mirror of
https://github.com/juanfont/headscale.git
synced 2026-07-18 00:45:06 +00:00
622e08f5e6
Some checks are pending
Build / build-nix (push) Waiting to run
Build / build-cross (GOARCH=amd64 GOOS=darwin) (push) Waiting to run
Build / build-cross (GOARCH=amd64 GOOS=linux) (push) Waiting to run
Build / build-cross (GOARCH=arm64 GOOS=darwin) (push) Waiting to run
Build / build-cross (GOARCH=arm64 GOOS=linux) (push) Waiting to run
Check Generated Files / check-generated (push) Waiting to run
Build (main) / container (push) Waiting to run
Build (main) / binaries (amd64, darwin) (push) Waiting to run
Build (main) / binaries (amd64, linux) (push) Waiting to run
Build (main) / binaries (arm64, darwin) (push) Waiting to run
Build (main) / binaries (arm64, linux) (push) Waiting to run
Nix Flake Checks / build (push) Waiting to run
Nix Flake Checks / gotest (push) Waiting to run
Nix Flake Checks / golangci-lint (push) Waiting to run
Nix Flake Checks / formatting (push) Waiting to run
NixOS Module Tests / nix-module-check (push) Waiting to run
Server Tests / servertest (push) Waiting to run
Defence-in-depth fixes to the OIDC login flow. Set the state/nonce cookie Secure flag from the configured server_url scheme rather than req.TLS, so the cookies stay Secure behind a TLS-terminating reverse proxy where the proxy-to-Headscale hop is plain HTTP. Deriving it from config avoids trusting a spoofable X-Forwarded-Proto header. Make the OIDC state single-use: consume it from the cache on the callback and clear the state/nonce cookies once validated, so a replayed callback cannot resolve the same session and the cookies do not linger until expiry. Bound OIDC discovery to the caller's context so a slow or unreachable issuer fails startup within the timeout instead of hanging, and validate the issuer URL and required client_id/client_secret at config load so an unworkable setup fails fast. |
||
|---|---|---|
| .. | ||
| change | ||
| testcapture | ||
| testdata | ||
| api_key.go | ||
| common.go | ||
| common_test.go | ||
| config.go | ||
| config_test.go | ||
| const.go | ||
| debug_routes.go | ||
| derp_config_test.go | ||
| main_test.go | ||
| node.go | ||
| node_benchmark_test.go | ||
| node_peerchange_test.go | ||
| node_tags_test.go | ||
| node_test.go | ||
| oauth.go | ||
| policy.go | ||
| preauth_key.go | ||
| preauth_key_test.go | ||
| registration.go | ||
| routes.go | ||
| slices.go | ||
| testlog.go | ||
| types_clone.go | ||
| types_view.go | ||
| users.go | ||
| users_test.go | ||
| version.go | ||