oslokommune / gatekeeper Goto Github PK

When sending big requests (files/pictures/videos) through the proxy, Gatekeeper will block the request with an 413 request entity too large error. The limit is per now set to 1mb.

I suggest (without thinking about it really) that we set the limit to infinity, or something really high and let reverse proxies handle request limits. A counter argument is that not everyone uses reverse proxies, but I suggest we implement it when and if its needed. Debugging request limiting is a pain in the. .

I ninjamerged a temp fix here: #38

Any thoughts on how we should handle this?

When the access token is expired, but the refresh token is not, user info must be called twice to get user info.

Before first request to /userinfo:

• expired access token
• valid refresh token
  Endpoint returns 401 and sets a new access token and refresh token

Before second request to /userinfo:

• valid access token
• valid refresh token
  Endpoint returns 200 with user info

What I expected is that gatekeeper first refreshed the tokens, and then fetched the user info, so that only one request is necessary.

Would be nice with a descriptive error when one has misconfigured an upstream. Per now we get 500

We should either provide a adequate error message or redirect to frontend base URL in this case

The workflow pipeline.yaml is referencing action actions/checkout using references v1. However this reference is missing the commit a6747255bd19d7a757dbdda8c654a9f84db19839 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.

The Gatekeeper brags about being best practice, let's keep it that way.

PKCE is an extension of the Authentication Code flow which is supposed to enhance security, especially for public clients.

ref

Interrupting the server is a pain

Due to the Secure flag and no SSL locally, developing is subpar due to the difference in environment compared to prod.

This tool looks promising: https://github.com/FiloSottile/mkcert

cookies.clearStateId does not work as intended