fix(oidc): prompt none not handled #7018
Conversation
This fixes an issue where the Content Security Policy was not set correctly in all situations.
This fixes an issue where prompt type none could be handled properly in a couple of scenarios but wasn't. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
ArtifactsThese changes are published for testing on Buildkite, DockerHub and GitHub Container Registry. Docker Container
|
WalkthroughThe modifications introduce enhanced checks and error handling in the OpenID Connect authorization process, particularly focusing on response modes, prompt parameters, and consent requirements. A notable addition is the handling of scenarios where a Changes
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
james-d-elliott
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Status
Actionable comments generated: 0
Configuration used: CodeRabbit UI
Files selected for processing (3)
- internal/handlers/handler_oidc_authorization.go (4 hunks)
- internal/handlers/handler_oidc_authorization_consent_pre_configured.go (2 hunks)
- internal/oidc/const.go (1 hunks)
Files skipped from review due to trivial changes (1)
- internal/oidc/const.go
Additional comments: 4
internal/handlers/handler_oidc_authorization.go (2)
- 35-37: The addition of a check for
ResponseModeFormPostbefore handling errors is a good practice to ensure that the response mode is correctly identified and handled. This change enhances the robustness of error handling in OIDC authorization requests.- 91-107: The new checks and logic related to the
PromptNoneparameter and explicit client consent requirements are crucial for correctly handling scenarios where silent authentication is requested but cannot be fulfilled due to consent requirements. This change improves the system's behavior in handling consent-related scenarios and error responses in a more precise and user-friendly manner.internal/handlers/handler_oidc_authorization_consent_pre_configured.go (2)
- 124-130: The addition of a conditional check to handle cases where
prompt=noneis requested but consent is required or pre-configured consent is missing is a significant improvement. This ensures that the system correctly identifies and responds to situations where consent cannot be silently obtained or is not pre-configured, thereby necessitating an error response. This change aligns with the PR objectives to enhance the handling of specific OIDC authorization scenarios.- 152-158: Repeating the conditional check in
handleOIDCAuthorizationConsentModePreConfiguredWithoutIDensures consistency across different consent handling scenarios. This repetition is necessary to cover both cases where a consent ID is provided and where it is not, ensuring that the system behaves correctly in both situations.
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #7018 +/- ##
==========================================
- Coverage 73.38% 73.34% -0.04%
==========================================
Files 345 345
Lines 29726 29757 +31
Branches 839 839
==========================================
+ Hits 21813 21825 +12
- Misses 7042 7062 +20
+ Partials 871 870 -1
Flags with carried forward coverage won't be shown. Click here to find out more.
|
Summary by CodeRabbit
New Features
Refactor