Jul 20, 2025 · Jul 20, 2025
diff --git a/coderd/coderdtest/oidctest/helper.go b/coderd/coderdtest/oidctest/helper.go
 return "", xerrors.Errorf("failed to create auth request: %w", err)
 }

 expCode := http.StatusTemporaryRedirect
 resp, err := doRequest(r)
 if err != nil {
 return "", xerrors.Errorf("request: %w", err)
 }
 defer resp.Body.Close()

 if resp.StatusCode != expCode {
 // Accept both 302 (Found) and 307 (Temporary Redirect) as valid OAuth2 redirects
 if resp.StatusCode != http.StatusFound && resp.StatusCode != http.StatusTemporaryRedirect {
 return "", codersdk.ReadBodyAsError(resp)
 }

diff --git a/coderd/oauth2.go b/coderd/oauth2.go
 // @Success 200 "Returns HTML authorization page"
 // @Router /oauth2/authorize [get]
 func (api *API) getOAuth2ProviderAppAuthorize() http.HandlerFunc {
 return oauth2provider.ShowAuthorizePage(api.Database, api.AccessURL)
 return oauth2provider.ShowAuthorizePage(api.AccessURL)
 }

 // @Summary OAuth2 authorization request (POST - process authorization).
 // @Success 302 "Returns redirect with authorization code"
 // @Router /oauth2/authorize [post]
 func (api *API) postOAuth2ProviderAppAuthorize() http.HandlerFunc {
 return oauth2provider.ProcessAuthorize(api.Database, api.AccessURL)
 return oauth2provider.ProcessAuthorize(api.Database)
 }

 // @Summary OAuth2 token exchange.
diff --git a/coderd/oauth2provider/authorize.go b/coderd/oauth2provider/authorize.go
 "github.com/coder/coder/v2/coderd/httpapi"
 "github.com/coder/coder/v2/coderd/httpmw"
 "github.com/coder/coder/v2/codersdk"
 "github.com/coder/coder/v2/site"
 )

 type authorizeParams struct {
 }

 // ShowAuthorizePage handles GET /oauth2/authorize requests to display the HTML authorization page.
 // It uses authorizeMW which intercepts GET requests to show the authorization form.
 func ShowAuthorizePage(db database.Store, accessURL *url.URL) http.HandlerFunc {
 handler := authorizeMW(accessURL)(ProcessAuthorize(db, accessURL))
 return handler.ServeHTTP
 func ShowAuthorizePage(accessURL *url.URL) http.HandlerFunc {
 return func(rw http.ResponseWriter, r *http.Request) {
 app := httpmw.OAuth2ProviderApp(r)
 ua := httpmw.UserAuthorization(r.Context())

 callbackURL, err := url.Parse(app.CallbackURL)
 if err != nil {
 site.RenderStaticErrorPage(rw, r, site.ErrorPageData{Status: http.StatusInternalServerError, HideStatus: false, Title: "Internal Server Error", Description: err.Error(), RetryEnabled: false, DashboardURL: accessURL.String(), Warnings: nil})
 return
 }

 params, validationErrs, err := extractAuthorizeParams(r, callbackURL)
 if err != nil {
 errStr := make([]string, len(validationErrs))
 for i, err := range validationErrs {
 errStr[i] = err.Detail
 }
 site.RenderStaticErrorPage(rw, r, site.ErrorPageData{Status: http.StatusBadRequest, HideStatus: false, Title: "Invalid Query Parameters", Description: "One or more query parameters are missing or invalid.", RetryEnabled: false, DashboardURL: accessURL.String(), Warnings: errStr})
 return
 }

 cancel := params.redirectURL
 cancelQuery := params.redirectURL.Query()
 cancelQuery.Add("error", "access_denied")
 cancel.RawQuery = cancelQuery.Encode()

 site.RenderOAuthAllowPage(rw, r, site.RenderOAuthAllowData{
 AppIcon:     app.Icon,
 AppName:     app.Name,
 CancelURI:   cancel.String(),
 RedirectURI: r.URL.String(),
 Username:    ua.FriendlyName,
 })
 }
 }

 // ProcessAuthorize handles POST /oauth2/authorize requests to process the user's authorization decision
 // and generate an authorization code. GET requests are handled by authorizeMW.
 func ProcessAuthorize(db database.Store, accessURL *url.URL) http.HandlerFunc {
 handler := func(rw http.ResponseWriter, r *http.Request) {
 // and generate an authorization code.
 func ProcessAuthorize(db database.Store) http.HandlerFunc {
 return func(rw http.ResponseWriter, r *http.Request) {
 ctx := r.Context()
 apiKey := httpmw.APIKey(r)
 app := httpmw.OAuth2ProviderApp(r)
 }
 params.redirectURL.RawQuery = newQuery.Encode()

 http.Redirect(rw, r, params.redirectURL.String(), http.StatusTemporaryRedirect)
 // (ThomasK33): Use a 302 redirect as some (external) OAuth 2 apps and browsers
 // do not work with the 307.
 http.Redirect(rw, r, params.redirectURL.String(), http.StatusFound)
 }

