Merge commit from fork

* Add DenyLists parsing * Remove unneeded returned error * Plug global denylist into Command * app creation: apply denylist to backchannel logout URI * Inject denylist to backchannel logout worker * webhook config: validate against blocked URLs * Add notificationsWebhook denylist target * command: Add SMTP endpoint validation against blocklist * command: Add SMS endpoint validation against blocklist * Validate webhook endpoint against denylist on channel notification * Remove unused tests * handle deprecated denylists * remove unintended denylist entry in deprecated list * use single http client * fix tests * update comments * fixes * cleanup * address comments * fix merge --------- Co-authored-by: Livio Spring <[email protected]>
2026-11-04 13:22:16 +00:00 · 2026-06-15 15:36:14 +02:00
parent d184e976fc
commit 8e82ec1cb9
97 changed files with 1834 additions and 285 deletions
@@ -26,7 +26,6 @@ import (
 	http_mw "github.com/zitadel/zitadel/internal/api/http/middleware"
 	"github.com/zitadel/zitadel/internal/api/ui/login"
 	"github.com/zitadel/zitadel/internal/crypto"
-	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/i18n"
 	"github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
@@ -58,7 +57,7 @@ type API struct {
 	targetEncryptionAlgorithm crypto.EncryptionAlgorithm
 	translator                *i18n.Translator
 	connectOTELInterceptor    *otelconnect.Interceptor
-	actionV2DenyList          []denylist.AddressChecker
+	httpClient                *http.Client
 }

 func (a *API) ListGrpcServices() []string {
@@ -113,7 +112,7 @@ func New(
 	targetEncryptionAlgorithm crypto.EncryptionAlgorithm,
 	translator *i18n.Translator,
 	trustRemoteSpans bool,
-	deniedIPList []denylist.AddressChecker,
+	httpClient *http.Client,
 ) (_ *API, err error) {
 	api := &API{
 		port:                      port,
@@ -129,10 +128,10 @@ func New(
 		connectServices:           make(map[string][]string),
 		targetEncryptionAlgorithm: targetEncryptionAlgorithm,
 		translator:                translator,
-		actionV2DenyList:          deniedIPList,
+		httpClient:                httpClient,
 	}

-	api.grpcServer = server.CreateServer(api.verifier, systemAuthz, authZ, queries, externalDomain, tlsConfig, accessInterceptor.AccessService(), targetEncryptionAlgorithm, api.translator, deniedIPList)
+	api.grpcServer = server.CreateServer(api.verifier, systemAuthz, authZ, queries, externalDomain, tlsConfig, accessInterceptor.AccessService(), targetEncryptionAlgorithm, api.translator, httpClient)
 	api.grpcGateway, err = server.CreateGateway(ctx, port, hostHeaders, accessInterceptor, tlsConfig)
 	if err != nil {
 		return nil, err
@@ -224,7 +223,7 @@ func (a *API) registerConnectServer(service server.ConnectServer) {
 		connect_middleware.AuthorizationInterceptor(a.verifier, a.systemAuthZ, a.authConfig),
 		connect_middleware.TranslationHandler(),
 		connect_middleware.QuotaExhaustedInterceptor(a.accessInterceptor.AccessService(), system_pb.SystemService_ServiceDesc.ServiceName),
-		connect_middleware.ExecutionHandler(a.targetEncryptionAlgorithm, a.queries.GetActiveSigningWebKey, a.actionV2DenyList),
+		connect_middleware.ExecutionHandler(a.targetEncryptionAlgorithm, a.queries.GetActiveSigningWebKey, a.httpClient),
 		connect_middleware.ValidationHandler(),
 		connect_middleware.ServiceHandler(),
 		connect_middleware.ActivityInterceptor(),
@@ -13,7 +13,6 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	http_utils "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/crypto"
-	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/execution"
 	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
@@ -27,12 +26,12 @@ var headersToForward = map[string]bool{
 	strings.ToLower(http_utils.Origin):        true,
 }

