kyma-project / busola / 28660673755

19%

main: 20%

push

github

fix: Prevent OIDC auth loop when SSO and cluster OIDC use different client IDs (#5122)

* fix: prevent OIDC auth loop when SSO and cluster OIDC use different client IDs

When SSO (IAS) is enabled alongside cluster OIDC auth, both UserManagers
called signinRedirectCallback on the same redirect URL. The one whose
client_id didn't match the stored state threw 'authority mismatch' or
'client_id mismatch', which caused a blocking alert and an infinite loop
on repeat page loads in non-incognito tabs.

Add isOwnOidcCallback helper that checks sessionStorage['oidc.<stateId>'].client_id
against the current UserManager's clientId before processing the callback.
If it doesn't match, clear stale state and do a fresh signinRedirect instead.

Also add 'authority mismatch' to the safety-net catch in authDataAtom so
any edge cases that slip through are handled without alerting the user.

* fix: don't signinRedirect when a foreign OIDC callback is being processed

* enable on dev

* fix: read OIDC pending state from localStorage, not sessionStorage

1700 of 11603 branches covered (14.65%)

Branch coverage included in aggregate %.

0 of 37 new or added lines in 2 files covered. (0.0%)

3660 of 16260 relevant lines covered (22.51%)

22.69 hits per line