[org] Disallow logins with organizational Git Auth #16874
Conversation
|
started the job as gitpod-build-at-org-git.1 because the annotations in the pull request description changed |
| "authorize-flow": true, | ||
| ap: authProvider.info, | ||
| }); | ||
| res.redirect(this.getSorryUrl(`Login with "${host}" is not permitted.`)); |
There was a problem hiding this comment.
Is there a better call to action we can include? What should the user do when this happens?
There was a problem hiding this comment.
Great question.
The response here is what's done on bad requests in that area. The legacy sorry page is used as a sink where we're lacking proper rending on the dashboard.
Why calling that a bad request? Those organizational Git Auth providers won't be available on the Login screen, they are not meant to be included there. Here we are guarding from forged requests to the /api/login endpoint parameterized with the host of an organizational Git Auth provider.
Given that one cannot reach this point by navigating any link, I don't think it make sense to provide any CTA. But that's definitely biased, so if find anything helpful, let's do that.
There was a problem hiding this comment.
I'm ok with this, given that it's a not a case a user can end up with in a regular case.
☁️ To better highlight this, we could also just return a 400 (Bad Request). But I think it's more cosmetics.
|
Trying to test this now... |
|
Works in the test. A tad weird:
But again, this is a weird edge case in the first place. 🧘 |
roboquat
added
deployed: webapp
Description
We need to make sure that login with organizational Git Auth is not permitted. Those organizational Git Auth providers are limited to be used for Git operations and API calls only.
Related Issue(s)
Fixes #16873
How to test
/api/login?host=some-gitlab.comRelease Notes
Documentation
Build Options:
Run the build with werft instead of GHA
Run Leeway with
--dont-testPublish Options
Installer Options
Add desired feature flags to the end of the line above, space separated
Preview Environment Options:
If enabled this will build
install/previewIf enabled this will create the environment on GCE infra
Valid options are
all,workspace,webapp,ide,jetbrains,vscode,ssh