Admin Web IDE OAuth mismatch callout: account for relative url
What does this MR do and why?
Currently we display the Web IDE OAuth mismatch callout in the Admin Area page if the request origin does not match any of the OAuth applications' redirect URL's origin. This may not necessary be true when taking relative urls into consideration. This MR aims to fix this case
To be safe, we should check if any of the redirect URLs listed matches the expected redirect URL with the following pattern: <base_url>/<relative_url>/-/ide/oauth_redirect
as we do in the frontend: Fix relative_url_root Web IDE OAuth issues (!161328 - merged).
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
With match | No match |
---|---|
Observed when:
|
How to set up and validate locally
Prerequisites:
Enable Web IDE OAuth flag
1\\. Make sure that \\\\\\\`web_ide_oauth\\\\\\\` feature flag is enabled by visiting \\\\\\\`/gitlab/rails/features\\\\\\\`Test out different domain case
1. Access the admin page via http://172.16.123.1:3000/gitlab/admin
Test out relative URL case: set up relative_url_root
locally in your GDK
relative_url_root
locally in your GDK- Stop GDK with
gdk stop
- Add
relative_url_root: "/gitlab"
to yourgdk.yml
- Run
gdk reconfigure
- In resulting
Procfile
, add-authBackend http://localhost:8080/gitlab
to the end of the line that starts withgitlab-workhorse:
(this is an issue withgitlab-workhorse
I discovered while testing. We'll fix theProcfile
generation in a separate MR) - Start GDK with
gdk start
- Now you can visit the GDK at
/gitlab
-
IMPORTANT: You might also need to disable
vite
, since that seems to haverelative_url_root
issues. https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/main/doc/configuration.md#vite-settings
Steps:
- In the Admin Area home page, should only observe callout if no base URL match found from the Web IDE OAuth application redirect URIs.