-func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) connect.UnaryInterceptorFunc {
+func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) connect.UnaryInterceptorFunc {
 	return func(handler connect.UnaryFunc) connect.UnaryFunc {
 		return func(ctx context.Context, req connect.AnyRequest) (_ connect.AnyResponse, err error) {

 			requestTargets := execution.QueryExecutionTargetsForRequest(ctx, req.Spec().Procedure)
-			handledReq, err := executeTargetsForRequest(ctx, requestTargets, req.Spec().Procedure, req, alg, activeSigningKey, deniedIPList)
+			handledReq, err := executeTargetsForRequest(ctx, requestTargets, req.Spec().Procedure, req, alg, activeSigningKey, httpClient)
 			if err != nil {
 				return nil, err
 			}
@@ -43,12 +42,12 @@ func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution
 			}

 			responseTargets := execution.QueryExecutionTargetsForResponse(ctx, req.Spec().Procedure)
-			return executeTargetsForResponse(ctx, responseTargets, req.Spec().Procedure, handledReq, response, alg, activeSigningKey, deniedIPList)
+			return executeTargetsForResponse(ctx, responseTargets, req.Spec().Procedure, handledReq, response, alg, activeSigningKey, httpClient)
 		}
 	}
 }

-func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ connect.AnyRequest, err error) {
+func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) (_ connect.AnyRequest, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()

@@ -68,14 +67,14 @@ func executeTargetsForRequest(ctx context.Context, targets []target_domain.Targe
 		Headers:    SetRequestHeaders(req.Header()),
 	}

-	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
+	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, httpClient)
 	if err != nil {
 		return nil, err
 	}
 	return req, nil
 }

-func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, resp connect.AnyResponse, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ connect.AnyResponse, err error) {
+func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, resp connect.AnyResponse, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) (_ connect.AnyResponse, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()

@@ -96,7 +95,7 @@ func executeTargetsForResponse(ctx context.Context, targets []target_domain.Targ
 		Headers:    SetRequestHeaders(req.Header()),
 	}

-	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
+	_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey, httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -75,9 +75,7 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
 }

 func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
-	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
-	require.NoError(t, err)
-	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
+	deniedIPs := []denylist.AddressChecker{denylist.NewHostChecker("127.0.0.1")}

 	type target struct {
 		reqBody             execution.ContextInfo
@@ -668,7 +666,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 				tt.args.req,
 				nil,
 				tt.args.getActiveSigningWebKey,
-				tt.args.deniedIPs,
+				&http.Client{Transport: denylist.NewHTTPTransport(tt.args.deniedIPs)},
 			)

 			if tt.res.wantErr {
@@ -774,9 +772,7 @@ func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
 }

 func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
-	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
-	require.NoError(t, err)
-	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
+	deniedIPs := []denylist.AddressChecker{denylist.NewHostChecker("127.0.0.1")}
 	type target struct {
 		reqBody    execution.ContextInfo
 		sleep      time.Duration
@@ -942,7 +938,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 				tt.args.resp,
 				nil,
 				mockGetActiveSigningWebKey(),
-				tt.args.deniedIPs,
+				&http.Client{Transport: denylist.NewHTTPTransport(tt.args.deniedIPs)},
 			)

 			if tt.res.wantErr {
@@ -13,17 +13,16 @@ import (
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/api/grpc/server/connect_middleware"
 	"github.com/zitadel/zitadel/internal/crypto"
-	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/execution"
 	target_domain "github.com/zitadel/zitadel/internal/execution/target"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 )

-func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) grpc.UnaryServerInterceptor {
+func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) grpc.UnaryServerInterceptor {
 	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
 		requestTargets := execution.QueryExecutionTargetsForRequest(ctx, info.FullMethod)
 		// call targets otherwise return req
-		handledReq, err := executeTargetsForRequest(ctx, requestTargets, info.FullMethod, req, alg, activeSigningKey, deniedIPList)
+		handledReq, err := executeTargetsForRequest(ctx, requestTargets, info.FullMethod, req, alg, activeSigningKey, httpClient)
 		if err != nil {
 			return nil, err
 		}
@@ -34,11 +33,11 @@ func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution
 		}

 		responseTargets := execution.QueryExecutionTargetsForResponse(ctx, info.FullMethod)
-		return executeTargetsForResponse(ctx, responseTargets, info.FullMethod, handledReq, response, alg, activeSigningKey, deniedIPList)
+		return executeTargetsForResponse(ctx, responseTargets, info.FullMethod, handledReq, response, alg, activeSigningKey, httpClient)
 	}
 }

