TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-02-28 23:07:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(oidc / login v2): always us login v2 if x-zitadel-login-client header is sent (#9336)

Browse Source 
# Which Problems Are Solved

As reported in #9311, even when providing a `x-zitadel-login-client`
header, the auth request would be created as hosted login UI / V1
request.
This is due to a change introduced with #9071, where the login UI
version can be specified using the app configuration.
The configuration set to V1 was not considering if the header was sent.

# How the Problems Are Solved

- Check presence of `x-zitadel-login-client` before the configuration.
Use later only if no header is set.

# Additional Changes

None

# Additional Context

- closes #9311 
- needs back ports to 2.67.x, 2.68.x and 2.69.x
This commit is contained in:
Livio Spring 2025-02-10 14:46:28 +01:00 committed by GitHub
parent b63c5fdb17
commit e7a73eb6b1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
internal/api/oidc/auth_request.go
View File

@ -46,6 +46,11 @@ func (o *OPStorage) CreateAuthRequest(ctx context.Context, req *oidc.AuthRequest
headers, _ := http_utils.HeadersFromCtx(ctx) headers, _ := http_utils.HeadersFromCtx(ctx)
loginClient := headers.Get(LoginClientHeader) loginClient := headers.Get(LoginClientHeader)
// for backwards compatibility we'll use the new login if the header is set (no matter the other configs)
if loginClient != "" {
return o.createAuthRequestLoginClient(ctx, req, userID, loginClient)
}
// if the instance requires the v2 login, use it no matter what the application configured // if the instance requires the v2 login, use it no matter what the application configured
if authz.GetFeatures(ctx).LoginV2.Required { if authz.GetFeatures(ctx).LoginV2.Required {
return o.createAuthRequestLoginClient(ctx, req, userID, loginClient) return o.createAuthRequestLoginClient(ctx, req, userID, loginClient)
@ -64,10 +69,7 @@ func (o *OPStorage) CreateAuthRequest(ctx context.Context, req *oidc.AuthRequest
case domain.LoginVersionUnspecified: case domain.LoginVersionUnspecified:
fallthrough fallthrough
default: default:
// if undefined, use the v2 login if the header is sent, to retain the current behavior // since we already checked for a login header, we can fall back to the v1 login
if loginClient != "" {
return o.createAuthRequestLoginClient(ctx, req, userID, loginClient)
}
return o.createAuthRequest(ctx, req, userID) return o.createAuthRequest(ctx, req, userID)
} }
} }