mirror of
https://github.com/juanfont/headscale.git
synced 2026-07-17 16:36:02 +00:00
622e08f5e6
Some checks are pending
Build / build-nix (push) Waiting to run
Build / build-cross (GOARCH=amd64 GOOS=darwin) (push) Waiting to run
Build / build-cross (GOARCH=amd64 GOOS=linux) (push) Waiting to run
Build / build-cross (GOARCH=arm64 GOOS=darwin) (push) Waiting to run
Build / build-cross (GOARCH=arm64 GOOS=linux) (push) Waiting to run
Check Generated Files / check-generated (push) Waiting to run
Build (main) / container (push) Waiting to run
Build (main) / binaries (amd64, darwin) (push) Waiting to run
Build (main) / binaries (amd64, linux) (push) Waiting to run
Build (main) / binaries (arm64, darwin) (push) Waiting to run
Build (main) / binaries (arm64, linux) (push) Waiting to run
Nix Flake Checks / build (push) Waiting to run
Nix Flake Checks / gotest (push) Waiting to run
Nix Flake Checks / golangci-lint (push) Waiting to run
Nix Flake Checks / formatting (push) Waiting to run
NixOS Module Tests / nix-module-check (push) Waiting to run
Server Tests / servertest (push) Waiting to run
Defence-in-depth fixes to the OIDC login flow. Set the state/nonce cookie Secure flag from the configured server_url scheme rather than req.TLS, so the cookies stay Secure behind a TLS-terminating reverse proxy where the proxy-to-Headscale hop is plain HTTP. Deriving it from config avoids trusting a spoofable X-Forwarded-Proto header. Make the OIDC state single-use: consume it from the cache on the callback and clear the state/nonce cookies once validated, so a replayed callback cannot resolve the same session and the cookies do not linger until expiry. Bound OIDC discovery to the caller's context so a slow or unreachable issuer fails startup within the timeout instead of hanging, and validate the issuer URL and required client_id/client_secret at config load so an unworkable setup fails fast. |
||
|---|---|---|
| .. | ||
| api | ||
| assets | ||
| capver | ||
| db | ||
| derp | ||
| dns | ||
| mapper | ||
| policy | ||
| scope | ||
| servertest | ||
| state | ||
| templates | ||
| testdata/apiv1_golden | ||
| types | ||
| util | ||
| apiv1_apikeys_test.go | ||
| apiv1_auth_test.go | ||
| apiv1_authmw_test.go | ||
| apiv1_client_test.go | ||
| apiv1_harness_test.go | ||
| apiv1_health_test.go | ||
| apiv1_nodes_test.go | ||
| apiv1_policy_test.go | ||
| apiv1_preauthkeys_test.go | ||
| apiv1_socket_test.go | ||
| apiv1_users_test.go | ||
| apiv2_acl_test.go | ||
| apiv2_devices_test.go | ||
| apiv2_keys_test.go | ||
| apiv2_oauth_matrix_test.go | ||
| apiv2_oauth_test.go | ||
| apiv2_settings_test.go | ||
| apiv2_users_test.go | ||
| app.go | ||
| app_test.go | ||
| auth.go | ||
| auth_tags_test.go | ||
| auth_test.go | ||
| debug.go | ||
| handlers.go | ||
| handlers_test.go | ||
| metrics.go | ||
| noise.go | ||
| noise_test.go | ||
| oidc.go | ||
| oidc_confirm_test.go | ||
| oidc_cookiename_test.go | ||
| oidc_template_test.go | ||
| oidc_test.go | ||
| platform_config.go | ||
| platform_config_test.go | ||
| poll.go | ||
| poll_test.go | ||
| realip.go | ||
| realip_test.go | ||
| tailsql.go | ||
| templates_consistency_test.go | ||