Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: return 401 if password is invalid #2796

Merged
merged 3 commits into from Feb 16, 2023
Merged

fix: return 401 if password is invalid #2796

merged 3 commits into from Feb 16, 2023

Conversation

nabokihms
Copy link
Member

Signed-off-by: m.nabokikh maksim.nabokikh@flant.com

What this PR does / why we need it

This will help to distinguish errors and successful requests.

Special notes for your reviewer

Context #2454 (comment)

Does this PR introduce a user-facing change?

Requests with invalid passwords are responded to with the 401 error code.

@nabokihms
fix: return 401 if password is invalid
33fae46 
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
@nabokihms nabokihms added this to the v2.36.0 milestone Jan 21, 2023
@nabokihms nabokihms added the release-note/enhancement Release note: Enhancements label Jan 21, 2023
dlipovetsky
dlipovetsky approved these changes Jan 24, 2023
View reviewed changes
Copy link
Contributor

@dlipovetsky dlipovetsky left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. While this change returns more information to the client than before, I think it's in line with standard behavior, i.e. if you submit the incorrect password, you get a 401.

Does this deserve a test somewhere, e.g in https://github.com/mesosphere/dex/blob/33fae46de75d1d299e041fe36f3068e95d95095e/server/handlers_test.go?

@nabokihms
Copy link
Member Author

@dlipovetsky thanks for reviewing, I think I can add a test.

@dlipovetsky
Copy link
Contributor

@dlipovetsky thanks for reviewing, I think I can add a test.

Thanks! (I'm not 100% certain a test is needed, but I thought it might one could add value by making sure the correct behavior (to return a 401 is the password is invalid) is not accidentally changed in the future)

@nabokihms
Add test
8d50277 
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
dlipovetsky
dlipovetsky approved these changes Feb 10, 2023
View reviewed changes
Copy link
Contributor

@dlipovetsky dlipovetsky left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the test! Looks good.

(nit: I'm not sure if the test name (TestPasswordConnectorDataNotEmpty) is accurate anymore. Maybe something more broad, e.g. TestPasswordConnector?)

@nabokihms
Rename test
841ede9 
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
@nabokihms
Copy link
Member Author

@dlipovetsky thank you for reviewing

@nabokihms nabokihms merged commit 7016a82 into dexidp:master Feb 16, 2023
xtremerui pushed a commit to concourse/dex that referenced this pull request May 25, 2023
upstream dex release: v2.36.0
2ab05af 
The official container image for this release can be pulled from
```
ghcr.io/dexidp/dex:v2.36.0
```

<!-- Release notes generated using configuration in .github/release.yml at v2.36.0 -->

