Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix: prevent infinite redirect oauth auth flow #10430

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Oct 30, 2023
Merged

fix: prevent infinite redirect oauth auth flow #10430

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2cb994a
fix: prevent infinite redirect oauth auth flow
Emyrk Oct 30, 2023
5bc70e0
Update error text
Emyrk Oct 30, 2023
8ea497a
Linting
Emyrk Oct 30, 2023
8913848
useSearchParams hook
Emyrk Oct 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions coderd/externalauth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,8 +268,9 @@ func (api *API) externalAuthCallback(externalAuthConfig *externalauth.Config) ht

redirect := state.Redirect
if redirect == "" {
// This is a nicely rendered screen on the frontend
redirect = fmt.Sprintf("/external-auth/%s", externalAuthConfig.ID)
// This is a nicely rendered screen on the frontend. Passing the query param lets the
// FE know not to enter the authentication loop again, and instead display an error.
redirect = fmt.Sprintf("/external-auth/%s?redirected=true", externalAuthConfig.ID)
}
http.Redirect(rw, r, redirect, http.StatusTemporaryRedirect)
}
Expand Down
36 changes: 35 additions & 1 deletion site/src/pages/ExternalAuthPage/ExternalAuthPage.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,21 @@ import {
} from "api/api";
import { usePermissions } from "hooks";
import { type FC } from "react";
import { useParams } from "react-router-dom";
import { useParams, useSearchParams } from "react-router-dom";
import ExternalAuthPageView from "./ExternalAuthPageView";
import { ApiErrorResponse } from "api/errors";
import { isAxiosError } from "axios";
import Box from "@mui/material/Box";
import Button from "@mui/material/Button";
import { SignInLayout } from "components/SignInLayout/SignInLayout";
import { Welcome } from "components/Welcome/Welcome";

const ExternalAuthPage: FC = () => {
const { provider } = useParams();
if (!provider) {
throw new Error("provider must exist");
}
const [searchParams] = useSearchParams();
const permissions = usePermissions();
const queryClient = useQueryClient();
const getExternalAuthProviderQuery = useQuery({
Expand Down Expand Up @@ -72,6 +77,35 @@ const ExternalAuthPage: FC = () => {
!getExternalAuthProviderQuery.data.authenticated &&
!getExternalAuthProviderQuery.data.device
) {
const redirectedParam = searchParams?.get("redirected");
if (redirectedParam && redirectedParam.toLowerCase() === "true") {
// The auth flow redirected the user here. If we redirect back to the
// callback, that resets the flow and we'll end up in an infinite loop.
// So instead, show an error, as the user expects to be authenticated at
// this point.
// TODO: Unsure what to do about the device auth flow, should we also
// show an error there?
return (
<SignInLayout>
<Welcome message="Failed to validate oauth access token" />
<Box textAlign="center">
Attempted to validate the user&apos;s oauth access token from the
authentication flow. This situation may occur as a result of an
external authentication provider misconfiguration. Verify the
external authentication validation URL is accurately configured.
</Box>
<br />
<Button
onClick={() => {
// Redirect to the auth flow again. *crosses fingers*
window.location.href = `/external-auth/${provider}/callback`;
}}
>
Retry
</Button>
</SignInLayout>
);
}
window.location.href = `/external-auth/${provider}/callback`;
return null;
}
Expand Down