mirror of
https://github.com/coder/coder.git
synced 2026-09-22 05:05:20 +08:00
Bobby Ho
209d1ca498
The token endpoint accepted any non-empty `code_verifier`, so a one-character verifier was enough to authenticate. RFC 7636 §4.1 requires 43 to 128 characters from the unreserved set. That fix plus the related gaps review surfaced in the same path: - Enforce the length and charset floor on the verifier before the S256 comparison runs. - Validate the challenge at the authorize endpoint too. It was only checked for non-emptiness, so a malformed challenge was stored and then failed late at token exchange, blaming the wrong parameter. - A malformed verifier now returns `invalid_request` (RFC 6749 §5.2); a well-formed but wrong one still returns `invalid_grant` (RFC 7636 §4.6). Both looked identical before, so a client had no way to tell a syntax error from a hash mismatch and would retry the same bad verifier forever. - Revoke the authorization code when a PKCE check fails. Without that, a leaked code could be replayed with unlimited verifier guesses for its remaining lifetime, and RFC 6749 §10.5 requires codes to be single use. - Fix verifier generation in `scripts/oauth2/*.sh` and the docs example. They deleted reserved base64 characters instead of translating them to the URL-safe alphabet, so most runs produced verifiers under the new floor. Also carries #28041, which merged into this branch: public clients may register bare custom schemes such as `vscode://` again, with `mailto`, `tel`, and `sms` rejected. Split out of #27873 (public OAuth2 client support). PKCE is already mandatory for every client, so this stands on its own. <details> <summary>Manual verification</summary> Ran against a local dev server on this branch, using a session token and a throwaway app from `scripts/oauth2/setup-test-app.sh`. 1. Happy path unchanged: HTTP 200, verifier length 43. 2. `code_verifier=short`, and a 43-character verifier ending in `!`: both HTTP 400 `invalid_request`, so charset is enforced and not just length. 3. `code_challenge=tooshort` at authorize: HTTP 400 `invalid_request`, no code issued. An empty challenge still hits the older "required and cannot be empty" message. 4. Well-formed but wrong verifier: HTTP 400 `invalid_grant`, distinct from the cases above. 5. Retrying that same code with the correct verifier: HTTP 400, code already revoked by the failed check. 6. `generate-pkce.sh` produces a 43-character verifier (20 out of 20 runs); the docs example produces 128. 7. `scripts/oauth2/test-mcp-oauth2.sh` passes end to end. The two bearer-token failures in its output are a pre-existing script bug (`09c50559f3`, July 2025) that reuses a resource-scoped token against the real API, not a regression here. </details>
OAuth2 Test Scripts
This directory contains test scripts for the MCP OAuth2 implementation in Coder.
Prerequisites
-
Start Coder in development mode:
./scripts/develop.sh -
Login to get a session token:
./scripts/coder-dev.sh login
Scripts
test-mcp-oauth2.sh
Complete automated test suite that verifies all OAuth2 functionality:
- Metadata endpoint
- PKCE flow
- Resource parameter support
- Token refresh
- Error handling
Usage:
chmod +x ./scripts/oauth2/test-mcp-oauth2.sh
./scripts/oauth2/test-mcp-oauth2.sh
setup-test-app.sh
Creates a test OAuth2 application and outputs environment variables.
Usage:
eval $(./scripts/oauth2/setup-test-app.sh)
echo "Client ID: $CLIENT_ID"
cleanup-test-app.sh
Deletes a test OAuth2 application.
Usage:
./scripts/oauth2/cleanup-test-app.sh $CLIENT_ID
# Or if CLIENT_ID is set as environment variable:
./scripts/oauth2/cleanup-test-app.sh
generate-pkce.sh
Generates PKCE code verifier and challenge for manual testing.
Usage:
./scripts/oauth2/generate-pkce.sh
test-manual-flow.sh
Launches a local Go web server to test the OAuth2 flow interactively. The server automatically handles the OAuth2 callback and token exchange, providing a user-friendly web interface with results.
Usage:
# First set up an app
eval $(./scripts/oauth2/setup-test-app.sh)
# Then run the test server
./scripts/oauth2/test-manual-flow.sh
Features:
- Starts a local web server on port 9876
- Automatically captures the authorization code
- Performs token exchange without manual intervention
- Displays results in a clean web interface
- Shows example API calls you can make with the token
oauth2-test-server.go
A Go web server that handles OAuth2 callbacks and token exchange. Used internally by test-manual-flow.sh but can also be run standalone:
export CLIENT_ID="your-client-id"
export CLIENT_SECRET="your-client-secret"
export CODE_VERIFIER="your-code-verifier"
export STATE="your-state"
go run ./scripts/oauth2/oauth2-test-server.go
Example Workflow
-
Run automated tests:
./scripts/oauth2/test-mcp-oauth2.sh -
Interactive browser testing:
# Create app eval $(./scripts/oauth2/setup-test-app.sh) # Run the test server (opens in browser automatically) ./scripts/oauth2/test-manual-flow.sh # - Opens authorization URL in terminal # - Handles callback automatically # - Shows token exchange results # Clean up when done ./scripts/oauth2/cleanup-test-app.sh -
Generate PKCE for custom testing:
./scripts/oauth2/generate-pkce.sh # Use the generated values in your own curl commands
Environment Variables
All scripts respect these environment variables:
SESSION_TOKEN: Coder session token (auto-read from.coderv2/session)BASE_URL: Coder server URL (default:http://localhost:3000)CLIENT_ID: OAuth2 client IDCLIENT_SECRET: OAuth2 client secret
OAuth2 Endpoints
- Metadata:
GET /.well-known/oauth-authorization-server - Authorization:
GET/POST /oauth2/authorize - Token:
POST /oauth2/tokens - Apps API:
/api/v2/oauth2-provider/apps