-func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req any, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ interface{}, err error) {
+func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req any, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) (_ interface{}, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()

@@ -59,10 +58,10 @@ func executeTargetsForRequest(ctx context.Context, targets []target_domain.Targe
 		Headers:    connect_middleware.SetRequestHeaders(md),
 	}

-	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
+	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, httpClient)
 }

-func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req, resp interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, deniedIPList []denylist.AddressChecker) (_ interface{}, err error) {
+func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req, resp interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey, httpClient *http.Client) (_ interface{}, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()

@@ -84,7 +83,7 @@ func executeTargetsForResponse(ctx context.Context, targets []target_domain.Targ
 		Headers:    connect_middleware.SetRequestHeaders(md),
 	}

-	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, deniedIPList)
+	return execution.CallTargets(ctx, targets, info, alg, activeSigningKey, httpClient)
 }

 var _ execution.ContextInfo = &ContextInfoRequest{}
@@ -64,9 +64,7 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
 }

 func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
-	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
-	require.NoError(t, err)
-	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
+	deniedIPs := []denylist.AddressChecker{denylist.NewHostChecker("127.0.0.1")}

 	type target struct {
 		reqBody             execution.ContextInfo
@@ -656,7 +654,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
 				tt.args.req,
 				nil,
 				tt.args.getActiveSigningWebKey,
-				tt.args.deniedIPs,
+				&http.Client{Transport: denylist.NewHTTPTransport(tt.args.deniedIPs)},
 			)

 			if tt.res.wantErr {
@@ -762,9 +760,7 @@ func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
 }

 func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
-	deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
-	require.NoError(t, err)
-	deniedIPs := []denylist.AddressChecker{deniedLocalhost}
+	deniedIPs := []denylist.AddressChecker{denylist.NewHostChecker("127.0.0.1")}

 	type target struct {
 		reqBody    execution.ContextInfo
@@ -930,7 +926,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
 				tt.args.resp,
 				nil,
 				mockGetActiveSigningWebKey(),
-				tt.args.deniedIPs,
+				&http.Client{Transport: denylist.NewHTTPTransport(tt.args.deniedIPs)},
 			)

