a00d87a3

fix(auth): a rejected sign-in names the origin that broke it

a73x 2026-08-11 18:21

Commit message

fix(auth): a rejected sign-in names the origin that broke it

The console's OAuth callback answered every failed state check with
"invalid oauth state" — true of all of them, useful for none. The browser
has just come back from a successful authentication, so the only reading
left is that eitri lost the sign-in, and the next move is a guess.

A rejection now says which way it failed. The reason is a stable word in
the log (wrong_origin, no_state_param, no_state_cookie, state_mismatch,
no_verifier_cookie) and a sentence in the browser that ends at the one
next move that works. Reasons and hostnames only: nothing logs a state
value, a cookie, or anything from the token exchange.

The cause worth naming is the first sign-in on a fresh box. The console
is served at public_url but answers on every address the host has, so a
browser at http://127.0.0.1:8080 gets the same page and signs in there.
The cookie is scoped to the address the browser used, the identity
provider returns the browser to the redirect URL built from public_url,
and the cookie is never sent to a different host: the flow dies one hop
from done, with both halves configured correctly.

That is not visible at the callback, which lands on public_url's host in
the working and the broken case alike. The evidence is at /auth/login one
redirect earlier, so state carries it forward — "<32 hex>.<base64url
origin>" — because state round-trips through the identity provider in the
query string, the one channel that survives the origin switch that breaks
the cookie. The random half and the whole-string cookie comparison are
unchanged, so the CSRF guard is exactly as strong as it was. The refusal
names both addresses outright and says which one to sign in at.

The host comparison is confined to the case where no cookie arrived,
which is the only case where it is evidence. When the cookie did come
back the browser is demonstrably on an origin this server's cookies live
on, so a Host that differs from public_url is a reverse proxy rewriting
it — diagnosed as the stale tab it really is, not as a wrong origin.

internal/server/api/auth.go

Old		New
@@ -119,7 +119,7 @@ func (af authFlow) handleLogin(w http.ResponseWriter, r http.Request) {
119	http.Error(w, "sign-in temporarily unavailable", http.StatusServiceUnavailable)	119	http.Error(w, "sign-in temporarily unavailable", http.StatusServiceUnavailable)
120	return	120	return
121	}	121	}
122	state, err := randomHex(16) // 32 hex chars	122	state, err := newState(requestOrigin(r))
123	if err != nil {	123	if err != nil {
124	http.Error(w, "internal error", http.StatusInternalServerError)	124	http.Error(w, "internal error", http.StatusInternalServerError)
125	return	125	return
@@ -146,19 +146,16 @@ func (af authFlow) handleCallback(w http.ResponseWriter, r http.Request) {
146	}	146	}
147		147
148	// State must round-trip through the cookie set at /auth/login (CSRF guard):	148	// State must round-trip through the cookie set at /auth/login (CSRF guard):
149	// a missing or mismatched value is rejected before any token exchange.	149	// a missing or mismatched value is rejected before any token exchange. The
150	stateCk, err := r.Cookie(stateCookie)	150	// guard is unchanged; what it rejects now says which way it failed.
151	if err != nil \|\| stateCk.Value == "" \|\| r.URL.Query().Get("state") != stateCk.Value {	151	pkceVerifier, rej := af.diagnoseCallback(r)
152	http.Error(w, "invalid oauth state", http.StatusBadRequest)	152	if rej != nil {
153	return	153	rej.log()
154	}	154	http.Error(w, rej.message(), http.StatusBadRequest)
155	verifierCk, err := r.Cookie(verifierCookie)
156	if err != nil \|\| verifierCk.Value == "" {
157	http.Error(w, "invalid oauth state", http.StatusBadRequest)
158	return	155	return
159	}	156	}
160		157
161	tok, err := af.oauth.Exchange(r.Context(), r.URL.Query().Get("code"), oauth2.VerifierOption(verifierCk.Value))	158	tok, err := af.oauth.Exchange(r.Context(), r.URL.Query().Get("code"), oauth2.VerifierOption(pkceVerifier))
162	if err != nil {	159	if err != nil {
163	slog.Warn("oauth code exchange failed", "err", err)	160	slog.Warn("oauth code exchange failed", "err", err)
164	http.Error(w, "sign-in failed", http.StatusBadGateway)	161	http.Error(w, "sign-in failed", http.StatusBadGateway)

