mathias/tapir
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(oidc): echo caller subject in the 403 to bootstrap the allowlist
CI / Lint / Test / Vet (push) Successful in 9s
Details
CI / Build & Import (push) Successful in 9s
Details
CI / Mirror to GitHub (push) Failing after 2s
Details

Browse Source 
First-login chicken-egg: TAPIR_ALLOWED_SUBJECT can't be known until the user
logs in once, but the allowlist gates login. Echo the (non-secret, opaque)
subject in the forbidden response so the maintainer can read it in the browser,
set the 1P item, and lock the allowlist.
This commit is contained in:
mathias
2026-06-03 08:53:06 +02:00
parent c33cba3555
commit c9863e9633
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/oidc/oidc.go
+4 -2
View File
@@ -242,9 +242,11 @@ func (d *DexAuth) handleCallback(w http.ResponseWriter, r *http.Request) {
return return
} }
// Single-user authz: only the allowlisted subject may sign in. // Single-user authz: only the allowlisted subject may sign in. On mismatch
// we echo the caller's own subject (an opaque id, not a secret) so the
// maintainer can bootstrap TAPIR_ALLOWED_SUBJECT on first login.
if idToken.Subject != d.cfg.AllowedSubject { if idToken.Subject != d.cfg.AllowedSubject {
http.Error(w, "forbidden", http.StatusForbidden) http.Error(w, "forbidden — not the allowlisted subject. your subject is: "+idToken.Subject, http.StatusForbidden)
return return
} }