go-pkgz / auth / 25576089427 / 1
85%
master: 85%

LAST BUILD BRANCH: docs/comment-sweep
DEFAULT BRANCH: master
Ran
Files 24
Run time 1s
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 84.171% (-0.08%) from 84.247%
25576089427.1

Pull #287

github

paskal 
fix(provider): bind dev oauth and custom-server to localhost by default

provider/dev_provider.go and provider/custom_server.go used Addr ":port",
which listens on every interface. The dev OAuth UI and the embedded
go-oauth2/oauth2 helper are intended for local development and embedded
flows, not for LAN exposure — but the bare-port shorthand silently
exposed them to anyone who could route to the host's other addresses
(other LAN clients, Docker network siblings, kube pods, etc).

Add localBindAddr(host, port) in provider/service.go that defaults the
listen host to 127.0.0.1 when the caller passes an empty host. Callers
that explicitly want non-loopback exposure can pass a hostname:

* dev_provider — uses Provider.Host (existing field) as the host;
  empty -> 127.0.0.1, explicit "0.0.0.0"/"192.168.x.y" honored.
* custom_server — uses the host from c.URL ("http://localhost:8080");
  "localhost" or empty -> 127.0.0.1; explicit non-loopback honored.

Same change in v1 and v2 in single PR.

Tests in both modules:

* TestLocalBindAddr — table for empty/explicit-loopback/explicit-LAN/
  explicit-0.0.0.0/IPv6 cases.
* TestLocalBindAddr_DefaultIsNotAllInterfaces — regression test for
  the property "default bind never produces ':port' shorthand".
  Confirmed locally that reverting localBindAddr to "return ':' + port"
  makes this test fail with a clear message.
Pull Request #287: fix(provider): bind dev oauth and custom-server to localhost by default

2712 of 3222 relevant lines covered (84.17%)

7.29 hits per line

Source Files on job 25576089427.1