internal/server/api/auth_test.go

@@ @@ -1,17 +1,21 @@ @@
+package api
+import (
+	"bytes"
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/cookiejar"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
@@ @@ -326,28 +330,185 @@ func TestAuthLogoutRevokesSession(t *testing.T) { @@
+	assert.False(t, ok, "session must no longer resolve after logout")
+// captureLogs redirects the default logger into a buffer: a rejected sign-in
+// reports its reason the only way a browser-facing refusal can, by logging it.
+func captureLogs(t *testing.T) *bytes.Buffer {
+	t.Helper()
+	var logs bytes.Buffer
+	prev := slog.Default()
+	slog.SetDefault(slog.New(slog.NewTextHandler(&logs, nil)))
+	t.Cleanup(func() { slog.SetDefault(prev) })
+	return &logs
+}
+// login drives /auth/login and returns the cookies it set. host overrides the
+// Host header the browser appears to have used ("" leaves it at public_url's),
+// which is how a sign-in started at the wrong origin is reproduced.
+func (e authEnv) login(t *testing.T, host string) []*http.Cookie {
+	t.Helper()
+	req, err := http.NewRequest(http.MethodGet, e.apiURL+"/auth/login", nil)
+	require.NoError(t, err)
+	if host != "" {
+		req.Host = host
+	}
+	resp, err := e.bare().Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusFound, resp.StatusCode)
+	return resp.Cookies()
+}
+// callback hits /auth/callback with exactly the query and cookies given —
+// no jar, so each case controls precisely what comes back from the browser.
+func (e authEnv) callback(t *testing.T, q url.Values, cookies []*http.Cookie) (int, string) {
+	t.Helper()
+	req, err := http.NewRequest(http.MethodGet, e.apiURL+"/auth/callback?"+q.Encode(), nil)
+	require.NoError(t, err)
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+	resp, err := e.bare().Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	return resp.StatusCode, string(body)
+}
+// bare is a client with no cookie jar that surfaces redirects.
+func (e authEnv) bare() *http.Client {
+	return &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+}
+// TestAuthCallbackRejectionsSayWhy pins the diagnosis: every way the state
+// check fails is a distinct reason word in the log and a distinct next move in
+// the browser. The wrong-origin case is the one that bites a first sign-in —
+// the console answers on every address the box has, so signing in from one that
+// is not public_url sets the cookie somewhere the callback never reaches — and
+// it is the one that must name both URLs outright.
+func TestAuthCallbackRejectionsSayWhy(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		// setup returns the callback's query and the cookies the browser sends.
+		setup      func(t *testing.T, e authEnv) (url.Values, []*http.Cookie)
+		wantReason string
+		wantLogged []string // extra key=value pairs the log line must carry
+		wantText   []string
+	}{
+		{
+			name: "wrong origin: signed in at an address public_url does not name",
+			setup: func(t *testing.T, e authEnv) (url.Values, []*http.Cookie) {
+				// The browser was at console.example.test:8080, so /auth/login
+				// set its cookies there; the identity provider returns it to
+				// public_url's host, which those cookies never reach.
+				set := e.login(t, "console.example.test:8080")
+				return url.Values{"state": {cookieByName(set, "eitri_oauth_state").Value}, "code": {"c"}}, nil
+			},
+			wantReason: "wrong_origin",
+			wantLogged: []string{"got_host=console.example.test:8080"},
+			wantText:   []string{"http://console.example.test:8080", "sign in there"},
+		},
+		{
+			name: "no state cookie: right origin, nothing came back",
+			setup: func(t *testing.T, e authEnv) (url.Values, []*http.Cookie) {
+				set := e.login(t, "")
+				return url.Values{"state": {cookieByName(set, "eitri_oauth_state").Value}, "code": {"c"}}, nil
+			},
+			wantReason: "no_state_cookie",
+			wantText:   []string{"did not come back", "ten minutes", "blocks cookies", "fresh tab"},
+		},
+		{
