sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-20 04:19:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

[management,proxy] Use single-use codes for OIDC session handoff (#7635)

Browse Source 
* Generalize PKCE verifier store into SingleUseStore

* Generalize PKCE verifier store into SingleUseStore

* Extend single-use store to generate one-time retrieval codes

* Hand off proxy OIDC session via one-time code instead of URL token

* Use the single-use store in integration tests

* Read active proxy versions by cluster

* Detect proxy clusters that support session codes

* Bind OIDC session handoff mode to signed state

* Deprecate legacy OIDC session token handoff

* Remove unrelated session code test stub

* fix tests

* fix merge

* Fix session code compatibility detection

* Isolate proxy session codes in shared cache

* bump min session version
This commit is contained in:
Bethuel Mmbaga
2026-09-29 18:29:55 +03:00
committed by GitHub
parent 7ff709f565
commit 30dd076b36
22 changed files with 676 additions and 281 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/internal/proxy/reverseproxy.go
+4 -3
View File
@@ -721,12 +721,13 @@ func stripSessionCookie(r *httputil.ProxyRequest) {
}
}
// stripSessionTokenQuery removes the OIDC session_token query parameter from
// the outgoing URL to prevent credential leakage to backends.
// stripSessionTokenQuery removes the OIDC session hand-off query parameters
// from the outgoing URL to prevent credential leakage to backends.
func stripSessionTokenQuery(r *httputil.ProxyRequest) {
q := r.Out.URL.Query()
if q.Has("session_token") {
if q.Has("session_token") || q.Has("session_code") {
q.Del("session_token")
q.Del("session_code")
r.Out.URL.RawQuery = q.Encode()
}
}