From 5aeeff98d0130f6e075b42e6050d0c02de8b9a94 Mon Sep 17 00:00:00 2001 From: Fredrik Ekre Date: Mon, 22 Jun 2026 13:12:02 +0200 Subject: [PATCH] oidc: fix NewProvider ignoring caller context timeout NewAuthProviderOIDC received a context with a 30-second timeout from its caller, but immediately discarded it by passing context.Background() to oidc.NewProvider. This caused both `headscale serve` and `headscale configtest` to hang indefinitely if the OIDC issuer was unreachable, rather than timing out and returning an error. Fix by passing the caller's ctx to oidc.NewProvider and remove the nolint:contextcheck annotation that was suppressing the linter warning about this bug. The annotation was introduced in ce580f82 as part of a bulk lint-suppression pass without addressing the underlying issue. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- hscontrol/oidc.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hscontrol/oidc.go b/hscontrol/oidc.go index fa2c3809..d432a052 100644 --- a/hscontrol/oidc.go +++ b/hscontrol/oidc.go @@ -87,7 +87,7 @@ func NewAuthProviderOIDC( ) (*AuthProviderOIDC, error) { var err error // grab oidc config if it hasn't been already - oidcProvider, err := oidc.NewProvider(context.Background(), cfg.Issuer) //nolint:contextcheck + oidcProvider, err := oidc.NewProvider(ctx, cfg.Issuer) if err != nil { return nil, fmt.Errorf("creating OIDC provider from issuer config: %w", err) }