+			name: "state mismatch: a stale tab or a replayed callback",
+			setup: func(t *testing.T, e authEnv) (url.Values, []*http.Cookie) {
+				set := e.login(t, "")
+				return url.Values{"state": {"another-sign-in"}, "code": {"c"}}, set
+			},
+			wantReason: "state_mismatch",
+			wantText:   []string{"no longer the one in progress", "fresh tab"},
+		},
+		{
+			name: "no verifier cookie: the state came back without its PKCE half",
+			setup: func(t *testing.T, e authEnv) (url.Values, []*http.Cookie) {
+				set := e.login(t, "")
+				state := cookieByName(set, "eitri_oauth_state")
+				return url.Values{"state": {state.Value}, "code": {"c"}}, []*http.Cookie{state}
+			},
+			wantReason: "no_verifier_cookie",
+			wantText:   []string{"PKCE verifier", "fresh tab"},
+		},
+		{
+			name: "no state at all: /auth/callback opened directly",
+			setup: func(t *testing.T, e authEnv) (url.Values, []*http.Cookie) {
+				return url.Values{}, nil
+			},
+			wantReason: "no_state_param",
+			wantText:   []string{"not a", "page to open"},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			env := newAuthEnv(t, false, nil, testUser{email: "alex@example.com"})
+			q, cookies := tc.setup(t, env)
+			logs := captureLogs(t) // after setup: only the rejection is captured
+			code, body := env.callback(t, q, cookies)
+			assert.Equal(t, http.StatusBadRequest, code)
+			assert.Contains(t, logs.String(), "reason="+tc.wantReason)
+			for _, want := range tc.wantLogged {
+				assert.Contains(t, logs.String(), want)
+			}
+			for _, want := range tc.wantText {
+				assert.Contains(t, body, want, "the refusal must say what to do about %s", tc.wantReason)
+			}
+			// Every refusal points at the console's real address, and none of
+			// them leaks the state value it was given.
+			assert.Contains(t, body, env.apiURL)
+			if s := q.Get("state"); s != "" {
+				assert.NotContains(t, logs.String(), s, "a rejection logs reasons, never the state")
+				assert.NotContains(t, body, s, "a rejection shows reasons, never the state")
+			}
+		})
+	}
+}
+// TestAuthCallbackWrongOriginNamesBothURLs is the sentence a first-time
+// self-hoster reads: both addresses, in full, and which one to use.
+func TestAuthCallbackWrongOriginNamesBothURLs(t *testing.T) {
+	env := newAuthEnv(t, false, nil, testUser{email: "alex@example.com"})
+	logs := captureLogs(t)
+	set := env.login(t, "127.0.0.1:9999")
+	_, body := env.callback(t, url.Values{
+		"state": {cookieByName(set, "eitri_oauth_state").Value}, "code": {"c"},
+	}, nil)
+	assert.Contains(t, body, "it started at http://127.0.0.1:9999")
+	assert.Contains(t, body, "the console is served at "+env.apiURL)
+	assert.Contains(t, body, "Open "+env.apiURL+" and sign in there.")
+	assert.Contains(t, logs.String(), "got_host=127.0.0.1:9999")
+	assert.Contains(t, logs.String(), "want_host="+strings.TrimPrefix(env.apiURL, "http://"))
+// TestAuthCallbackStateCarriesOriginWithoutWeakeningTheGuard: the origin rides
+// along in the state parameter, and the CSRF half in front of it is still the
+// 32 random hex chars the cookie must match whole.
+func TestAuthCallbackStateCarriesOrigin(t *testing.T) {
+	env := newAuthEnv(t, false, nil, testUser{email: "alex@example.com"})
+	set := env.login(t, "")
+	state := cookieByName(set, "eitri_oauth_state").Value
+	random, encoded, found := strings.Cut(state, ".")
+	require.True(t, found, "state must carry the origin after the random half")
+	assert.Len(t, random, 32, "the CSRF value is unchanged")
+	assert.Regexp(t, "^[0-9a-f]+$", random)
+	got, err := base64.RawURLEncoding.DecodeString(encoded)
+	require.NoError(t, err)
+	assert.Equal(t, env.apiURL, string(got), "the origin the sign-in started at")
+	// A callback carrying only the random half is still rejected: the cookie
+	// comparison is whole-string.
+	code, _ := env.callback(t, url.Values{"state": {random}, "code": {"c"}}, set)
+	assert.Equal(t, http.StatusBadRequest, code)
+// --- hand-rolled stub issuer: cases internal/oidcprovider can't produce ---

