Repository navigation
OAuth: an unreachable auth server refuses the token, whatever its address - #315
Merged
Merged
Conversation
…ress fetch_user returned a shared `test_user_id` (role group_user) for any bearer token when the request to the auth server failed and auth_url was loopback or contained "localhost" - which Settings::default() is. Any string in `Authorization: Bearer` then acted as that one account. The branch was a test convenience compiled into production; the test harness runs its own /me mock and never needed it. Now it is the same error as for any other address, and the middleware refuses the request. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by the
user.rolesecurity audit.Problem.
fetch_user(src/middleware/authentication/method/f_oauth.rs) handled a failed request to the auth server (connection error) differently depending on the address. Whenauth_urlstarted withhttp://127.0.0.1:or containedlocalhost, it returned a fixed usertest_user_id(rolegroup_user) for any bearer token. Any string inAuthorization: Bearerthen acted as that one shared account, with its projects and deployments.Settings::default()hasauth_url: http://localhost:8080/me, and the service runs on those defaults whenever its configuration does not deserialize (see the companion PR).Change. That branch is removed. An unreachable auth server is now the same error for every address, and the middleware refuses the request. A request with no
Authorizationheader still goes throughanonym, as before.Tests
an_unreachable_loopback_auth_server_refuses_the_token(127.0.0.1 and localhost, a port with nothing listening). It failed against the old code withan unverified token became user Ok("test_user_id")and passes now.cargo test --libpasses (2305).cargo nextest run --tests -E 'not binary(bdd)'passes all 2977, so no test relied on the fallback.cargo test --test bddpasses 334 scenarios.🤖 Generated with Claude Code