## What's Changed
### Enhancements 🚀
* TLS configure for OIDC connector by @xtremerui in dexidp#1632
* Add icon for gitea by @pinpox in dexidp#2733
* fix: Do not use connector data from the refresh token field by @nabokihms in dexidp#2729
* Add preferredEmailDomain config option for GitHub connector by @nobuyo in dexidp#2740
* Move unique functionality into getGroups to reduce calls to google by @snuggie12 in dexidp#2628
* fix: prevent server-side request forgery using Kubernetes storage by @nabokihms in dexidp#2479
* fix: return 401 if password is invalid by @nabokihms in dexidp#2796
* feat: Add default robots.txt by @nabokihms in dexidp#2834
* Skip redirection to approval when it is not required (dexidp#2686) by @nobuyo in dexidp#2805
* feat: Bump dependencies and Makefile refactoring by @nabokihms in dexidp#2844
### Bug Fixes 🐛
* Make admin email optional when no service account path is configured by @sagikazarmark in dexidp#2695
* Only initialize google admin service if necessary by @sagikazarmark in dexidp#2700
### Dependency Updates ⬆️
* build(deps): bump golang from 1.19.1-alpine3.16 to 1.19.2-alpine3.16 by @dependabot in dexidp#2697
* fix: Update gomplate version to 3.11.3 fix CVE-2022-27665 by @nabokihms in dexidp#2705
* build(deps): bump github.com/spf13/cobra from 1.5.0 to 1.6.0 by @dependabot in dexidp#2708
* build(deps): bump github.com/stretchr/testify from 1.8.0 to 1.8.1 by @dependabot in dexidp#2715
* build(deps): bump google.golang.org/api from 0.98.0 to 0.101.0 by @dependabot in dexidp#2720
* build(deps): bump github.com/mattn/go-sqlite3 from 1.14.15 to 1.14.16 by @dependabot in dexidp#2721
* build(deps): bump aquasecurity/trivy-action from 0.7.1 to 0.8.0 by @dependabot in dexidp#2723
* build(deps): bump github.com/spf13/cobra from 1.6.0 to 1.6.1 by @dependabot in dexidp#2718
* build(deps): bump golang from 1.19.2-alpine3.16 to 1.19.3-alpine3.16 by @dependabot in dexidp#2724
* build(deps): bump alpine from 3.16.2 to 3.17.0 by @dependabot in dexidp#2746
* build(deps): bump github.com/prometheus/client_golang from 1.13.0 to 1.14.0 by @dependabot in dexidp#2735
* build(deps): bump go.etcd.io/etcd/client/pkg/v3 from 3.5.5 to 3.5.6 by @dependabot in dexidp#2744
* build(deps): bump github.com/Masterminds/sprig/v3 from 3.2.2 to 3.2.3 by @dependabot in dexidp#2751
* build(deps): bump golang from 1.19.3-alpine3.16 to 1.19.4-alpine3.16 by @dependabot in dexidp#2750
* build(deps): bump golang.org/x/crypto from 0.3.0 to 0.4.0 by @dependabot in dexidp#2755
* build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.5 to 3.5.6 by @dependabot in dexidp#2743
* build(deps): bump github.com/go-sql-driver/mysql from 1.6.0 to 1.7.0 by @dependabot in dexidp#2754
* build(deps): bump helm/kind-action from 1.4.0 to 1.5.0 by @dependabot in dexidp#2758
* build(deps): bump google.golang.org/grpc from 1.50.1 to 1.51.0 by @dependabot in dexidp#2741
* build(deps): bump google.golang.org/api from 0.101.0 to 0.104.0 by @dependabot in dexidp#2753
* build(deps): bump google.golang.org/grpc from 1.49.0 to 1.51.0 in /api/v2 by @dependabot in dexidp#2742
* build(deps): bump golang.org/x/net from 0.3.0 to 0.4.0 by @dependabot in dexidp#2761
* build(deps): bump entgo.io/ent from 0.11.3 to 0.11.4 by @dependabot in dexidp#2725
* build(deps): bump google.golang.org/api from 0.104.0 to 0.105.0 by @dependabot in dexidp#2760
* build(deps): bump golang.org/x/net from 0.4.0 to 0.5.0 by @dependabot in dexidp#2774
* build(deps): bump google.golang.org/api from 0.105.0 to 0.106.0 by @dependabot in dexidp#2772
* build(deps): bump github.com/coreos/go-oidc/v3 from 3.4.0 to 3.5.0 by @dependabot in dexidp#2770
* build(deps): bump golang.org/x/crypto from 0.4.0 to 0.5.0 by @dependabot in dexidp#2773
* build(deps): bump golang.org/x/oauth2 from 0.3.0 to 0.4.0 by @dependabot in dexidp#2777
* build(deps): bump entgo.io/ent from 0.11.4 to 0.11.5 by @dependabot in dexidp#2779
* build(deps): bump alpine from 3.17.0 to 3.17.1 by @dependabot in dexidp#2780
* build(deps): bump mheap/github-action-required-labels from 2 to 3 by @dependabot in dexidp#2769
* build(deps): bump google.golang.org/api from 0.106.0 to 0.107.0 by @dependabot in dexidp#2788
* build(deps): bump golang from 1.19.4-alpine3.16 to 1.19.5-alpine3.16 by @dependabot in dexidp#2782
* build(deps): bump google.golang.org/grpc from 1.51.0 to 1.52.0 by @dependabot in dexidp#2783
* build(deps): bump google.golang.org/api from 0.107.0 to 0.108.0 by @dependabot in dexidp#2793
* build(deps): bump google.golang.org/grpc from 1.51.0 to 1.52.0 in /api/v2 by @dependabot in dexidp#2784
* chore: Upgrade golangci-lint to v1.50.1 from v1.46.0 by @dlipovetsky in dexidp#2790
* ci: Use go 1.19 by @dlipovetsky in dexidp#2791
* build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.6 to 3.5.7 by @dependabot in dexidp#2798
* build(deps): bump docker/build-push-action from 3 to 4 by @dependabot in dexidp#2807
* build(deps): bump golang from 1.19.5-alpine3.16 to 1.20.0-alpine3.16 by @dependabot in dexidp#2811
* build(deps): bump aquasecurity/trivy-action from 0.8.0 to 0.9.0 by @dependabot in dexidp#2810
* build(deps): bump alpine from 3.17.1 to 3.17.2 by @dependabot in dexidp#2821
* build(deps): bump aquasecurity/trivy-action from 0.9.0 to 0.9.1 by @dependabot in dexidp#2822
* build(deps): bump entgo.io/ent from 0.11.5 to 0.11.8 by @dependabot in dexidp#2823
* build(deps): bump golang.org/x/crypto from 0.5.0 to 0.6.0 by @dependabot in dexidp#2818
* build(deps): bump golang.org/x/net from 0.5.0 to 0.7.0 by @dependabot in dexidp#2828
* build(deps): bump golang.org/x/net from 0.4.0 to 0.7.0 in /api/v2 by @dependabot in dexidp#2832
* build(deps): bump golang.org/x/sys from 0.0.0-20220114195835-da31bd327af9 to 0.1.0 in /examples by @dependabot in dexidp#2837
* build(deps): bump golang.org/x/net from 0.0.0-20220114011407-0dd24b26b47d to 0.7.0 in /examples by @dependabot in dexidp#2846
* build(deps): bump golang from 1.20.0-alpine3.16 to 1.20.1-alpine3.16 by @dependabot in dexidp#2827
* build(deps): bump aquasecurity/trivy-action from 0.9.1 to 0.9.2 by @dependabot in dexidp#2850
* build(deps): bump golang from 1.20.1-alpine3.16 to 1.20.2-alpine3.16 by @dependabot in dexidp#2849
* feat: Bump gomplate 3.11.4 by @nabokihms in dexidp#2840
* build(deps): bump golang.org/x/crypto from 0.6.0 to 0.7.0 by @dependabot in dexidp#2856
* build(deps): bump golang.org/x/oauth2 from 0.4.0 to 0.6.0 by @dependabot in dexidp#2847
* build(deps): bump google.golang.org/api from 0.108.0 to 0.112.0 by @dependabot in dexidp#2853
* build(deps): bump google.golang.org/api from 0.112.0 to 0.114.0 by @dependabot in dexidp#2869
* build(deps): bump actions/setup-go from 3 to 4 by @dependabot in dexidp#2863
* build(deps): bump github.com/russellhaering/goxmldsig from 1.2.0 to 1.3.0 by @dependabot in dexidp#2862
* build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.30.0 by @dependabot in dexidp#2866
* build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.30.0 in /api/v2 by @dependabot in dexidp#2867
* build(deps): bump golang.org/x/crypto from 0.0.0-20220112180741-5e0467b6c7ce to 0.1.0 in /examples by @dependabot in dexidp#2845
* build(deps): bump google.golang.org/grpc from 1.52.0 to 1.53.0 in /api/v2 by @dependabot in dexidp#2816
* chore: upgrade tools by @sagikazarmark in dexidp#2870
### Other Changes
* Bump image in examples/k8s/dex.yaml to v2.32.0 by @stealthybox in dexidp#2569

