5 Commits

Author	SHA1	Message	Date
Kristoffer Dalby	cbb9357d1c	oidc: harden reloadable confirmation flow ... Updates #3365 (cherry picked from commit 10dd38fcef)	2026-09-23 21:19:22 +02:00
Kristoffer Dalby	2b28f5756b	oidc: harden callback CSRF cookies, state reuse, and issuer config ... Defence-in-depth fixes to the OIDC login flow. Set the state/nonce cookie Secure flag from the configured server_url scheme rather than req.TLS, so the cookies stay Secure behind a TLS-terminating reverse proxy where the proxy-to-Headscale hop is plain HTTP. Deriving it from config avoids trusting a spoofable X-Forwarded-Proto header. Make the OIDC state single-use: consume it from the cache on the callback and clear the state/nonce cookies once validated, so a replayed callback cannot resolve the same session and the cookies do not linger until expiry. Bound OIDC discovery to the caller's context so a slow or unreachable issuer fails startup within the timeout instead of hanging, and validate the issuer URL and required client_id/client_secret at config load so an unworkable setup fails fast. (cherry picked from commit 622e08f5e6)	2026-09-23 21:19:22 +02:00
Kristoffer Dalby	88044f43ff	hscontrol: satisfy golangci-lint on changed lines ... Sentinel ErrNodeKeyInUse (err113); key the visible-peer set by tailcfg.NodeID to drop an int64->uint64 cast (gosec G115); NewRequestWithContext (noctx); wsl.	2026-06-09 15:21:18 +02:00
Kristoffer Dalby	0fdff0c79b	oidc: set SameSite=Lax on state/nonce CSRF cookies ... setCSRFCookie set no SameSite attribute despite a nolint comment claiming it did, so the OIDC state/nonce cookies relied on the browser default. Set Lax explicitly (Strict would drop the cookie on the cross-site IdP->callback navigation and break login), hardening browsers that do not default to Lax against OIDC login CSRF.	2026-06-09 15:21:18 +02:00
Justin Angel	7be20912f5	oidc: make email verification configurable ... Co-authored-by: Kristoffer Dalby <kristoffer@tailscale.com>	2025-12-18 11:42:32 +00:00