Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit7eb2bec

Browse files
authored
fix: redirect from oauth2 authorization page (#12241)
At the moment it just says "you are not authorized", but we want toautomatically redirect to the login page.
1 parentc3a7b13 commit7eb2bec

File tree

3 files changed

+30
-15
lines changed

3 files changed

+30
-15
lines changed

‎enterprise/coderd/coderd.go

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,15 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
153153
Optional:false,
154154
SessionTokenFunc:nil,// Default behavior
155155
})
156+
// Same as above but it redirects to the login page.
157+
apiKeyMiddlewareRedirect:=httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
158+
DB:options.Database,
159+
OAuth2Configs:oauthConfigs,
160+
RedirectToLogin:true,
161+
DisableSessionExpiryRefresh:options.DeploymentValues.DisableSessionExpiryRefresh.Value(),
162+
Optional:false,
163+
SessionTokenFunc:nil,// Default behavior
164+
})
156165
apiKeyMiddlewareOptional:=httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
157166
DB:options.Database,
158167
OAuth2Configs:oauthConfigs,
@@ -168,25 +177,30 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
168177
}
169178

170179
api.AGPL.RootHandler.Group(func(r chi.Router) {
171-
//Oauth2 linking routes do not make sense under the /api/v2 path.
180+
//OAuth2 linking routes do not make sense under the /api/v2 path.
172181
r.Route("/oauth2",func(r chi.Router) {
173182
r.Use(
174183
api.oAuth2ProviderMiddleware,
175184
// Fetch the app as system because in the /tokens route there will be no
176185
// authenticated user.
177186
httpmw.AsAuthzSystem(httpmw.ExtractOAuth2ProviderApp(options.Database)),
178187
)
179-
r.Group(func(r chi.Router) {
180-
r.Use(apiKeyMiddleware)
181-
r.Get("/authorize",api.postOAuth2ProviderAppAuthorize())
182-
// DELETE on /tokens is not part of the OAuth2 spec. It is our own
183-
// route used to revoke permissions from an application. It is here for
184-
// parity with POST on /tokens.
185-
r.Delete("/tokens",api.deleteOAuth2ProviderAppTokens())
188+
r.Route("/authorize",func(r chi.Router) {
189+
r.Use(apiKeyMiddlewareRedirect)
190+
r.Get("/",api.getOAuth2ProviderAppAuthorize())
191+
})
192+
r.Route("/tokens",func(r chi.Router) {
193+
r.Group(func(r chi.Router) {
194+
r.Use(apiKeyMiddleware)
195+
// DELETE on /tokens is not part of the OAuth2 spec. It is our own
196+
// route used to revoke permissions from an application. It is here for
197+
// parity with POST on /tokens.
198+
r.Delete("/",api.deleteOAuth2ProviderAppTokens())
199+
})
200+
// The POST /tokens endpoint will be called from an unauthorized client so we
201+
// cannot require an API key.
202+
r.Post("/",api.postOAuth2ProviderAppToken())
186203
})
187-
// The /tokens endpoint will be called from an unauthorized client so we
188-
// cannot require an API key.
189-
r.Post("/tokens",api.postOAuth2ProviderAppToken())
190204
})
191205
})
192206

‎enterprise/coderd/oauth2.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,7 @@ func (api *API) deleteOAuth2ProviderAppSecret(rw http.ResponseWriter, r *http.Re
292292
// @Param scope query string false "Token scopes (currently ignored)"
293293
// @Success 302
294294
// @Router /oauth2/authorize [post]
295-
func (api*API)postOAuth2ProviderAppAuthorize() http.HandlerFunc {
295+
func (api*API)getOAuth2ProviderAppAuthorize() http.HandlerFunc {
296296
returnidentityprovider.Authorize(api.Database,api.AccessURL)
297297
}
298298

‎site/src/pages/LoginPage/LoginPage.tsx

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@ export const LoginPage: FC = () => {
2525
// If the redirect is going to a workspace application, and we
2626
// are missing authentication, then we need to change the href location
2727
// to trigger a HTTP request. This allows the BE to generate the auth
28-
// cookie required.
28+
// cookie required. Similarly for the OAuth2 exchange as the authorization
29+
// page is served by the backend.
2930
// If no redirect is present, then ignore this branched logic.
3031
if(redirectTo!==""&&redirectTo!=="/"){
3132
try{
@@ -39,8 +40,8 @@ export const LoginPage: FC = () => {
3940
}catch{
4041
// Do nothing
4142
}
42-
// Path based apps.
43-
if(redirectTo.includes("/apps/")){
43+
// Path based apps and OAuth2.
44+
if(redirectTo.includes("/apps/")||redirectTo.includes("/oauth2/")){
4445
window.location.href=redirectTo;
4546
returnnull;
4647
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp