From d6242b7267268cb4d257d7fdca30d1f6b3ded7c8 Mon Sep 17 00:00:00 2001 From: Reza Rezaei <77894240+MeRezaRezaei@users.noreply.github.com> Date: Tue, 18 Aug 2026 15:53:18 +0200 Subject: [PATCH] fix(auth): add missing state parameter to OIDC authorization URL (#10614) * fix(auth): add missing state parameter to OIDC authorization URL The OIDC login route generates a state UUID and stores it in the oidc_state cookie, but never includes it in the authorization URL. This causes the OIDC callback to receive state=null, failing with 'oidc_error=missing_code' because the provider has no state to echo. Add url.searchParams.set('state', state) after setting scope, so the state parameter is sent to the OIDC provider and returned in the callback for proper CSRF protection. * test(auth): add regression coverage for OIDC login state parameter Adds a TDD regression test proving the fix in this PR: the OIDC login route now includes the state query parameter in the authorization redirect URL, and it matches the oidc_state cookie value set on the same response. Modeled on tests/unit/oidc-callback.test.ts. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(auth): use originEarly for OIDC err redirects (#10224) * test(auth): verify OIDC err redirects use proxy origin (#10224) --------- Co-authored-by: openhands Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --- src/app/api/auth/oidc/callback/route.ts | 26 +++-- src/app/api/auth/oidc/login/route.ts | 1 + tests/unit/oidc-callback.test.ts | 21 +++++ tests/unit/oidc-login-state.test.ts | 120 ++++++++++++++++++++++++ 4 files changed, 153 insertions(+), 15 deletions(-) create mode 100644 tests/unit/oidc-login-state.test.ts diff --git a/src/app/api/auth/oidc/callback/route.ts b/src/app/api/auth/oidc/callback/route.ts index 702cd39deb..28e88fe054 100644 --- a/src/app/api/auth/oidc/callback/route.ts +++ b/src/app/api/auth/oidc/callback/route.ts @@ -48,14 +48,14 @@ export async function GET(request: Request) { const originEarly = `${schemeEarly}://${hostEarly}`; if (!code || !returnedState) { - return NextResponse.redirect(new URL("/login?oidc_error=missing_code", reqUrlEarly)); + return NextResponse.redirect(new URL("/login?oidc_error=missing_code", originEarly)); } // Validate state from cookie (via seam so tests can capture) const cookieStore = await oidcCallbackInternals.getCookieStore(); const storedState = cookieStore.get("oidc_state")?.value; if (!storedState || storedState !== returnedState) { - return NextResponse.redirect(new URL("/login?oidc_error=invalid_state", reqUrlEarly)); + return NextResponse.redirect(new URL("/login?oidc_error=invalid_state", originEarly)); } // Clear state cookie @@ -80,7 +80,7 @@ export async function GET(request: Request) { : "/api/auth/oidc/callback"; if (!enabled || !issuer || !clientId || !clientSecret) { - return NextResponse.redirect(new URL("/login?oidc_error=not_configured", reqUrlEarly)); + return NextResponse.redirect(new URL("/login?oidc_error=not_configured", originEarly)); } // Compute absolute redirect_uri matching what we sent @@ -131,28 +131,28 @@ export async function GET(request: Request) { signal: AbortSignal.timeout(10000), }); } catch { - return NextResponse.redirect(new URL("/login?oidc_error=token_exchange", reqUrlEarly)); + return NextResponse.redirect(new URL("/login?oidc_error=token_exchange", originEarly)); } if (!tokenResp.ok) { - return NextResponse.redirect(new URL("/login?oidc_error=token_exchange", reqUrlEarly)); + return NextResponse.redirect(new URL("/login?oidc_error=token_exchange", originEarly)); } let tokenData: unknown; try { tokenData = await tokenResp.json(); } catch { - return NextResponse.redirect(new URL("/login?oidc_error=token_response", reqUrlEarly)); + return NextResponse.redirect(new URL("/login?oidc_error=token_response", originEarly)); } if (!tokenData || typeof tokenData !