 // Always wrap with its custom mw.
 return authorizeMW(accessURL)(http.HandlerFunc(handler)).ServeHTTP
 }
diff --git a/coderd/oauth2provider/middleware.go b/coderd/oauth2provider/middleware.go
Original file line number	Diff line number	Diff line change
Expand Up		@@ -132,14 +132,14 @@ func OAuth2GetCode(rawAuthURL string, doRequest func(req http.Request) (http.R
		return "", xerrors.Errorf("failed to create auth request: %w", err)
		}

		expCode := http.StatusTemporaryRedirect
		resp, err := doRequest(r)
		if err != nil {
		return "", xerrors.Errorf("request: %w", err)
		}
		defer resp.Body.Close()

		if resp.StatusCode != expCode {
		// Accept both 302 (Found) and 307 (Temporary Redirect) as valid OAuth2 redirects
		if resp.StatusCode != http.StatusFound && resp.StatusCode != http.StatusTemporaryRedirect {
		return "", codersdk.ReadBodyAsError(resp)
		}

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -116,7 +116,7 @@ func (api *API) deleteOAuth2ProviderAppSecret() http.HandlerFunc {
		// @Success 200 "Returns HTML authorization page"
		// @Router /oauth2/authorize [get]
		func (api *API) getOAuth2ProviderAppAuthorize() http.HandlerFunc {
		return oauth2provider.ShowAuthorizePage(api.Database, api.AccessURL)
		return oauth2provider.ShowAuthorizePage(api.AccessURL)
		}

		// @Summary OAuth2 authorization request (POST - process authorization).
Expand All		@@ -131,7 +131,7 @@ func (api *API) getOAuth2ProviderAppAuthorize() http.HandlerFunc {
		// @Success 302 "Returns redirect with authorization code"
		// @Router /oauth2/authorize [post]
		func (api *API) postOAuth2ProviderAppAuthorize() http.HandlerFunc {
		return oauth2provider.ProcessAuthorize(api.Database, api.AccessURL)
		return oauth2provider.ProcessAuthorize(api.Database)
		}

		// @Summary OAuth2 token exchange.
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -16,6 +16,7 @@ import (
		"github.com/coder/coder/v2/coderd/httpapi"
		"github.com/coder/coder/v2/coderd/httpmw"
		"github.com/coder/coder/v2/codersdk"
		"github.com/coder/coder/v2/site"
		)

		type authorizeParams struct {
Expand DownExpand Up		@@ -67,16 +68,46 @@ func extractAuthorizeParams(r http.Request, callbackURL url.URL) (authorizePar
		}

		// ShowAuthorizePage handles GET /oauth2/authorize requests to display the HTML authorization page.
		// It uses authorizeMW which intercepts GET requests to show the authorization form.
		func ShowAuthorizePage(db database.Store, accessURL *url.URL) http.HandlerFunc {
		handler := authorizeMW(accessURL)(ProcessAuthorize(db, accessURL))
		return handler.ServeHTTP
		func ShowAuthorizePage(accessURL *url.URL) http.HandlerFunc {
		return func(rw http.ResponseWriter, r *http.Request) {
		app := httpmw.OAuth2ProviderApp(r)
		ua := httpmw.UserAuthorization(r.Context())

		callbackURL, err := url.Parse(app.CallbackURL)
		if err != nil {
		site.RenderStaticErrorPage(rw, r, site.ErrorPageData{Status: http.StatusInternalServerError, HideStatus: false, Title: "Internal Server Error", Description: err.Error(), RetryEnabled: false, DashboardURL: accessURL.String(), Warnings: nil})
		return
		}

		params, validationErrs, err := extractAuthorizeParams(r, callbackURL)
		if err != nil {
		errStr := make([]string, len(validationErrs))
		for i, err := range validationErrs {
		errStr[i] = err.Detail
		}
		site.RenderStaticErrorPage(rw, r, site.ErrorPageData{Status: http.StatusBadRequest, HideStatus: false, Title: "Invalid Query Parameters", Description: "One or more query parameters are missing or invalid.", RetryEnabled: false, DashboardURL: accessURL.String(), Warnings: errStr})
		return
		}

		cancel := params.redirectURL
		cancelQuery := params.redirectURL.Query()
		cancelQuery.Add("error", "access_denied")
		cancel.RawQuery = cancelQuery.Encode()

		site.RenderOAuthAllowPage(rw, r, site.RenderOAuthAllowData{
		AppIcon: app.Icon,
		AppName: app.Name,
		CancelURI: cancel.String(),
		RedirectURI: r.URL.String(),
		Username: ua.FriendlyName,
		})
		}
		}

		// ProcessAuthorize handles POST /oauth2/authorize requests to process the user's authorization decision
		// and generate an authorization code. GET requests are handled by authorizeMW.
		func ProcessAuthorize(db database.Store, accessURL *url.URL) http.HandlerFunc {
		handler := func(rw http.ResponseWriter, r *http.Request) {
		// and generate an authorization code.
		func ProcessAuthorize(db database.Store) http.HandlerFunc {
		return func(rw http.ResponseWriter, r *http.Request) {
		ctx := r.Context()
		apiKey := httpmw.APIKey(r)
		app := httpmw.OAuth2ProviderApp(r)
Expand DownExpand Up		@@ -159,9 +190,8 @@ func ProcessAuthorize(db database.Store, accessURL *url.URL) http.HandlerFunc {
		}
		params.redirectURL.RawQuery = newQuery.Encode()

		http.Redirect(rw, r, params.redirectURL.String(), http.StatusTemporaryRedirect)
		// (ThomasK33): Use a 302 redirect as some (external) OAuth 2 apps and browsers
		// do not work with the 307.
		http.Redirect(rw, r, params.redirectURL.String(), http.StatusFound)
		}

		// Always wrap with its custom mw.
		return authorizeMW(accessURL)(http.HandlerFunc(handler)).ServeHTTP
		}