internal/server/api/authreject.go

@@ @@ -0,0 +1,226 @@ @@
+package api
+import (
+	"encoding/base64"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"strings"
+)
+// A callback that fails the state check has exactly one thing to offer the
+// person in front of it: which way it failed. "invalid oauth state" is true of
+// every one of them and useful for none — the browser has just come back from a
+// successful authentication, so the reading is that eitri lost the sign-in, and
+// the operator's next move is a guess.
+//
+// The causes below are the ones the request can actually be read apart into.
+// The first is the common one, and it is not a mistake anybody makes twice once
+// it is named: the console is served at public_url, but it answers on every
+// address the box has, so a browser at http://127.0.0.1:8080 gets the same page
+// public_url serves and signs in from there. The cookie /auth/login sets is
+// scoped to the host the browser used; the identity provider sends the callback
+// to the redirect URL, which is built from public_url; the cookie is not sent to
+// a different host, and the flow dies one hop from done.
+//
+// That is diagnosable, but not from the callback alone — the callback lands on
+// public_url's host in both the working and the broken case, so its own Host
+// header says nothing. The evidence is at /auth/login, one redirect earlier, and
+// the state parameter is what carries it forward: state round-trips through the
+// identity provider in the query string, which is the one channel that survives
+// the origin switch that breaks the cookie.
+const (
+	reasonNoStateParam     = "no_state_param"
+	reasonWrongOrigin      = "wrong_origin"
+	reasonNoStateCookie    = "no_state_cookie"
+	reasonStateMismatch    = "state_mismatch"
+	reasonNoVerifierCookie = "no_verifier_cookie"
+)
+// stateOriginSep separates the CSRF-random half of a state value from the
+// base64url origin the sign-in started at: "<32 hex>.<origin>". The random half
+// is unchanged and the cookie comparison stays whole-string, so the guard is
+// exactly as strong as it was; the suffix is inert data the server wrote and
+// only ever reads back to explain a failure.
+const stateOriginSep = "."
+// newState mints a state value carrying the origin the browser used to reach
+// /auth/login.
+func newState(origin string) (string, error) {
+	r, err := randomHex(16) // 32 hex chars
+	if err != nil {
+		return "", err
+	}
+	if origin == "" {
+		return r, nil
+	}
+	return r + stateOriginSep + base64.RawURLEncoding.EncodeToString([]byte(origin)), nil
+}
+// stateOrigin reads back what newState wrote, or "" for a state without an
+// origin (an in-flight flow from an older server) or one that does not decode
+// to a plausible origin. The value came from a request header, so it is treated
+// as untrusted input on the way out as much as on the way in.
+func stateOrigin(state string) string {
+	i := strings.Index(state, stateOriginSep)
+	if i < 0 {
+		return ""
+	}
+	raw, err := base64.RawURLEncoding.DecodeString(state[i+1:])
+	if err != nil {
+		return ""
+	}
+	return sanitizeOrigin(string(raw))
+}
+// requestOrigin is the scheme://host the browser used for this request. The
+// server never trusts proxy headers to build an external URL (see API.URL,
+// which reads public_url and nothing else), so this reads Host as sent and is
+// used only to explain a failure, never to construct a redirect.
+func requestOrigin(r *http.Request) string {
+	scheme := "http"
+	if r.TLS != nil {
+		scheme = "https"
+	}
+	return sanitizeOrigin(scheme + "://" + r.Host)
+}
+// sanitizeOrigin passes an http(s) origin whose host is plausible, and "" for
+// anything else — the string is echoed into a log line and an error page, and
+// its host half is caller-controlled.
+func sanitizeOrigin(origin string) string {
+	if len(origin) > 200 {
+		return ""
+	}
+	u, err := url.Parse(origin)
+	if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
+		return ""
+	}
+	if u.Path != "" || u.RawQuery != "" || u.Fragment != "" || u.User != nil {
+		return ""
+	}
+	for _, c := range u.Host {
+		switch {
+		case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z', c >= '0' && c <= '9':
+		case c == '.' || c == '-' || c == ':' || c == '[' || c == ']':
+		default:
+			return ""
+		}
+	}
+	return u.Scheme + "://" + u.Host
+}
+// originHost is an origin's host[:port], lowercased for comparison. Ports are
+// part of it deliberately: 127.0.0.1:8080 and 127.0.0.1:9090 are different
+// cookie origins, and a mismatched port breaks a sign-in exactly like a
+// mismatched name does.
+func originHost(origin string) string {
+	u, err := url.Parse(origin)
+	if err != nil {
+		return ""
+	}
+	return strings.ToLower(u.Host)
+}
+// stateRejection is one diagnosed sign-in failure: a stable reason word for the