== "object") { - return NextResponse.redirect(new URL("/login?oidc_error=token_response", reqUrlEarly)); + return NextResponse.redirect(new URL("/login?oidc_error=token_response", originEarly)); } const td = tokenData as Record; const idToken = typeof td.id_token === "string" ? td.id_token : undefined; if (!idToken) { - return NextResponse.redirect(new URL("/login?oidc_error=no_id_token", reqUrlEarly)); + return NextResponse.redirect(new URL("/login?oidc_error=no_id_token", originEarly)); } // Validate ID token @@ -178,13 +178,11 @@ export async function GET(request: Request) { return email !== "" && v.toLowerCase() === email; }); if (!ok) { - return NextResponse.redirect( - new URL("/login?oidc_error=subject_not_allowed", reqUrlEarly) - ); + return NextResponse.redirect(new URL("/login?oidc_error=subject_not_allowed", originEarly)); } } } catch { - return NextResponse.redirect(new URL("/login?oidc_error=id_token_invalid", reqUrlEarly)); + return NextResponse.redirect(new URL("/login?oidc_error=id_token_invalid", originEarly)); } // First successful OIDC login marks setupComplete (like password bootstrap). try { @@ -194,9 +192,7 @@ export async function GET(request: Request) { } // Mint the exact same dashboard session JWT as password login if (!process.env.JWT_SECRET) { - return NextResponse.redirect( - new URL("/login?oidc_error=server_misconfigured", reqUrlEarly) - ); + return NextResponse.redirect(new URL("/login?oidc_error=server_misconfigured", originEarly)); } const forceSecureCookie = process.env.AUTH_COOKIE_SECURE === "true"; diff --git a/src/app/api/auth/oidc/login/route.ts b/src/app/api/auth/oidc/login/route.ts index 0c9eb5f619..a49dbbe431 100644 --- a/src/app/api/auth/oidc/login/route.ts +++ b/src/app/api/auth/oidc/login/route.ts @@ -73,6 +73,7 @@ export async function GET(request: Request) { url.searchParams.set("client_id", clientId); url.searchParams.set("redirect_uri", redirectUri); url.searchParams.set("scope", scope); + url.searchParams.set("state", state); const isHttpsRequest = scheme === "https"; const useSecureCookie = process.env.AUTH_COOKIE_SECURE === "true" || isHttpsRequest; diff --git a/tests/unit/oidc-callback.test.ts b/tests/unit/oidc-callback.test.ts index 310fed37cb..5d41701e42 100644 --- a/tests/unit/oidc-callback.test.ts +++ b/tests/unit/oidc-callback.test.ts @@ -485,3 +485,24 @@ test("OIDC callback rejects missing JWT_SECRET at mint time (server_misconfigure globalThis.fetch = originalFetch; } }); + +test("OIDC callback error redirect respects proxy headers (#10224)", async () => { + await setupFullOidcSettings(); + + // Omit code/state to force an immediate error redirect + // Use a bind-address style URL like when behind an internal proxy + const request = new Request("http://127.0.0.1:20128/api/auth/oidc/callback", { + headers: { + "x-forwarded-proto": "https", + host: "auth.pubg-sell.ir", + }, + }); + + const response = await callbackRoute.GET(request); + assert.equal(response.status, 307); + + const loc = response.headers.get("location") || ""; + // Without the fix, this would be http://127.0.0.1:20128/login?oidc_error=missing_code + // With the fix, it correctly uses originEarly + assert.equal(loc, "https://auth.pubg-sell.ir/login?oidc_error=missing_code"); +}); diff --git a/tests/unit/oidc-login-state.test.ts b/tests/unit/oidc-login-state.test.ts new file mode 100644 index 0000000000..ea9c4e56fb --- /dev/null +++ b/tests/unit/oidc-login-state.test.ts @@ -0,0 +1,120 @@ +import test from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; + +// NOTE: Dynamic imports below are used (with comment) solely because the modules read process.env at evaluation time. +// The specifiers are literals. This is the established pattern in this repo's auth tests for env-controlled DB