mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
Bobby Ho
209d1ca498
The token endpoint accepted any non-empty `code_verifier`, so a one-character verifier was enough to authenticate. RFC 7636 §4.1 requires 43 to 128 characters from the unreserved set. That fix plus the related gaps review surfaced in the same path: - Enforce the length and charset floor on the verifier before the S256 comparison runs. - Validate the challenge at the authorize endpoint too. It was only checked for non-emptiness, so a malformed challenge was stored and then failed late at token exchange, blaming the wrong parameter. - A malformed verifier now returns `invalid_request` (RFC 6749 §5.2); a well-formed but wrong one still returns `invalid_grant` (RFC 7636 §4.6). Both looked identical before, so a client had no way to tell a syntax error from a hash mismatch and would retry the same bad verifier forever. - Revoke the authorization code when a PKCE check fails. Without that, a leaked code could be replayed with unlimited verifier guesses for its remaining lifetime, and RFC 6749 §10.5 requires codes to be single use. - Fix verifier generation in `scripts/oauth2/*.sh` and the docs example. They deleted reserved base64 characters instead of translating them to the URL-safe alphabet, so most runs produced verifiers under the new floor. Also carries #28041, which merged into this branch: public clients may register bare custom schemes such as `vscode://` again, with `mailto`, `tel`, and `sms` rejected. Split out of #27873 (public OAuth2 client support). PKCE is already mandatory for every client, so this stands on its own. <details> <summary>Manual verification</summary> Ran against a local dev server on this branch, using a session token and a throwaway app from `scripts/oauth2/setup-test-app.sh`. 1. Happy path unchanged: HTTP 200, verifier length 43. 2. `code_verifier=short`, and a 43-character verifier ending in `!`: both HTTP 400 `invalid_request`, so charset is enforced and not just length. 3. `code_challenge=tooshort` at authorize: HTTP 400 `invalid_request`, no code issued. An empty challenge still hits the older "required and cannot be empty" message. 4. Well-formed but wrong verifier: HTTP 400 `invalid_grant`, distinct from the cases above. 5. Retrying that same code with the correct verifier: HTTP 400, code already revoked by the failed check. 6. `generate-pkce.sh` produces a 43-character verifier (20 out of 20 runs); the docs example produces 128. 7. `scripts/oauth2/test-mcp-oauth2.sh` passes end to end. The two bearer-token failures in its output are a pre-existing script bug (`09c50559f3`, July 2025) that reuses a resource-scoped token against the real API, not a regression here. </details>
84 lines
2.3 KiB
Bash
Executable File
84 lines
2.3 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
|
|
# Manual OAuth2 flow test with automatic callback handling
|
|
# Usage: ./test-manual-flow.sh
|
|
|
|
SESSION_TOKEN="${SESSION_TOKEN:-$(cat ./.coderv2/session 2>/dev/null || echo '')}"
|
|
BASE_URL="${BASE_URL:-http://localhost:3000}"
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
# Colors for output
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
RED='\033[0;31m'
|
|
NC='\033[0m' # No Color
|
|
|
|
# Cleanup function
|
|
cleanup() {
|
|
if [ -n "$SERVER_PID" ]; then
|
|
echo -e "\n${YELLOW}Stopping OAuth2 test server...${NC}"
|
|
kill "$SERVER_PID" 2>/dev/null || true
|
|
fi
|
|
}
|
|
|
|
trap cleanup EXIT
|
|
|
|
# Check if app credentials are set
|
|
if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ]; then
|
|
echo -e "${RED}ERROR: CLIENT_ID and CLIENT_SECRET must be set${NC}"
|
|
echo "Run: eval \$(./setup-test-app.sh) first"
|
|
exit 1
|
|
fi
|
|
|
|
# Check if Go is installed
|
|
if ! command -v go &>/dev/null; then
|
|
echo -e "${RED}ERROR: Go is not installed${NC}"
|
|
echo "Please install Go to use the OAuth2 test server"
|
|
exit 1
|
|
fi
|
|
|
|
# Generate PKCE parameters
|
|
CODE_VERIFIER=$(openssl rand -base64 32 | tr '+/' '-_' | tr -d '=')
|
|
export CODE_VERIFIER
|
|
CODE_CHALLENGE=$(echo -n "$CODE_VERIFIER" | openssl dgst -sha256 -binary | base64 | tr -d "=" | tr '+/' '-_')
|
|
export CODE_CHALLENGE
|
|
|
|
# Generate state parameter
|
|
STATE=$(openssl rand -hex 16)
|
|
export STATE
|
|
|
|
# Export required environment variables
|
|
export CLIENT_ID
|
|
export CLIENT_SECRET
|
|
export BASE_URL
|
|
|
|
# Start the OAuth2 test server
|
|
echo -e "${YELLOW}Starting OAuth2 test server on http://localhost:9876${NC}"
|
|
go run "$SCRIPT_DIR/oauth2-test-server.go" &
|
|
SERVER_PID=$!
|
|
|
|
# Wait for server to start
|
|
sleep 1
|
|
|
|
# Build authorization URL
|
|
AUTH_URL="$BASE_URL/oauth2/authorize?client_id=$CLIENT_ID&response_type=code&redirect_uri=http://localhost:9876/callback&state=$STATE&code_challenge=$CODE_CHALLENGE&code_challenge_method=S256"
|
|
|
|
echo ""
|
|
echo -e "${GREEN}=== Manual OAuth2 Flow Test ===${NC}"
|
|
echo ""
|
|
echo "1. Open this URL in your browser:"
|
|
echo -e "${YELLOW}$AUTH_URL${NC}"
|
|
echo ""
|
|
echo "2. Log in if required, then click 'Allow' to authorize the application"
|
|
echo ""
|
|
echo "3. You'll be automatically redirected to the test server"
|
|
echo " The server will handle the token exchange and display the results"
|
|
echo ""
|
|
echo -e "${YELLOW}Waiting for OAuth2 callback...${NC}"
|
|
echo "Press Ctrl+C to cancel"
|
|
echo ""
|
|
|
|
# Wait for the server process
|
|
wait $SERVER_PID
|