 			if tt.res.wantErr {
@@ -16,7 +16,6 @@ import (
 	grpc_api "github.com/zitadel/zitadel/internal/api/grpc"
 	"github.com/zitadel/zitadel/internal/api/grpc/server/middleware"
 	"github.com/zitadel/zitadel/internal/crypto"
-	"github.com/zitadel/zitadel/internal/denylist"
 	"github.com/zitadel/zitadel/internal/i18n"
 	"github.com/zitadel/zitadel/internal/logstore"
 	"github.com/zitadel/zitadel/internal/logstore/record"
@@ -69,7 +68,7 @@ func CreateServer(
 	accessSvc *logstore.Service[*record.AccessLog],
 	targetEncAlg crypto.EncryptionAlgorithm,
 	translator *i18n.Translator,
-	deniedIPList []denylist.AddressChecker,
+	httpClient *http.Client,
 ) *grpc.Server {
 	metricTypes := []metrics.MetricType{metrics.MetricTypeTotalCount, metrics.MetricTypeRequestCount, metrics.MetricTypeStatusCode}
 	serverOptions := []grpc.ServerOption{
@@ -87,7 +86,7 @@ func CreateServer(
 				middleware.AuthorizationInterceptor(verifier, systemAuthz, authConfig),
 				middleware.TranslationHandler(),
 				middleware.QuotaExhaustedInterceptor(accessSvc, system_pb.SystemService_ServiceDesc.ServiceName),
-				middleware.ExecutionHandler(targetEncAlg, queries.GetActiveSigningWebKey, deniedIPList),
+				middleware.ExecutionHandler(targetEncAlg, queries.GetActiveSigningWebKey, httpClient),
 				middleware.ValidationHandler(),
 				middleware.ServiceHandler(),
 				middleware.ActivityInterceptor(),
@@ -0,0 +1,131 @@
+package http
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/denylist"
+)
+
+type ClientConfig struct {
+	MaxBodySize         int64
+	Timeout             time.Duration
+	MaxRedirects        int
+	AllowHTTPSDowngrade bool
+	DenyList            []denylist.AddressChecker
+}
+
+// NewClient returns a new http.Client with the configured settings.
+// The client is protected against DNS rebinding attacks, redirects, HTTPs downgrades, and response body size limits.
+func (c *ClientConfig) NewClient() *http.Client {
+	baseTransport := denylist.NewHTTPTransport(c.DenyList)
+
+	protectedTransport := &MaxBytesRoundTripper{
+		Underlying: baseTransport,
+		MaxBytes:   c.MaxBodySize,
+	}
+
+	return &http.Client{
+		Transport: protectedTransport,
+		Timeout:   c.Timeout,
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			if len(via) >= c.MaxRedirects {
+				return ErrTooManyRedirects
+			}
+			if !c.AllowHTTPSDowngrade && len(via) > 0 {
+				prev := via[len(via)-1]
+				if prev != nil && prev.URL != nil && req.URL != nil &&
+					strings.EqualFold(prev.URL.Scheme, "https") &&
+					!strings.EqualFold(req.URL.Scheme, "https") {
+					return ErrHTTPsDowngrade
+				}
+			}
+			return denylist.IsURLBlocked(c.DenyList, req.URL, nil)
+		},
+	}
+}
+
+// MergeDeprecatedDenylists merges the two deprecated (actions) denylists into the main denylist.
+func (c *ClientConfig) MergeDeprecatedDenylists(actionsV1, actionsV2 []denylist.AddressChecker) {
+	c.DenyList = append(c.DenyList, actionsV1...)
+	c.DenyList = append(c.DenyList, actionsV2...)
+}
+
+var (
+	// ErrResponseTooLarge is returned when the response body exceeds the configured limit.
+	ErrResponseTooLarge = errors.New("response body exceeded maximum allowed size")
+	//ErrTooManyRedirects is returned when the number of redirects exceeds the configured limit.
+	ErrTooManyRedirects = errors.New("stopped after too many redirects")
+	// ErrHTTPsDowngrade is returned when the client attempts to downgrade to HTTP.
+	ErrHTTPsDowngrade = errors.New("redirect downgrade from https to http is not allowed")
+)
+
+// MaxBytesRoundTripper wraps an existing RoundTripper to protect against OOM.
+type MaxBytesRoundTripper struct {
+	Underlying http.RoundTripper
+	MaxBytes   int64
+}
+
+func (m *MaxBytesRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	transport := m.Underlying
+	if transport == nil {
+		transport = http.DefaultTransport
+	}
+
+	resp, err := transport.RoundTrip(req)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp.ContentLength > m.MaxBytes {
+		resp.Body.Close()
+		return nil, fmt.Errorf("%w: Content-Length is %d (limit %d)", ErrResponseTooLarge, resp.ContentLength, m.MaxBytes)
+	}
+
+	resp.Body = &strictMaxBytesReader{
+		limitReader: io.LimitReader(resp.Body, m.MaxBytes+1), // We initialize with +1 to detect overflows during Read
+		closer:      resp.Body,
+		limit:       m.MaxBytes,
+	}
+
+	return resp, nil
+}
+
+var _ http.RoundTripper = (*MaxBytesRoundTripper)(nil)
+
+// strictMaxBytesReader enforces a hard limit and returns an explicit error if exceeded.
+type strictMaxBytesReader struct {
+	limitReader io.Reader
+	closer      io.Closer
+	limit       int64
+	bytesRead   int64
+}
+
+func (s *strictMaxBytesReader) Read(p []byte) (int, error) {
+	n, err := s.limitReader.Read(p)
+	s.bytesRead += int64(n)
+
+	if s.bytesRead > s.limit {
+		// Because LimitReader stops at limit+1, excess is mathematically guaranteed to be 1
