opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-22 05:05:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

test(coderd/coderdtest/oidctest): scope IDP NotFound errors to IDP paths (#25892)

Browse Source 
The FakeIDP mux.NotFound handler called t.Errorf for any unrecognized
HTTP request, failing the owning test. It also never wrote an HTTP
response, so the stale caller got a 200 with an empty body, hiding
the problem on the caller side.

When the IDP runs as a real HTTP server (WithServing), OS port reuse
across concurrent test binaries can route stale connections to the IDP
port. The source is enterprise provisionerd reconnects and DERP
clients from parallel tests whose coderd servers have shut down.

Check whether the NotFound request path starts with a known IDP route
prefix (/oauth2/, /.well-known/, /login/, /external-auth-validate/).
IDP paths: t.Errorf, logger.Error, and 404 response. Non-IDP paths:
t.Logf, logger.Warn, and 421 Misdirected Request response. Both
branches now return a proper HTTP error so the offending caller can be
traced.
This commit is contained in:
Mathias Fredriksson
2026-06-03 13:06:46 +03:00
committed by GitHub
parent 8b058dc949
commit faf0add985
1 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/coderdtest/oidctest/idp.go
+22 -3
View File
@@ -1413,9 +1413,28 @@ func (f *FakeIDP) httpHandler(t testing.TB) http.Handler {
}.Encode())
}))
mux.NotFound(func(_ http.ResponseWriter, r *http.Request) {
f.logger.Error(r.Context(), "http call not found", slogRequestFields(r)...)
t.Errorf("unexpected request to IDP at path %q. Not supported", r.URL.Path)
mux.NotFound(func(rw http.ResponseWriter, r *http.Request) {
// When the IDP runs as a real HTTP server (WithServing), OS
// port reuse can route stale connections from other tests to
// this server. Only fail the test for paths that look like
// legitimate IDP requests (OIDC protocol paths). Non-IDP
// paths (e.g. /api/v2/.../provisionerdaemons/serve, /derp)
// are cross-test contamination; return an error to the caller
// so the offending test can be traced, but do not fail this
// test.
idpPath := strings.HasPrefix(r.URL.Path, "/oauth2/") ||
strings.HasPrefix(r.URL.Path, "/.well-known/") ||
strings.HasPrefix(r.URL.Path, "/login/") ||
strings.HasPrefix(r.URL.Path, "/external-auth-validate/")
if idpPath {
f.logger.Error(r.Context(), "unexpected IDP request at unhandled path", slogRequestFields(r)...)
t.Errorf("unexpected request to IDP at path %q. Not supported", r.URL.Path)
http.Error(rw, fmt.Sprintf("unexpected IDP request at path %q", r.URL.Path), http.StatusNotFound)
} else {
f.logger.Warn(r.Context(), "non-IDP request received, likely cross-test port reuse", slogRequestFields(r)...)
t.Logf("ignoring non-IDP request at path %q (likely cross-test port reuse)", r.URL.Path)
http.Error(rw, fmt.Sprintf("misdirected request to IDP at path %q", r.URL.Path), http.StatusMisdirectedRequest)
}
})
return mux