From d0b1c36d5109df439ecdd8f13c2831a39d0e9bbd Mon Sep 17 00:00:00 2001 From: Jon Ayers Date: Thu, 20 Oct 2022 00:25:57 -0500 Subject: [PATCH] fix: prevent refreshing tokens that don't exist (#4661) - When logging in with Google OIDC refresh tokens are not provided unless explicitly asked for. This PR updates the logic to avoid attempting to refresh the token if a refresh token does not exist. A session should only be dependent on a valid Coder API key, the state of its OAuth token (beyond initial authentication) should be irrelevant. --- coderd/httpmw/apikey.go | 2 +- coderd/httpmw/apikey_test.go | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/coderd/httpmw/apikey.go b/coderd/httpmw/apikey.go index cc331983ce..54a28a2d1c 100644 --- a/coderd/httpmw/apikey.go +++ b/coderd/httpmw/apikey.go @@ -203,7 +203,7 @@ func ExtractAPIKey(cfg ExtractAPIKeyConfig) func(http.Handler) http.Handler { return } // Check if the OAuth token is expired - if link.OAuthExpiry.Before(now) && !link.OAuthExpiry.IsZero() { + if link.OAuthExpiry.Before(now) && !link.OAuthExpiry.IsZero() && link.OAuthRefreshToken != "" { var oauthConfig OAuth2Config switch key.LoginType { case database.LoginTypeGithub: diff --git a/coderd/httpmw/apikey_test.go b/coderd/httpmw/apikey_test.go index 7bfdf360b3..8205515e8c 100644 --- a/coderd/httpmw/apikey_test.go +++ b/coderd/httpmw/apikey_test.go @@ -468,9 +468,10 @@ func TestAPIKey(t *testing.T) { }) require.NoError(t, err) _, err = db.InsertUserLink(r.Context(), database.InsertUserLinkParams{ - UserID: user.ID, - LoginType: database.LoginTypeGithub, - OAuthExpiry: database.Now().AddDate(0, 0, -1), + UserID: user.ID, + LoginType: database.LoginTypeGithub, + OAuthExpiry: database.Now().AddDate(0, 0, -1), + OAuthRefreshToken: "hello", }) require.NoError(t, err)