+		safeN := n - 1
+		if safeN < 0 {
+			safeN = 0
+		}
+
+		// This instantly slices off that single offending byte from the view of the caller
+		p = p[:safeN]
+		return safeN, ErrResponseTooLarge
+	}
+
+	return n, err
+}
+
+func (s *strictMaxBytesReader) Close() error {
+	return s.closer.Close()
+}
+
+var _ io.ReadCloser = (*strictMaxBytesReader)(nil)
@@ -0,0 +1,144 @@
+package http
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/zitadel/zitadel/internal/denylist"
+)
+
+func TestClientConfig_NewClient_Allowed(t *testing.T) {
+	t.Parallel()
+
+	// Spin up a simple local test server to serve a dummy response
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("hello world"))
+	}))
+	defer server.Close()
+
+	// An empty denylist permits all safe destinations
+	cfg := &ClientConfig{
+		MaxBodySize:  1024,
+		Timeout:      2 * time.Second,
+		MaxRedirects: 3,
+		DenyList:     []denylist.AddressChecker{},
+	}
+
+	client := cfg.NewClient()
+	req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, server.URL, nil)
+	assert.NoError(t, err)
+
+	resp, err := client.Do(req)
+	assert.NoError(t, err)
+	if resp != nil {
+		defer resp.Body.Close()
+		body, err := io.ReadAll(resp.Body)
+		assert.NoError(t, err)
+		assert.Equal(t, "hello world", string(body))
+	}
+}
+
+func TestClientConfig_Redirect_HTTPSDowngradeBlocked(t *testing.T) {
+	t.Parallel()
+
+	cfg := &ClientConfig{
+		MaxBodySize:         1024,
+		Timeout:             2 * time.Second,
+		MaxRedirects:        3,
+		AllowHTTPSDowngrade: false, // Explicitly disallow downgrades
+		DenyList:            []denylist.AddressChecker{},
+	}
+
+	client := cfg.NewClient()
+
+	// Mock a historical request chain moving from a secure schema to an unencrypted target
+	viaReq, _ := http.NewRequest(http.MethodGet, "https://secure-identity.com/oauth", nil)
+	currentReq, _ := http.NewRequest(http.MethodGet, "http://insecure-identity.com/callback", nil)
+
+	err := client.CheckRedirect(currentReq, []*http.Request{viaReq})
+	assert.ErrorIs(t, err, ErrHTTPsDowngrade)
+}
+
+func TestMaxBytesRoundTripper_EnforcesCap(t *testing.T) {
+	t.Parallel()
+
+	// Spin up a local server delivering an exact 10-byte payload response string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte("0123456789"))
+	}))
+	defer server.Close()
+
+	tests := []struct {
+		name        string
+		maxBytes    int64
+		expectError error
+	}{
+		{
+			name:        "body cleanly within threshold limit",
+			maxBytes:    15,
+			expectError: nil,
+		},
+		{
+			name:        "body matches boundary size exactly",
+			maxBytes:    10,
+			expectError: nil,
+		},
+		{
+			name:        "body exceeds allowable limit",
+			maxBytes:    5,
+			expectError: ErrResponseTooLarge,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := &ClientConfig{
+				MaxBodySize:  tt.maxBytes,
+				Timeout:      2 * time.Second,
+				MaxRedirects: 3,
+				DenyList:     []denylist.AddressChecker{},
+			}
+
+			client := cfg.NewClient()
+			req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, server.URL, nil)
+			resp, err := client.Do(req)
+
+			if tt.expectError != nil {
+				// Depending on optimization, errors can trip directly on call or during chunk reading
+				if err != nil {
+					assert.ErrorIs(t, err, tt.expectError)
+					return
+				}
+				defer resp.Body.Close()
+				_, readErr := io.ReadAll(resp.Body)
+				assert.ErrorIs(t, readErr, tt.expectError)
+			} else {
+				assert.NoError(t, err)
+				defer resp.Body.Close()
+				body, readErr := io.ReadAll(resp.Body)
+				assert.NoError(t, readErr)
+				assert.Equal(t, 10, len(body))
+			}
+		})
+	}
+}
+
+func TestClientConfig_MergeDeprecatedDenylists(t *testing.T) {
+	t.Parallel()
+
+	cfg := &ClientConfig{DenyList: []denylist.AddressChecker{denylist.NewHostChecker("1.1.1.1")}}
+
+	v1 := []denylist.AddressChecker{denylist.NewHostChecker("2.2.2.2")}
+	v2 := []denylist.AddressChecker{denylist.NewHostChecker("3.3.3.3")}
+
+	cfg.MergeDeprecatedDenylists(v1, v2)
+
+	assert.Len(t, cfg.DenyList, 3)
+}
@@ -127,6 +127,7 @@ func NewServer(
 	fallbackLogger *slog.Logger,
 	hashConfig crypto.HashConfig,
 	federatedLogoutCache cache.Cache[federatedlogout.Index, string, *federatedlogout.FederatedLogout],
+	httpClient *http.Client,
 ) (*Server, error) {
 	opConfig, err := createOPConfig(config, defaultLogoutRedirectURI, cryptoKey)
 	if err != nil {
@@ -189,6 +190,7 @@ func NewServer(
 		targetEncryptionAlgorithm:  targetEncryptionAlgorithm,
 		opCrypto:                   alg,
 		assetAPIPrefix:             assets.AssetAPI(),
+		httpClient:                 httpClient,
 	}
 	metricTypes := []metrics.MetricType{metrics.MetricTypeRequestCount, metrics.MetricTypeStatusCode, metrics.MetricTypeTotalCount}
 	server.Handler = op.RegisterLegacyServer(server,
@@ -44,6 +44,7 @@ type Server struct {
 	opCrypto                  op.Crypto

