lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): support form_post OIDC callback and add POST /auth/callback route

Browse source
This commit is contained in:
Claus Lohmar 2026-06-14 14:43:12 +00:00
parent 6f65d25c3f
commit 6873e474be
2 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/core/auth/oidc.go
View file

@ -73,7 +73,12 @@ func (h *OIDCHandler) Callback(w http.ResponseWriter, r *http.Request) {
} }
// Verify state parameter matches // Verify state parameter matches
// Get state from URL query (GET) or form body (POST form_post mode)
stateParam := r.URL.Query().Get("state") stateParam := r.URL.Query().Get("state")
if stateParam == "" {
r.ParseForm()
stateParam = r.Form.Get("state")
}
if stateParam == "" || stateParam != stateCookie.Value { if stateParam == "" || stateParam != stateCookie.Value {
http.Error(w, "state mismatch", http.StatusForbidden) http.Error(w, "state mismatch", http.StatusForbidden)
return return
@ -88,7 +93,11 @@ func (h *OIDCHandler) Callback(w http.ResponseWriter, r *http.Request) {
HttpOnly: true, HttpOnly: true,
}) })
// Get code from URL query (GET) or form body (POST form_post mode)
code := r.URL.Query().Get("code") code := r.URL.Query().Get("code")
if code == "" {
code = r.Form.Get("code")
}
if code == "" { if code == "" {
http.Error(w, "missing authorization code", http.StatusBadRequest) http.Error(w, "missing authorization code", http.StatusBadRequest)
return return

1
src/main.go
View file

@ -101,6 +101,7 @@ func main() {
// --- OIDC auth routes (public) --- // --- OIDC auth routes (public) ---
mux.HandleFunc("GET /auth/login", oidcHandler.LoginRedirect) mux.HandleFunc("GET /auth/login", oidcHandler.LoginRedirect)
mux.HandleFunc("GET /auth/callback", oidcHandler.Callback) mux.HandleFunc("GET /auth/callback", oidcHandler.Callback)
mux.HandleFunc("POST /auth/callback", oidcHandler.Callback)
mux.HandleFunc("GET /auth/logout", func(w http.ResponseWriter, r *http.Request) { mux.HandleFunc("GET /auth/logout", func(w http.ResponseWriter, r *http.Request) {
// Clear session cookie // Clear session cookie
http.SetCookie(w, &http.Cookie{ http.SetCookie(w, &http.Cookie{