Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: redirect invalid state errors to site url #1722

Merged
merged 6 commits into from
Aug 16, 2024
Merged

fix: redirect invalid state errors to site url #1722

merged 6 commits into from
Aug 16, 2024

Conversation

kangmingtay
Copy link
Member

@kangmingtay kangmingtay commented Aug 14, 2024 •
edited
Loading

What kind of change does this PR introduce?

  • Currently, invalid state errors on the oauth callback endpoint are returned as json responses - this makes error handling impossible for the client since the callback is invoked by the oauth provider and leaves users with an unfriendly error message.
  • This PR aims to address this by redirecting errors to the Site URL. We can't redirect errors to the redirect url specified in the state because the state might not be verified yet, which may lead to malicious redirects.
  • This changes the response for these type of errors to redirect to the site URL instead of failing at the /callback endpoint.

@kangmingtay kangmingtay requested a review from a team as a code owner August 14, 2024 21:46
@kangmingtay
Copy link
Member Author

staticcheck errors are fixed in this commit

hf
hf reviewed Aug 15, 2024
View reviewed changes
internal/api/external_oauth.go Outdated Show resolved Hide resolved
@coveralls
Copy link

Pull Request Test Coverage Report for Build 10410802254

Details

  • 13 of 38 (34.21%) changed or added relevant lines in 4 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage decreased (-0.06%) to 58.222%
Changes Missing Coverage Covered Lines Changed/Added Lines %
internal/api/external.go 8 14 57.14%
internal/api/external_oauth.go 4 12 33.33%
internal/api/samlacs.go 0 11 0.0%
Totals Coverage Status
Change from base Build 10410796346: -0.06%
Covered Lines: 9195
Relevant Lines: 15793
💛 - Coveralls

@kangmingtay kangmingtay merged commit b2b1123 into master Aug 16, 2024
2 checks passed
@kangmingtay kangmingtay deleted the km/redirect-invalid-state branch August 16, 2024 13:16
@github-actions github-actions bot mentioned this pull request Aug 16, 2024
Merged
kangmingtay pushed a commit that referenced this pull request Aug 21, 2024
@github-actions
chore(master): release 2.159.0 (#1716)
a6de8c9 
🤖 I have created a release *beep* *boop*
---


##
[2.159.0](v2.158.1...v2.159.0)
(2024-08-21)


### Features

* Vercel marketplace OIDC
([#1731](#1731))
([a9ff361](a9ff361))


### Bug Fixes

* add error codes to password login flow
([#1721](#1721))
([4351226](4351226))
* change phone constraint to per user
([#1713](#1713))
([b9bc769](b9bc769))
* custom SMS does not work with Twilio Verify
([#1733](#1733))
([dc2391d](dc2391d))
* ignore errors if transaction has closed already
([#1726](#1726))
([53c11d1](53c11d1))
* redirect invalid state errors to site url
([#1722](#1722))
([b2b1123](b2b1123))
* remove TOTP field for phone enroll response
([#1717](#1717))
([4b04327](4b04327))
* use signing jwk to sign oauth state
([#1728](#1728))
([66fd0c8](66fd0c8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
uxodb pushed a commit to uxodb/auth that referenced this pull request Nov 13, 2024
@kangmingtay
fix: redirect invalid state errors to site url (supabase#1722)
0f1a296
uxodb pushed a commit to uxodb/auth that referenced this pull request Nov 13, 2024
@github-actions
chore(master): release 2.159.0 (supabase#1716)
f8c8ea8 
🤖 I have created a release *beep* *boop*
---


##
[2.159.0](supabase/auth@v2.158.1...v2.159.0)
(2024-08-21)


### Features

* Vercel marketplace OIDC
([supabase#1731](supabase#1731))
([a9ff361](supabase@a9ff361))


### Bug Fixes

* add error codes to password login flow
([supabase#1721](supabase#1721))
([4351226](supabase@4351226))
* change phone constraint to per user
([supabase#1713](supabase#1713))
([b9bc769](supabase@b9bc769))
* custom SMS does not work with Twilio Verify
([supabase#1733](supabase#1733))
([dc2391d](supabase@dc2391d))
* ignore errors if transaction has closed already
([supabase#1726](supabase#1726))
([53c11d1](supabase@53c11d1))
* redirect invalid state errors to site url
([supabase#1722](supabase#1722))
([b2b1123](supabase@b2b1123))
* remove TOTP field for phone enroll response
([supabase#1717](supabase#1717))
([4b04327](supabase@4b04327))
* use signing jwk to sign oauth state
([supabase#1728](supabase#1728))
([66fd0c8](supabase@66fd0c8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 13, 2024
@kangmingtay @LashaJini
fix: redirect invalid state errors to site url (supabase#1722)
522d816
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 13, 2024
@github-actions @LashaJini
chore(master): release 2.159.0 (supabase#1716)
8f59687 
🤖 I have created a release *beep* *boop*
---


##
[2.159.0](supabase/auth@v2.158.1...v2.159.0)
(2024-08-21)


### Features

* Vercel marketplace OIDC
([supabase#1731](supabase#1731))
([a9ff361](supabase@a9ff361))


### Bug Fixes

* add error codes to password login flow
([supabase#1721](supabase#1721))
([4351226](supabase@4351226))
* change phone constraint to per user
([supabase#1713](supabase#1713))
([b9bc769](supabase@b9bc769))
* custom SMS does not work with Twilio Verify
([supabase#1733](supabase#1733))
([dc2391d](supabase@dc2391d))
* ignore errors if transaction has closed already
([supabase#1726](supabase#1726))
([53c11d1](supabase@53c11d1))
* redirect invalid state errors to site url
([supabase#1722](supabase#1722))
([b2b1123](supabase@b2b1123))
* remove TOTP field for phone enroll response
([supabase#1717](supabase#1717))
([4b04327](supabase@4b04327))
* use signing jwk to sign oauth state
([supabase#1728](supabase#1728))
([66fd0c8](supabase@66fd0c8))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@hf hf hf approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@kangmingtay @coveralls @hf