 	assetAPIPrefix func(ctx context.Context) string
+	httpClient     *http.Client
 }

 func endpoints(endpointConfig *EndpointConfig) op.Endpoints {
@@ -424,7 +424,7 @@ func (s *Server) userinfoFlows(ctx context.Context, qu *query.OIDCUserInfo, user
 			apiFields,
 			action.Script,
 			action.Name,
-			append(actions.ActionToOptions(action), actions.WithHTTP(actionCtx), actions.WithUUID(actionCtx))...,
+			append(actions.ActionToOptions(action), actions.WithHTTP(actionCtx, s.httpClient), actions.WithUUID(actionCtx))...,
 		)
 		cancel()
 		if err != nil {
@@ -461,7 +461,7 @@ func (s *Server) userinfoFlows(ctx context.Context, qu *query.OIDCUserInfo, user
 		UserGrants:   qu.UserGrants,
 	}

-	resp, err := execution.CallTargets(ctx, executionTargets, info, s.targetEncryptionAlgorithm, s.query.GetActiveSigningWebKey, s.command.ActionsV2DenyList)
+	resp, err := execution.CallTargets(ctx, executionTargets, info, s.targetEncryptionAlgorithm, s.query.GetActiveSigningWebKey, s.httpClient)
 	if err != nil {
 		return err
 	}
@@ -48,6 +48,7 @@ func NewProvider(
 	instanceHandler,
 	userAgentCookie func(http.Handler) http.Handler,
 	accessHandler *middleware.AccessInterceptor,
+	httpClient *http.Client,
 ) (*Provider, error) {
 	metricTypes := []metrics.MetricType{metrics.MetricTypeRequestCount, metrics.MetricTypeStatusCode, metrics.MetricTypeTotalCount}

@@ -63,6 +64,7 @@ func NewProvider(
 		fmt.Sprintf("%s%s?%s=", login.HandlerPrefix, login.EndpointLogin, login.QueryAuthRequestID),
 		conf.DefaultLoginURLV2,
 		ContextToIssuer,
+		httpClient,
 	)
 	if err != nil {
 		return nil, err
@@ -125,6 +127,7 @@ func newStorage(
 	defaultLoginURL string,
 	defaultLoginURLV2 string,
 	contextToIssuer func(context.Context) string,
+	actionHttpClient *http.Client,
 ) (*Storage, error) {
 	return &Storage{
 		encAlg:            encAlg,
@@ -138,6 +141,7 @@ func newStorage(
 		defaultLoginURL:   defaultLoginURL,
 		defaultLoginURLv2: defaultLoginURLV2,
 		contextToIssuer:   contextToIssuer,
+		httpClient:        actionHttpClient,
 	}, nil
 }

