stacklok / toolhive / 37921021736

71%

push

github

Remove the 10s header timeout from the upstream IdP client (#6755)

Remove header timeout from upstream IdP client

The embedded auth server's client for the upstream identity provider inherited the builder's 10s response-header timeout.
A token endpoint that takes longer than 10s to send its first byte therefore fails code exchange and refresh, although the client timeout and the refresher's budget are both 30s.
When a refresh is cut off after a provider that revokes the presented refresh token has processed it, the stored refresh token is no longer valid and the user has to sign in again.
The shared grant client in pkg/oauthproto leaves this timeout unset for the same reason, so that slow IdP chains can answer within the client timeout.
Add HttpClientBuilder.WithResponseHeaderTimeout, keeping the 10s default for every other caller, and have newHTTPClientForHost remove the limit.
Discovery, JWKS and userinfo use the same client and the same IdP, so they get the same 30s budget.

Signed-off-by: Aleksandr Filippov <71711753+alex-feel@users.noreply.github.com>

5 of 5 new or added lines in 2 files covered. (100.0%)

85580 of 120422 relevant lines covered (71.07%)

126.35 hits per line