setup. + +const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-oidc-login-")); +process.env.DATA_DIR = TEST_DATA_DIR; +process.env.JWT_SECRET = "test-jwt-secret-for-oidc-login"; + +// @ts-ignore - intentional for test harness timing (see note at top) +const core = await import("../../src/lib/db/core.ts"); +// @ts-ignore - intentional for test harness timing +const localDb = await import("../../src/lib/localDb.ts"); +// @ts-ignore - intentional for test harness timing +const loginRoute = await import("../../src/app/api/auth/oidc/login/route.ts"); + +async function resetStorage() { + core.resetDbInstance(); + fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true }); + fs.mkdirSync(TEST_DATA_DIR, { recursive: true }); +} + +test.beforeEach(async () => { + await resetStorage(); +}); + +test.after(() => { + core.resetDbInstance(); + fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true }); + delete process.env.JWT_SECRET; +}); + +async function setupFullOidcSettings() { + await localDb.updateSettings({ + requireLogin: true, + password: "", + oidcEnabled: true, + oidcIssuer: "https://idp.test", + oidcClientId: "client-oidc-test", + oidcClientSecret: "secret-oidc-test", + oidcRedirectPath: "/api/auth/oidc/callback", + oidcAllowedSubjects: [], + }); +} + +function extractCookieValue(setCookieHeader: string | null, name: string): string | undefined { + if (!setCookieHeader) return undefined; + const match = setCookieHeader + .split(";") + .map((part) => part.trim()) + .find((part) => part.startsWith(`${name}=`)); + return match ? decodeURIComponent(match.slice(name.length + 1)) : undefined; +} + +test("OIDC login redirect includes a state parameter matching the oidc_state cookie", async () => { + await setupFullOidcSettings(); + + const originalFetch = globalThis.fetch; + globalThis.fetch = (async (input: RequestInfo | URL) => { + const url = typeof input === "string" ? input : (input as URL).toString(); + if (url.includes("/.well-known/openid-configuration")) { + // Force the deterministic fallback authEndpoint path (no live network dependency). + return new Response("not found", { status: 404 }); + } + return new Response("not mocked", { status: 404 }); + }) as unknown as typeof fetch; + + try { + const response = await loginRoute.GET( + new Request("http://localhost/api/auth/oidc/login", { + headers: { "x-forwarded-proto": "http" }, + }) + ); + + assert.equal(response.status, 307); + + const location = response.headers.get("location"); + assert.ok(location, "redirect must include a Location header"); + + const redirectUrl = new URL(location as string); + const stateInUrl = redirectUrl.searchParams.get("state"); + assert.ok(stateInUrl, "authorization URL must include a state query parameter"); + + const setCookieHeader = response.headers.get("set-cookie"); + assert.ok(setCookieHeader, "response must set the oidc_state cookie"); + + const stateInCookie = extractCookieValue(setCookieHeader, "oidc_state"); + assert.ok(stateInCookie, "oidc_state cookie must carry a value"); + + assert.equal( + stateInUrl, + stateInCookie, + "state parameter in the authorization URL must match the oidc_state cookie value" + ); + + // Basic cookie hygiene (mirrors the callback route's expectations) + assert.match(setCookieHeader as string, /HttpOnly/i); + assert.match(setCookieHeader as string, /SameSite=lax/i); + } finally { + globalThis.fetch = originalFetch; + } +}); + +test("OIDC login returns 400 without redirecting when OIDC is not configured", async () => { + await localDb.updateSettings({ + requireLogin: true, + password: "", + oidcEnabled: false, + }); + + const response = await loginRoute.GET(new Request("http://localhost/api/auth/oidc/login")); + + assert.equal(response.status, 400); + assert.equal(response.headers.get("location"), null); + assert.equal(response.headers.get("set-cookie"), null); +});