go-pkgz / auth / 25577691033

85%

master: 85%

Pull #287

github

fix(provider): bind dev oauth and custom-server to localhost by default

provider/dev_provider.go and provider/custom_server.go used Addr ":port",
which listens on every interface. The dev OAuth UI and the embedded
go-oauth2/oauth2 helper are intended for local development and embedded
flows, not for LAN exposure — but the bare-port shorthand silently
exposed them to anyone who could route to the host's other addresses
(other LAN clients, Docker network siblings, kube pods, etc).

Add localBindAddr(host, port) in provider/service.go that defaults the
listen host to 127.0.0.1 when the caller passes an empty host. Callers
that explicitly want non-loopback exposure can pass a hostname:

* dev_provider — uses Provider.Host (existing field) as the host;
  empty -> 127.0.0.1, explicit "0.0.0.0"/"192.168.x.y" honored.
* custom_server — uses the host from c.URL ("http://localhost:8080");
  "localhost" or empty -> 127.0.0.1; explicit non-loopback honored.

Same change in v1 and v2 in single PR.

Tests in both modules:

* TestLocalBindAddr — table for empty/explicit-loopback/explicit-LAN/
  explicit-0.0.0.0/IPv6 cases.
* TestLocalBindAddr_DefaultIsNotAllInterfaces — regression test for
  the property "default bind never produces ':port' shorthand".
  Confirmed locally that reverting localBindAddr to "return ':' + port"
  makes this test fail with a clear message.

11 of 13 new or added lines in 3 files covered. (84.62%)

2812 of 3315 relevant lines covered (84.83%)

7.76 hits per line