opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

refactor: simplify OAuth2 authorization flow and use 302 redirects (#18923)

Browse Source 
# Refactor OAuth2 Provider Authorization Flow

This PR refactors the OAuth2 provider authorization flow by:

1. Removing the `authorizeMW` middleware and directly implementing its functionality in the `ShowAuthorizePage` handler
2. Simplifying function signatures by removing unnecessary parameters:
   - Removed `db` parameter from `ShowAuthorizePage`
   - Removed `accessURL` parameter from `ProcessAuthorize`
3. Changing the redirect status code in `ProcessAuthorize` from 307 (Temporary Redirect) to 302 (Found) to improve compatibility with external OAuth2 apps and browsers. (Technical explanation: we replied with a 307 to a POST request, thus the browser performs a redirect to that URL as a POST request, but we need it to be a GET request to be compatible. Thus, we use the 302 redirect so that browsers turn it into a GET request when redirecting back to the redirect_uri.)

The changes maintain the same functionality while simplifying the code and improving compatibility with external systems.
This commit is contained in:
Thomas Kosiewski
2025-07-20 16:22:52 +02:00
committed by GitHub
parent 071383bbe8
commit 7b06fc77ae
4 changed files with 45 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/coderdtest/oidctest/helper.go
+2 -2
View File
@@ -132,14 +132,14 @@ func OAuth2GetCode(rawAuthURL string, doRequest func(req *http.Request) (*http.R
return "", xerrors.Errorf("failed to create auth request: %w", err)
}
expCode := http.StatusTemporaryRedirect
resp, err := doRequest(r)
if err != nil {
return "", xerrors.Errorf("request: %w", err)
}
defer resp.Body.Close()
if resp.StatusCode != expCode {
// Accept both 302 (Found) and 307 (Temporary Redirect) as valid OAuth2 redirects
if resp.StatusCode != http.StatusFound && resp.StatusCode != http.StatusTemporaryRedirect {
return "", codersdk.ReadBodyAsError(resp)
}