fix(idp): prevent server errors for idps using form post for callbacks (#9097)

# Which Problems Are Solved

Some IdP callbacks use HTTP form POST to return their data on callbacks.
For handling CSRF in the login after such calls, a 302 Found to the
corresponding non form callback (in ZITADEL) is sent. Depending on the
size of the initial form body, this could lead to ZITADEL terminating
the connection, resulting in the user not getting a response or an
intermediate proxy to return them an HTTP 502.

# How the Problems Are Solved

- the form body is parsed and stored into the ZITADEL cache (using the
configured database by default)
- the redirect (302 Found) is performed with the request id
- the callback retrieves the data from the cache instead of the query
parameters (will fallback to latter to handle open uncached requests)

# Additional Changes

- fixed a typo in the default (cache) configuration: `LastUsage` ->
`LastUseAge`

# Additional Context

- reported by a customer
- needs to be backported to current cloud version (2.66.x)

---------

Co-authored-by: Silvan <27845747+adlerhurst@users.noreply.github.com>
This commit is contained in:
Livio Spring
2025-01-06 10:47:46 +01:00
committed by GitHub
parent 79af682c9b
commit fa5e590aab
7 changed files with 108 additions and 15 deletions

View File

@@ -198,8 +198,11 @@ Caches:
AutoPrune:
Interval: 1m
TimeOut: 5s
# Postgres connector uses the configured database (postgres or cockraochdb) as cache.
# It is suitable for deployments with multiple containers.
# The cache is enabled by default because it is the default cache states for IdP form callbacks
Postgres:
Enabled: false
Enabled: true
AutoPrune:
Interval: 15m
TimeOut: 30s
@@ -311,7 +314,7 @@ Caches:
# When connector is empty, this cache will be disabled.
Connector: ""
MaxAge: 1h
LastUsage: 10m
LastUseAge: 10m
# Log enables cache-specific logging. Default to error log to stderr when omitted.
Log:
Level: error
@@ -322,7 +325,7 @@ Caches:
Milestones:
Connector: ""
MaxAge: 1h
LastUsage: 10m
LastUseAge: 10m
Log:
Level: error
AddSource: true
@@ -332,7 +335,17 @@ Caches:
Organization:
Connector: ""
MaxAge: 1h
LastUsage: 10m
LastUseAge: 10m
Log:
Level: error
AddSource: true
Formatter:
Format: text
# IdP callbacks using form POST cache, required for handling them securely and without possible too big request urls.
IdPFormCallbacks:
Connector: "postgres"
MaxAge: 1h
LastUseAge: 10m
Log:
Level: error
AddSource: true