From 4b56c77ddb6e3d16fa2107569c9ae31181d657f3 Mon Sep 17 00:00:00 2001 From: Trong Huu Nguyen Date: Tue, 28 Jul 2026 11:10:12 +0200 Subject: [PATCH] fix(openid/client): refuse redirects for credential-bearing requests Requests to the token and pushed authorization endpoints carry the client secret or a signed client assertion. Following a redirect would forward those credentials to a host the provider never advertised. --- pkg/openid/client/client.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkg/openid/client/client.go b/pkg/openid/client/client.go index 9a89bf2..78dab51 100644 --- a/pkg/openid/client/client.go +++ b/pkg/openid/client/client.go @@ -64,6 +64,11 @@ func NewClient(cfg openidconfig.Config, jwksProvider JwksProvider) *Client { httpClient := &http.Client{ Timeout: time.Second * 10, Transport: httpinternal.Transport(), + // requests to the token and pushed authorization endpoints carry client credentials, + // so following a redirect would forward them to a host the provider did not advertise. + CheckRedirect: func(req *http.Request, via []*http.Request) error { + return fmt.Errorf("refusing to follow redirect to %q", req.URL.Redacted()) + }, } return &Client{ @@ -209,6 +214,9 @@ func (c *Client) oauthPostRequest(ctx context.Context, endpoint string, payload } r.Header.Set("Content-Type", "application/x-www-form-urlencoded") + // #nosec G704 -- the endpoint comes from the provider's metadata document, which is + // fetched from the operator-configured well-known URL at startup; redirects are refused + // so credentials cannot be forwarded elsewhere resp, err := c.httpClient.Do(r) if err != nil { return nil, fmt.Errorf("performing request: %w", err)