GitHub sign-in fails when the OAuth App has more than one redirect URI

Aberta
  • Algo errado?
#643 1 comentário 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
3/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
55/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
github, rust
Domínio
authentication

Direção de pesquisa

Read login_handler and callback_response in src/web/auth.rs, then trace how the OAuth redirect URI and state cookie are built and validated. Reproduce the flow with two registered callback URIs and compare the callback address with the sign-in origin. Done when sign-in returns to the originating address and the callback accepts its state.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Observed behavior

GitHub sign-in fails with {"error":"Login state is missing or expired."} when the server is reached at an address other than the first redirect URI registered on the OAuth App. With http://127.0.0.1:3000/api/callback registered first and a tunnel's https://<name>.trycloudflare.com/api/callback added second, signing in from the tunnel address failed this way. Signing in from the tunnel worked once the tunnel's callback was the only redirect URI on the app.

Expected behavior

Signing in returns to the address the sign-in started from, as long as that address's callback is registered on the OAuth App.

Reproduction
  1. Register a GitHub OAuth App with two redirect URIs, http://127.0.0.1:3000/api/callback first and a second origin's /api/callback after it. GitHub's OAuth App settings now accept up to ten.
  2. Set GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET and SESSION_SECRET, run cargo run -- web, and expose port 3000 on the second origin (I used cloudflared tunnel --url http://127.0.0.1:3000).
  3. Open /peer-lobby on the second origin and press Sign in with GitHub, then Authorize.
  4. The page shows {"error":"Login state is missing or expired."}.
CodeTrial version

codetrial 0.1.0 (5e00eab), built from source on Windows 11. The working tree had uncommitted changes in desktop/, src/config.rs, src/launch.rs and src/web/setup_edit.rs, none of them in the sign-in path.

Initial analysis
  • Path: login_handler in src/web/auth.rs:127 (at 5e00eab) builds the authorize URL as {oauth_base}/login/oauth/authorize?client_id=...&state=...&scope=... with no redirect_uri. The state cookie it sets belongs to the origin the request came in on.
  • Evidence: the authorize URL in the browser carried only client_id, state and scope. Without redirect_uri, GitHub redirects to the app's default callback, which for an app with several redirect URIs is the first one. callback_response (src/web/auth.rs:292) then runs on 127.0.0.1, which never received the state cookie, and returns the 401 above.
  • Hypothesis: the redirect landed on http://127.0.0.1:3000/api/callback. I did not capture the address bar after the failure; repeating step 3 and reading it would confirm or refute this.

Two directions, not yet compared against the code: send redirect_uri built from the request's origin, which needs the Host the server already accepts through CODETRIAL_ALLOWED_HOSTS and the proxy settings; or keep the single-callback design and say in the docs and in the error that the app must have exactly one redirect URI, for the origin users sign in from.

Sanitized evidence
{"error":"Login state is missing or expired."}
  • I removed credentials, session tokens, candidate recordings, and personal interview content from this public report.
Linguagem predominante
Rust
Estrelas
228
Forks
150
Merge médio
1d 3h
PRs com merge (30d)
230

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de sysprog21/codetrial

Todas as issues de sysprog21/codetrial

Issues semelhantes

Mais issues de Rust

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.