dev_agentandClaude Opus 5.5
e8dafda534
Address review findings on a10b24c:
- F1: the OIDC issuer and the discovered authorization, token and JWKS
endpoints must be https://; plain http:// is allowed only for the
loopback hosts localhost, 127.0.0.1 and [::1]. Config rejects a remote
http:// issuer at startup; auth.New rejects a discovered remote http://
endpoint, naming it, before it is used.
- F2: a failed code exchange is reduced to a fixed category plus the HTTP
status; the token endpoint's body and error_description are never logged
or wrapped into the returned error.
- F3: MEALQUEST_PUBLIC_URL must be https:// unless its host is loopback,
so the Secure login cookie is always sent back on the callback.
The rule lives once, in internal/secureurl.Check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
939 B
Go
41 lines
939 B
Go
package secureurl
|
|
|
|
import (
|
|
"net/url"
|
|
"testing"
|
|
)
|
|
|
|
func TestCheck(t *testing.T) {
|
|
t.Parallel()
|
|
tests := []struct {
|
|
raw string
|
|
ok bool
|
|
}{
|
|
{"https://meals.example.com", true},
|
|
{"https://auth.example.com/application/o/mealquest/", true},
|
|
{"https://192.0.2.10:8443", true},
|
|
{"http://localhost:8080", true},
|
|
{"http://LOCALHOST:8080", true},
|
|
{"http://127.0.0.1:8080/path", true},
|
|
{"http://[::1]:8080", true},
|
|
{"http://[::1]", true},
|
|
{"http://meals.example.com", false},
|
|
{"http://192.0.2.10", false},
|
|
{"http://127.0.0.2", false},
|
|
{"http://localhost.example.com", false},
|
|
{"http://0.0.0.0:8080", false},
|
|
{"ftp://localhost", false},
|
|
{"https://", false},
|
|
{"meals.example.com", false},
|
|
}
|
|
for _, tc := range tests {
|
|
u, err := url.Parse(tc.raw)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Check(u); (err == nil) != tc.ok {
|
|
t.Errorf("Check(%q) error = %v, want ok=%v", tc.raw, err, tc.ok)
|
|
}
|
|
}
|
|
}
|