sean/kratos-identity-operator
Watch
1
0
Fork
You've already forked kratos-identity-operator
 0
Code Issues Pull requests Projects Releases 22 Packages Wiki Activity

merge fix/admin-client-no-redirect (a9edc9425d) #61

Closed
pipeline-bot wants to merge 1 commit from fix/admin-client-no-redirect into trunk
pull from: fix/admin-client-no-redirect
merge into: sean:trunk
Conversation 0 Commits 1 Files changed 4 +90 -4
pipeline-bot commented 2026-07-27 17:53:13 +00:00
Contributor
Copy link
No description provided.
fix(security): refuse redirects on Kratos Admin API calls
All checks were successful
pipeline/ci CI green va9edc9425d1a
Details
a9edc9425d
 
Pinning kratosAdminURL to the in-namespace kratos-admin Service pins
the URL the operator DIALS, not where the request ends up. The shared
client set no CheckRedirect, so Go followed up to ten redirects across
origins, and 307/308 replay the request body — which for createIdentity
and updateIdentity is the plaintext password read from the referenced
Secret.

That leaves the original confused-deputy open to the very actor the pin
defends against: anyone who can create a Service or EndpointSlice named
kratos-admin on port 4434 in their own namespace satisfies the pin, then
answers with a 307 and receives the credential.

The client now returns the 3xx to the caller instead of following it,
where it fails the status-code check like any other unexpected response.
This costs nothing: the Kratos Admin API never answers a legitimate
request with a redirect.

Both the shipped client and the tested client now come from one
controller.NewAdminHTTPClient constructor, so a future timeout or
transport change cannot reintroduce the gap on only one side — the
previous client was built inline in cmd/main.go, out of reach of every
test in the controller package.

The regression test drives createIdentity through a redirecting server
and asserts the redirect target receives nothing. Removing CheckRedirect
fails it with the password visible in the captured body.
pipeline-bot force-pushed fix/admin-client-no-redirect from a9edc9425d
All checks were successful
pipeline/ci CI green va9edc9425d1a
Details
to b1c1c7b1b7 2026-07-27 17:53:50 +00:00 Compare
gitea_admin closed this pull request 2026-07-28 07:42:09 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/kratos-identity-operator!61
No description provided.