From 222c6d53e24ddfff1a52ad59fdb853dfb67c460e Mon Sep 17 00:00:00 2001 From: Bethuel Mmbaga Date: Thu, 24 Sep 2026 20:48:40 +0300 Subject: [PATCH] [management] Refuse HTTP redirects on IdP clients (#7579) --- management/server/idp/auth0.go | 8 +------- management/server/idp/authentik.go | 8 +------- management/server/idp/azure.go | 8 +------- management/server/idp/dex.go | 10 +--------- management/server/idp/google_workspace.go | 9 +-------- management/server/idp/jumpcloud.go | 8 +------- management/server/idp/keycloak.go | 8 +------- management/server/idp/okta.go | 8 +------- management/server/idp/pocketid.go | 8 +------- management/server/idp/util.go | 19 +++++++++++++++++++ management/server/idp/zitadel.go | 8 +------- 11 files changed, 29 insertions(+), 73 deletions(-) diff --git a/management/server/idp/auth0.go b/management/server/idp/auth0.go index 7d3837190..4d6ef5859 100644 --- a/management/server/idp/auth0.go +++ b/management/server/idp/auth0.go @@ -132,13 +132,7 @@ type ConnectionOptions struct { // NewAuth0Manager creates a new instance of the Auth0Manager func NewAuth0Manager(config Auth0ClientConfig, appMetrics telemetry.AppMetrics) (*Auth0Manager, error) { - httpTransport := http.DefaultTransport.(*http.Transport).Clone() - httpTransport.MaxIdleConns = 5 - - httpClient := &http.Client{ - Timeout: idpTimeout(), - Transport: httpTransport, - } + httpClient := newHTTPClient() helper := JsonParser{} diff --git a/management/server/idp/authentik.go b/management/server/idp/authentik.go index ebd79b715..9ab884bc7 100644 --- a/management/server/idp/authentik.go +++ b/management/server/idp/authentik.go @@ -49,13 +49,7 @@ type AuthentikCredentials struct { // NewAuthentikManager creates a new instance of the AuthentikManager. func NewAuthentikManager(config AuthentikClientConfig, appMetrics telemetry.AppMetrics) (*AuthentikManager, error) { - httpTransport := http.DefaultTransport.(*http.Transport).Clone() - httpTransport.MaxIdleConns = 5 - - httpClient := &http.Client{ - Timeout: idpTimeout(), - Transport: httpTransport, - } + httpClient := newHTTPClient() helper := JsonParser{} diff --git a/management/server/idp/azure.go b/management/server/idp/azure.go index 320ca7a83..6640ef6d0 100644 --- a/management/server/idp/azure.go +++ b/management/server/idp/azure.go @@ -54,13 +54,7 @@ type azureProfile map[string]any // NewAzureManager creates a new instance of the AzureManager. func NewAzureManager(config AzureClientConfig, appMetrics telemetry.AppMetrics) (*AzureManager, error) { - httpTransport := http.DefaultTransport.(*http.Transport).Clone() - httpTransport.MaxIdleConns = 5 - - httpClient := &http.Client{ - Timeout: idpTimeout(), - Transport: httpTransport, - } + httpClient := newHTTPClient() helper := JsonParser{} diff --git a/management/server/idp/dex.go b/management/server/idp/dex.go index 0cac246e1..7d25c6ed0 100644 --- a/management/server/idp/dex.go +++ b/management/server/idp/dex.go @@ -4,10 +4,8 @@ import ( "context" "encoding/base64" "fmt" - "net/http" "strings" "sync" - "time" "github.com/dexidp/dex/api/v2" log "github.com/sirupsen/logrus" @@ -44,13 +42,7 @@ func NewDexManager(config DexClientConfig, appMetrics telemetry.AppMetrics) (*De return nil, fmt.Errorf("dex IdP configuration is incomplete, GRPCAddr is missing") } - httpTransport := http.DefaultTransport.(*http.Transport).Clone() - httpTransport.MaxIdleConns = 5 - - httpClient := &http.Client{ - Timeout: 10 * time.Second, - Transport: httpTransport, - } + httpClient := newHTTPClient() helper := JsonParser{} return &DexManager{ diff --git a/management/server/idp/google_workspace.go b/management/server/idp/google_workspace.go index dadbfd83e..ff58e7772 100644 --- a/management/server/idp/google_workspace.go +++ b/management/server/idp/google_workspace.go @@ -4,7 +4,6 @@ import ( "context" "encoding/base64" "fmt" - "net/http" log "github.com/sirupsen/logrus" "golang.org/x/oauth2/google" @@ -44,13 +43,7 @@ func (gc *GoogleWorkspaceCredentials) Authenticate(_ context.Context) (JWTToken, // NewGoogleWorkspaceManager creates a new instance of the GoogleWorkspaceManager. func NewGoogleWorkspaceManager(ctx context.Context, config GoogleWorkspaceClientConfig, appMetrics telemetry.AppMetrics) (*GoogleWorkspaceManager, error) { - httpTransport := http.DefaultTransport.