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"net/http"
 	"strings"
 	"time"

@@ -66,6 +67,7 @@ type Storage struct {
 	defaultLoginURL   string
 	defaultLoginURLv2 string
 	contextToIssuer   func(context.Context) string
+	httpClient        *http.Client
 }

 func (p *Storage) GetEntityByID(ctx context.Context, entityID string) (*serviceprovider.ServiceProvider, error) {
@@ -380,7 +382,7 @@ func (p *Storage) getCustomAttributes(ctx context.Context, user *query.User, use
 			apiFields,
 			action.Script,
 			action.Name,
-			append(actions.ActionToOptions(action), actions.WithHTTP(actionCtx))...,
+			append(actions.ActionToOptions(action), actions.WithHTTP(actionCtx, p.httpClient))...,
 		)
 		cancel()
 		if err != nil {
@@ -401,7 +403,7 @@ func (p *Storage) getCustomAttributes(ctx context.Context, user *query.User, use
 		UserGrants: userGrants.UserGrants,
 	}

-	resp, err := execution.CallTargets(ctx, executionTargets, info, p.targetEncAlg, p.query.GetActiveSigningWebKey, p.command.ActionsV2DenyList)
+	resp, err := execution.CallTargets(ctx, executionTargets, info, p.targetEncAlg, p.query.GetActiveSigningWebKey, p.httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -152,7 +152,7 @@ func (l *Login) runPostExternalAuthenticationActions(
 			apiFields,
 			a.Script,
 			a.Name,
-			append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx), actions.WithUUID(actionCtx))...,
+			append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx, l.httpClient), actions.WithUUID(actionCtx))...,
 		)
 		cancel()
 		if err != nil {
@@ -226,7 +226,7 @@ func (l *Login) runPostInternalAuthenticationActions(
 			apiFields,
 			a.Script,
 			a.Name,
-			append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx), actions.WithUUID(actionCtx))...,
+			append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx, l.httpClient), actions.WithUUID(actionCtx))...,
 		)
 		cancel()
 		if err != nil {
@@ -346,7 +346,7 @@ func (l *Login) runPreCreationActions(
 			apiFields,
 			a.Script,
 			a.Name,
-			append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx), actions.WithUUID(actionCtx))...,
+			append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx, l.httpClient), actions.WithUUID(actionCtx))...,
 		)
 		cancel()
 		if err != nil {
@@ -423,7 +423,7 @@ func (l *Login) runPostCreationActions(
 			apiFields,
 			a.Script,
 			a.Name,
-			append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx), actions.WithUUID(actionCtx))...,
+			append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx, l.httpClient), actions.WithUUID(actionCtx))...,
 		)
 		cancel()
 		if err != nil {
@@ -1053,6 +1053,7 @@ func (l *Login) googleProvider(ctx context.Context, identityProvider *query.IDPT
 		secret,
 		l.baseURL(ctx)+EndpointExternalLoginCallback,
 		identityProvider.GoogleIDPTemplate.Scopes,
+		l.httpClient,
 	)
 }

@@ -1079,6 +1080,7 @@ func (l *Login) oidcProvider(ctx context.Context, identityProvider *query.IDPTem
 		l.baseURL(ctx)+EndpointExternalLoginCallback,
 		identityProvider.OIDCIDPTemplate.Scopes,
 		openid.DefaultMapper,
+		l.httpClient,
 		opts...,
 	)
 }
@@ -1092,6 +1094,7 @@ func (l *Login) jwtProvider(identityProvider *query.IDPTemplate) (*jwt.Provider,
 		identityProvider.JWTIDPTemplate.HeaderName,
 		identityProvider.JWTIDPTemplate.Audience,
 		l.idpConfigAlg,
+		l.httpClient,
 	)
 }