## New Contributors
* @pinpox made their first contribution in dexidp#2733
* @nobuyo made their first contribution in dexidp#2740
* @dlipovetsky made their first contribution in dexidp#2790
* @seankhliao made their first contribution in dexidp#2812
* @stealthybox made their first contribution in dexidp#2569

**Full Changelog**: dexidp/dex@v2.35.3...v2.36.0
Cedric-Magnan pushed a commit to Cedric-Magnan/dex that referenced this pull request May 29, 2023
@nabokihms @Cedric-Magnan
fix: return 401 if password is invalid (dexidp#2796)
4a49c2f 
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
palexster pushed a commit to palexster/dex that referenced this pull request Oct 4, 2023
@nabokihms
fix: return 401 if password is invalid (dexidp#2796)
816d57c 
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
michaelliau pushed a commit to FlockFreight/dex that referenced this pull request Oct 4, 2023
@nabokihms @michaelliau
fix: return 401 if password is invalid (dexidp#2796)
fbb3e23 
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
@nabokihms nabokihms mentioned this pull request Oct 6, 2023
Merged
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dlipovetsky dlipovetsky dlipovetsky approved these changes

@sagikazarmark sagikazarmark Awaiting requested review from sagikazarmark

Assignees
No one assigned
Labels
release-note/enhancement Release note: Enhancements
Projects
None yet
Milestone
v2.36.0
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@nabokihms @dlipovetsky