+// log and the facts needed to tell the person what to do about it.
+type stateRejection struct {
+	reason   string
+	browsing string // origin the sign-in started at; set for wrong_origin
+	console  string // public_url, trailing slash trimmed
+}
+// diagnoseCallback runs the state check and, on failure, says which way it
+// failed. It returns the PKCE verifier when every check passes.
+//
+// The order is the order of the evidence, not of the checks it replaces. A
+// callback with no state parameter at all was never sent by an identity
+// provider. Then the cookie: when it did not arrive, an origin that is not
+// public_url's is the whole explanation and wins the diagnosis. When it DID
+// arrive, the browser is demonstrably on an origin this server's cookies live
+// on, so any difference between Host and public_url is a reverse proxy
+// rewriting Host rather than evidence about the browser — the mismatch is
+// diagnosed on what it really is, a state that belongs to another sign-in.
+func (af *authFlow) diagnoseCallback(r *http.Request) (string, *stateRejection) {
+	rej := &stateRejection{console: strings.TrimRight(af.cfg.PublicURL, "/")}
+	state := r.URL.Query().Get("state")
+	if state == "" {
+		rej.reason = reasonNoStateParam
+		return "", rej
+	}
+	stateCk, err := r.Cookie(stateCookie)
+	if err != nil || stateCk.Value == "" {
+		// Prefer the origin the flow started at over this request's own Host:
+		// it is the host the missing cookie was scoped to, which is the fact
+		// that explains the absence.
+		browsing := stateOrigin(state)
+		if browsing == "" {
+			browsing = requestOrigin(r)
+		}
+		if want := originHost(rej.console); want != "" && browsing != "" && originHost(browsing) != want {
+			rej.reason, rej.browsing = reasonWrongOrigin, browsing
+			return "", rej
+		}
+		rej.reason = reasonNoStateCookie
+		return "", rej
+	}
+	if state != stateCk.Value {
+		rej.reason = reasonStateMismatch
+		return "", rej
+	}
+	verifierCk, err := r.Cookie(verifierCookie)
+	if err != nil || verifierCk.Value == "" {
+		rej.reason = reasonNoVerifierCookie
+		return "", rej
+	}
+	return verifierCk.Value, nil
+}
+// log records the rejection with its reason and the hostnames that explain it.
+// Never the state value, the cookie, or anything from the token exchange: a
+// rejected sign-in is worth a log line, not a copy of the credentials it
+// carried.
+func (rej *stateRejection) log() {
+	if rej.reason == reasonWrongOrigin {
+		slog.Warn("oauth callback rejected", "reason", rej.reason,
+			"got_host", originHost(rej.browsing), "want_host", originHost(rej.console))
+		return
+	}
+	slog.Warn("oauth callback rejected", "reason", rej.reason)
+}
+// message is what the browser is shown. Refusal-family voice, one per cause:
+// the request is fine and the person did nothing wrong — this origin, or this
+// tab, cannot finish the sign-in — so each one ends at the single next move
+// that works.
+func (rej *stateRejection) message() string {
+	console := rej.console
+	if console == "" {
+		console = "the console's configured public_url"
+	}
+	switch rej.reason {
+	case reasonWrongOrigin:
+		return "this sign-in cannot be completed from here: it started at " + rej.browsing +
+			", but the console is served at " + console + ", so the cookie holding the sign-in was set for " +
+			"the address you were browsing and was never sent to the one the identity provider returned you " +
+			"to. Open " + console + " and sign in there."
+	case reasonNoStateParam:
+		return "/auth/callback is where an identity provider returns a browser at the end of a sign-in, not a " +
+			"page to open: this request carried no sign-in to finish. Open " + console + " and sign in from there."
+	case reasonNoStateCookie:
+		return "this sign-in cannot be completed: the cookie set when it started did not come back, so nothing " +
+			"here can match this callback to the flow it belongs to. A sign-in left unfinished for more than " +
+			"ten minutes expires, and a browser that blocks cookies for this site cannot complete one at all. " +
+			"Open the console at exactly " + console + " and sign in again from a fresh tab."
+	case reasonStateMismatch:
+		return "this callback belongs to a sign-in that is no longer the one in progress: the state it carries " +
+			"is not the state this browser last started with, which is what a stale tab, a reloaded callback, " +
+			"or a second sign-in started meanwhile looks like. Sign in again from a fresh tab at " + console + "."
+	case reasonNoVerifierCookie:
+		return "this sign-in cannot be completed: the browser returned the sign-in but not the PKCE verifier " +
+			"cookie that goes with it, so the authorization code cannot be exchanged. Sign in again from a " +
+			"fresh tab at " + console + "."
+	}
+	return "this sign-in cannot be completed. Open " + console + " and sign in again from a fresh tab."
+}