Skip to content

Notify admin on Web IDE OAuth callback mismatch

Issue: Notify admins when visiting the GitLab applicat... (gitlab-web-ide#351 - closed)

What does this MR do and why?

When Web IDE OAuth is enabled for the GitLab instance and a user loads the Web IDE within a domain that does not match the callback URL (which is based on base_url that comes from the GitLab config), they will get an error upon redirecting. In this MR, a warning alert is shown to the instance admin if there is a mismatch between the GitLab instance and the GitLab config origin to prevent this issue from occurring.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

No domain mismatch With domain mismatch

no-mismatch.mov

No alert shown in the admin dashboard

mismatch.mov

Alert shown in the admin dashboard. Button click redirects to admin application page.

How to set up and validate locally

Setup

  • Ensure that the web_ide_oauth flag is enabled
  • Follow steps outlined here to reconfigure GDK with new host name if you haven't already
  • Pull this branch

Steps

  1. Access the GitLab application with http://127.0.0.1:3000. In console, check that gon.gitlab_url is http://gdk.test:3000.
  2. Navigate to /admin. Should see the new warning alert.
  3. Access the admin dashboard via http://gdk.test:3000/admin. Should not see the warning alert.
Edited by Cindy Halim

Merge request reports