6 Commits

Include renames

Author	SHA1	Message	Date
Kristoffer Dalby	10dd38fcef	oidc: harden reloadable confirmation flow ... Updates #3365	2026-09-09 19:01:43 +02:00
Kristoffer Dalby	622e08f5e6	oidc: harden callback CSRF cookies, state reuse, and issuer config ... Defence-in-depth fixes to the OIDC login flow. Set the state/nonce cookie Secure flag from the configured server_url scheme rather than req.TLS, so the cookies stay Secure behind a TLS-terminating reverse proxy where the proxy-to-Headscale hop is plain HTTP. Deriving it from config avoids trusting a spoofable X-Forwarded-Proto header. Make the OIDC state single-use: consume it from the cache on the callback and clear the state/nonce cookies once validated, so a replayed callback cannot resolve the same session and the cookies do not linger until expiry. Bound OIDC discovery to the caller's context so a slow or unreachable issuer fails startup within the timeout instead of hanging, and validate the issuer URL and required client_id/client_secret at config load so an unworkable setup fails fast.	2026-06-26 09:18:06 +02:00
Kristoffer Dalby	8f314797ce	all: fix full-tree golangci-lint findings ... The new full-tree golangci-lint check reports issues the --new-from-rev diff lint hid: nine wsl_v5 whitespace gaps, a prealloc, and an unparam (setCSRFCookie never errored, so drop the return and update callers). gocyclo on the central UpdateNodeFromMapRequest and an SA1019 NetMap deprecation in an integration helper are suppressed with reasons.	2026-06-20 21:08:01 +02:00
Kristoffer Dalby	88044f43ff	hscontrol: satisfy golangci-lint on changed lines ... Sentinel ErrNodeKeyInUse (err113); key the visible-peer set by tailcfg.NodeID to drop an int64->uint64 cast (gosec G115); NewRequestWithContext (noctx); wsl.	2026-06-09 15:21:18 +02:00
Kristoffer Dalby	0fdff0c79b	oidc: set SameSite=Lax on state/nonce CSRF cookies ... setCSRFCookie set no SameSite attribute despite a nolint comment claiming it did, so the OIDC state/nonce cookies relied on the browser default. Set Lax explicitly (Strict would drop the cookie on the cross-site IdP->callback navigation and break login), hardening browsers that do not default to Lax against OIDC login CSRF.	2026-06-09 15:21:18 +02:00
Justin AngelandKristoffer Dalby	7be20912f5	oidc: make email verification configurable ... Co-authored-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-12-18 11:42:32 +00:00