GitHub sign-in fails when the OAuth App has more than one redirect URI

Abierto
  • ¿Algo no está bien?
#643 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
55/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github, rust
Área
authentication

Línea de trabajo

Read login_handler and callback_response in src/web/auth.rs, then trace how the OAuth redirect URI and state cookie are built and validated. Reproduce the flow with two registered callback URIs and compare the callback address with the sign-in origin. Done when sign-in returns to the originating address and the callback accepts its state.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Observed behavior

GitHub sign-in fails with {"error":"Login state is missing or expired."} when the server is reached at an address other than the first redirect URI registered on the OAuth App. With http://127.0.0.1:3000/api/callback registered first and a tunnel's https://<name>.trycloudflare.com/api/callback added second, signing in from the tunnel address failed this way. Signing in from the tunnel worked once the tunnel's callback was the only redirect URI on the app.

Expected behavior

Signing in returns to the address the sign-in started from, as long as that address's callback is registered on the OAuth App.

Reproduction
  1. Register a GitHub OAuth App with two redirect URIs, http://127.0.0.1:3000/api/callback first and a second origin's /api/callback after it. GitHub's OAuth App settings now accept up to ten.
  2. Set GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET and SESSION_SECRET, run cargo run -- web, and expose port 3000 on the second origin (I used cloudflared tunnel --url http://127.0.0.1:3000).
  3. Open /peer-lobby on the second origin and press Sign in with GitHub, then Authorize.
  4. The page shows {"error":"Login state is missing or expired."}.
CodeTrial version

codetrial 0.1.0 (5e00eab), built from source on Windows 11. The working tree had uncommitted changes in desktop/, src/config.rs, src/launch.rs and src/web/setup_edit.rs, none of them in the sign-in path.

Initial analysis
  • Path: login_handler in src/web/auth.rs:127 (at 5e00eab) builds the authorize URL as {oauth_base}/login/oauth/authorize?client_id=...&state=...&scope=... with no redirect_uri. The state cookie it sets belongs to the origin the request came in on.
  • Evidence: the authorize URL in the browser carried only client_id, state and scope. Without redirect_uri, GitHub redirects to the app's default callback, which for an app with several redirect URIs is the first one. callback_response (src/web/auth.rs:292) then runs on 127.0.0.1, which never received the state cookie, and returns the 401 above.
  • Hypothesis: the redirect landed on http://127.0.0.1:3000/api/callback. I did not capture the address bar after the failure; repeating step 3 and reading it would confirm or refute this.

Two directions, not yet compared against the code: send redirect_uri built from the request's origin, which needs the Host the server already accepts through CODETRIAL_ALLOWED_HOSTS and the proxy settings; or keep the single-callback design and say in the docs and in the error that the app must have exactly one redirect URI, for the origin users sign in from.

Sanitized evidence
{"error":"Login state is missing or expired."}
  • I removed credentials, session tokens, candidate recordings, and personal interview content from this public report.
Lenguaje dominante
Rust
Estrellas
228
Forks
150
Merge medio
1 d 3 h
PR fusionados (30 d)
230

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de sysprog21/codetrial

Todos los issues de sysprog21/codetrial

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.