merge fix/admin-client-no-redirect-r2 (569b504a5d) #62

Merged

pipeline-bot merged 1 commit from fix/admin-client-no-redirect-r2 into trunk 2026-07-27 18:23:25 +00:00

Conversation 0 Commits 1 Files changed 4 +90 -4

pipeline-bot commented 2026-07-27 18:22:55 +00:00

Contributor

Copy link

No description provided.

pipeline-bot added 1 commit 2026-07-27 18:23:00 +00:00

fix(security): refuse redirects on Kratos Admin API calls ... 569b504a5d

Pinning kratosAdminURL to the in-namespace kratos-admin Service pins
the URL the operator DIALS, not where the request ends up. The shared
client set no CheckRedirect, so Go followed up to ten redirects across
origins, and 307/308 replay the request body — which for createIdentity
and updateIdentity is the plaintext password read from the referenced
Secret.

That leaves the original confused-deputy open to the very actor the pin
defends against: anyone who can create a Service or EndpointSlice named
kratos-admin on port 4434 in their own namespace satisfies the pin, then
answers with a 307 and receives the credential.

The client now returns the 3xx to the caller instead of following it,
where it fails the status-code check like any other unexpected response.
This costs nothing: the Kratos Admin API never answers a legitimate
request with a redirect.

Both the shipped client and the tested client now come from one
controller.NewAdminHTTPClient constructor, so a future timeout or
transport change cannot reintroduce the gap on only one side — the
previous client was built inline in cmd/main.go, out of reach of every
test in the controller package.

The regression test drives createIdentity through a redirecting server
and asserts the redirect target receives nothing. Removing CheckRedirect
fails it with the password visible in the captured body.

pipeline-bot merged commit 6a76a73085 into trunk 2026-07-27 18:23:25 +00:00

pipeline-bot referenced this pull request from a commit 2026-07-27 18:23:28 +00:00

Merge pull request 'merge fix/admin-client-no-redirect-r2 (569b504a5d12)' (#62) from fix/admin-client-no-redirect-r2 into trunk

pipeline-bot deleted branch fix/admin-client-no-redirect-r2 2026-07-27 18:23:31 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/kratos-identity-operator!62

No description provided.