@@ -1123,6 +1126,7 @@ func (l *Login) oauthProvider(ctx context.Context, identityProvider *query.IDPTe
 		func() idp.User {
 			return oauth.NewUserMapper(identityProvider.OAuthIDPTemplate.IDAttribute)
 		},
+		l.httpClient,
 		opts...,
 	)
 }
@@ -1176,6 +1180,7 @@ func (l *Login) samlProvider(ctx context.Context, identityProvider *query.IDPTem
 		identityProvider.Metadata,
 		identityProvider.Certificate,
 		key,
+		l.httpClient,
 		opts...,
 	)
 }
@@ -1198,6 +1203,7 @@ func (l *Login) azureProvider(ctx context.Context, identityProvider *query.IDPTe
 		secret,
 		l.baseURL(ctx)+EndpointExternalLoginCallback,
 		identityProvider.AzureADIDPTemplate.Scopes,
+		l.httpClient,
 		opts...,
 	)
 }
@@ -1212,6 +1218,7 @@ func (l *Login) githubProvider(ctx context.Context, identityProvider *query.IDPT
 		secret,
 		l.baseURL(ctx)+EndpointExternalLoginCallback,
 		identityProvider.GitHubIDPTemplate.Scopes,
+		l.httpClient,
 	)
 }

@@ -1229,6 +1236,7 @@ func (l *Login) githubEnterpriseProvider(ctx context.Context, identityProvider *
 		identityProvider.GitHubEnterpriseIDPTemplate.TokenEndpoint,
 		identityProvider.GitHubEnterpriseIDPTemplate.UserEndpoint,
 		identityProvider.GitHubIDPTemplate.Scopes,
+		l.httpClient,
 	)
 }

@@ -1242,6 +1250,7 @@ func (l *Login) gitlabProvider(ctx context.Context, identityProvider *query.IDPT
 		secret,
 		l.baseURL(ctx)+EndpointExternalLoginCallback,
 		identityProvider.GitLabIDPTemplate.Scopes,
+		l.httpClient,
 	)
 }

@@ -1257,6 +1266,7 @@ func (l *Login) gitlabSelfHostedProvider(ctx context.Context, identityProvider *
 		secret,
 		l.baseURL(ctx)+EndpointExternalLoginCallback,
 		identityProvider.GitLabSelfHostedIDPTemplate.Scopes,
+		l.httpClient,
 	)
 }

@@ -1272,6 +1282,7 @@ func (l *Login) appleProvider(ctx context.Context, identityProvider *query.IDPTe
 		l.baseURL(ctx)+EndpointExternalLoginCallbackFormPost,
 		privateKey,
 		identityProvider.AppleIDPTemplate.Scopes,
+		l.httpClient,
 	)
 }

@@ -44,6 +44,7 @@ type Login struct {
 	idpConfigAlg        crypto.EncryptionAlgorithm
 	userCodeAlg         crypto.EncryptionAlgorithm
 	caches              *Caches
+	httpClient          *http.Client
 }

 type Config struct {
@@ -198,6 +199,7 @@ func CreateLogin(
 	csrfCookieKey []byte,
 	cacheConnectors connector.Connectors,
 	federateLogoutCache cache.Cache[federatedlogout.Index, string, *federatedlogout.FederatedLogout],
+	httpClient *http.Client,
 ) (*Login, error) {
 	login := &Login{
 		oidcAuthCallbackURL: oidcAuthCallbackURL,
@@ -210,6 +212,7 @@ func CreateLogin(
 		authRepo:            authRepo,
 		idpConfigAlg:        idpConfigAlg,
 		userCodeAlg:         userCodeAlg,
+		httpClient:          httpClient,
 	}
 	csrfInterceptor := createCSRFInterceptor(config.CSRFCookieName, csrfCookieKey, externalSecure, login.csrfErrorHandler())
 	cacheInterceptor := createCacheInterceptor(config.Cache.MaxAge, config.Cache.SharedMaxAge, assetCache)