stacklok / toolhive / 31528762774

70%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth): bind OAuth callback listener to loopback only (#6238)

The interactive login callback server bound ":port" (all interfaces)
while advertising a localhost redirect URL. For the lifetime of a
login, any host on the LAN could probe the listener and abort the
flow by hitting /callback?error=... (no state needed on the error
path). Login-code theft is not possible: the 128-bit state is
validated before token exchange, so the impact is login DoS only.

Bind 127.0.0.1 explicitly, matching the redirect URL host and the
loopback address the port-availability probe already uses. Added
TestListenAddrLoopback asserting the listener address is loopback.

Signed-off-by: Sasha Mitchell <sash.t.mitchell@gmail.com>

Coverage Stats

4 of 4 new or added lines in 1 file covered. (100.0%)

14 existing lines in 4 files now uncovered.

84436 of 120165 relevant lines covered (70.27%)

98.31 hits per line