(*http.Transport).Clone() - httpTransport.MaxIdleConns = 5 - - httpClient := &http.Client{ - Timeout: idpTimeout(), - Transport: httpTransport, - } + httpClient := newHTTPClient() helper := JsonParser{} diff --git a/management/server/idp/jumpcloud.go b/management/server/idp/jumpcloud.go index f0dec3a9b..ac547e4a1 100644 --- a/management/server/idp/jumpcloud.go +++ b/management/server/idp/jumpcloud.go @@ -58,13 +58,7 @@ type JumpCloudCredentials struct { // NewJumpCloudManager creates a new instance of the JumpCloudManager. func NewJumpCloudManager(config JumpCloudClientConfig, appMetrics telemetry.AppMetrics) (*JumpCloudManager, error) { - httpTransport := http.DefaultTransport.(*http.Transport).Clone() - httpTransport.MaxIdleConns = 5 - - httpClient := &http.Client{ - Timeout: idpTimeout(), - Transport: httpTransport, - } + httpClient := newHTTPClient() helper := JsonParser{} diff --git a/management/server/idp/keycloak.go b/management/server/idp/keycloak.go index 1cf26394f..9c01fcee2 100644 --- a/management/server/idp/keycloak.go +++ b/management/server/idp/keycloak.go @@ -59,13 +59,7 @@ type keycloakProfile struct { // NewKeycloakManager creates a new instance of the KeycloakManager. func NewKeycloakManager(config KeycloakClientConfig, appMetrics telemetry.AppMetrics) (*KeycloakManager, error) { - httpTransport := http.DefaultTransport.(*http.Transport).Clone() - httpTransport.MaxIdleConns = 5 - - httpClient := &http.Client{ - Timeout: idpTimeout(), - Transport: httpTransport, - } + httpClient := newHTTPClient() helper := JsonParser{} diff --git a/management/server/idp/okta.go b/management/server/idp/okta.go index 07f0d8008..90bcd05a9 100644 --- a/management/server/idp/okta.go +++ b/management/server/idp/okta.go @@ -40,13 +40,7 @@ type OktaCredentials struct { // NewOktaManager creates a new instance of the OktaManager. func NewOktaManager(config OktaClientConfig, appMetrics telemetry.AppMetrics) (*OktaManager, error) { - httpTransport := http.DefaultTransport.(*http.Transport).Clone() - httpTransport.MaxIdleConns = 5 - - httpClient := &http.Client{ - Timeout: idpTimeout(), - Transport: httpTransport, - } + httpClient := newHTTPClient() helper := JsonParser{} config.Issuer = baseURL(config.Issuer) diff --git a/management/server/idp/pocketid.go b/management/server/idp/pocketid.go index fc338b86b..b340bfe5f 100644 --- a/management/server/idp/pocketid.go +++ b/management/server/idp/pocketid.go @@ -83,13 +83,7 @@ type pocketIdUserGroupDto struct { } func NewPocketIdManager(config PocketIdClientConfig, appMetrics telemetry.AppMetrics) (*PocketIdManager, error) { - httpTransport := http.DefaultTransport.(*http.Transport).Clone() - httpTransport.MaxIdleConns = 5 - - httpClient := &http.Client{ - Timeout: idpTimeout(), - Transport: httpTransport, - } + httpClient := newHTTPClient() helper := JsonParser{} diff --git a/management/server/idp/util.go b/management/server/idp/util.go index 6545c2a69..be59edba7 100644 --- a/management/server/idp/util.go +++ b/management/server/idp/util.go @@ -2,6 +2,8 @@ package idp import ( "encoding/json" + "errors" + "net/http" "net/url" "os" "strings" @@ -81,6 +83,23 @@ const ( defaultTimeout = 10 * time.Second ) +// errRedirectRefused is returned instead of http.ErrUseLastResponse so the +// client closes the redirect response rather than handing it back unread. +var errRedirectRefused = errors.New("redirect refused") + +func newHTTPClient() *http.Client { + httpTransport := http.DefaultTransport.(*http.Transport).Clone() + httpTransport.MaxIdleConns = 5 + + return &http.Client{ + Timeout: idpTimeout(), + Transport: httpTransport, + CheckRedirect: func(*http.Request, []*http.Request) error { + return errRedirectRefused + }, + } +} + // idpTimeout returns a timeout value for the IDP func idpTimeout() time.Duration { timeoutStr, ok := os.LookupEnv(idpTimeoutEnv) diff --git a/management/server/idp/zitadel.go b/management/server/idp/zitadel.go index 320f0c131..fdc59915d 100644 --- a/management/server/idp/zitadel.go +++ b/management/server/idp/zitadel.go @@ -160,13 +160,7 @@ func verifyJWTConfig(config ZitadelClientConfig) error { // NewZitadelManager creates a new instance of the ZitadelManager. func NewZitadelManager(config ZitadelClientConfig, appMetrics telemetry.AppMetrics) (*ZitadelManager, error) { - httpTransport := http.DefaultTransport.(*http.Transport).Clone() - httpTransport.MaxIdleConns = 5 - - httpClient := &http.Client{ - Timeout: idpTimeout(), - Transport: httpTransport, - } + httpClient := newHTTPClient() helper := JsonParser{}