "register-twice", | ||
| first: register, then: register, | ||
| first: performRegistration, then: performRegistration, | ||
| }} { | ||
| t.Run("case="+tc.name, func(t *testing.T) { | ||
| subject = tc.name + "[email protected]" | ||
| tc.first(t) | ||
| tc.then(t) | ||
| }) | ||
| } | ||
| t.Run("case=should use redirect_to URL on failure", func(t *testing.T) { | ||
| ctx := context.Background() | ||
| subject = "[email protected]" | ||
|
|
||
| i := identity.NewIdentity(config.DefaultIdentityTraitsSchemaID) | ||
| i.SetCredentials(identity.CredentialsTypePassword, identity.Credentials{ | ||
| Identifiers: []string{subject}, | ||
| }) | ||
| i.Traits = identity.Traits(`{"subject":"` + subject + `"}`) | ||
| require.NoError(t, reg.PrivilegedIdentityPool().CreateIdentity(ctx, i)) | ||
|
|
||
| f := newAPILoginFlow(t, returnTS.URL+"?return_session_token_exchange_code=true&return_to=/app_code", 1*time.Minute) | ||
|
|
||
| _, err := exchangeCodeForToken(t, sessiontokenexchange.Codes{InitCode: f.SessionTokenExchangeCode}) | ||
| require.Error(t, err) | ||
|
|
||
| action := assertFormValues(t, f.ID, "valid") | ||
| returnToURL := makeAPICodeFlowRequest(t, "valid", action) | ||
| returnedFlow := returnToURL.Query().Get("flow") | ||
|
|
||
| require.NotEmpty(t, returnedFlow, "flow query param was empty in the return_to URL") | ||
| loginFlow, err := reg.LoginFlowPersister().GetLoginFlow(ctx, uuid.FromStringOrNil(returnedFlow)) | ||
| require.NoError(t, err) | ||
| assert.Equal(t, text.ErrorValidationDuplicateCredentials, loginFlow.UI.Messages[0].ID) | ||
| }) | ||
| }) | ||
|
|
||
| t.Run("case=submit id_token during registration or login", func(t *testing.T) { | ||
|
|
||