Max Peintner and GitHub
14a5946db8
fix(login): better error handling for saml cookie serialization ( #10259 )
...
Fixes issues where SAML identity provider authentication would fail
silently, leaving users unable to complete the login flow through
external SAML providers.
changes `saml.ts`:
- Enhanced
[setSAMLFormCookie()](vscode-file://vscode-app/Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/code/electron-browser/workbench/workbench.html)
with proper error handling and logging
- Improved
[getSAMLFormCookie()](vscode-file://vscode-app/Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/code/electron-browser/workbench/workbench.html)
with detailed error reporting
- Added cookie size validation and warnings
changes `zitadel.ts`:
- Enhanced
[startIdentityProviderFlow()](vscode-file://vscode-app/Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/code/electron-browser/workbench/workbench.html)
with robust form data handling
- Added detailed logging for protobuf object structure analysis
- Implemented safe fallback serialization for complex objects
- Added comprehensive error handling for JSON operations
2025-07-15 07:46:18 +00:00
Elio Bischof and GitHub
0598abe7e6
chore(login): fix close pr action ( #10234 )
...
# Which Problems Are Solved
The close PR action fails
https://github.com/zitadel/typescript/actions/runs/16196332400/job/45723668837?pr=511
# How the Problems Are Solved
A backtick is escaped.
# Additional Context
- Completes #10229
2025-07-10 13:39:45 +00:00
Elio Bischof and GitHub
f9cad0f3e5
chore(typescript): improve close PR action ( #10229 )
...
# Which Problems Are Solved
The close PR action currently fails because of unescaped backticks.
# How the Problems Are Solved
Backticks are escaped.
# Additional Changes
- Adding a login remote immediately fetches for better UX.
- Adding a subtree is not necessary, as it is already added in the repo.
- Fix and clarify PR migration steps.
- Add workflow dispatch event
2025-07-10 13:10:44 +02:00
Max Peintner and GitHub
253beb4d39
fix(login): encode formpost data to cookie ( #10173 )
...
This PR implements a SAML cookie which is used to save information to
complete the form post. It is primarily used to avoid sending the
information as url search params and therefore reducing its length.
2025-07-07 16:11:14 +02:00
12656235e2
chore: fix login image with sha release ( #10157 )
...
# Which Problems Are Solved
Fixes the releasing of multi-architecture login images.
# How the Problems Are Solved
- The login-container workflow extends the bake definition with a file
docker-bake-release.hcl wich adds the platforms linux/arm and linux/amd
to all relevant build targets. The used technique is similar to how the
docker metadata action allows to extend the bake definitions.
- The local login tag is moved to the metadata bake target, which is
always inherited and overwritten in the pipeline
- Packages write permission is added
# Additional Changes
- The MIT license is noted in container labels and annotations
- The Image is built from root so that the local proto files are used
---------
Co-authored-by: Copilot <[email protected]
2025-07-03 13:10:10 +02:00
Max Peintner and GitHub
47f0486ee8
fix(login): email or phone query, session context from loginname ( #10158 )
...
This PR fixes an issue where the orQuery for phone and email was not
correctly set.
2025-07-03 08:07:34 +00:00
8c39779533
chore(deps): bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2 in /login/apps/login-test-acceptance/idp/oidc in the go_modules group across 1 directory ( #10152 )
...
Bumps the go_modules group with 1 update in the
/login/apps/login-test-acceptance/idp/oidc directory:
[github.com/go-chi/chi/v5](https://github.com/go-chi/chi ).
Updates `github.com/go-chi/chi/v5` from 5.2.1 to 5.2.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-chi/chi/releases ">github.com/go-chi/chi/v5's
releases</a>.</em></p>
<blockquote>
<h2>v5.2.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Use strings.Cut in a few places by <a
href="https://github.com/JRaspass "><code>@JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/971 ">go-chi/chi#971</a></li>
<li>Fix non-constant format strings in t.Fatalf by <a
href="https://github.com/JRaspass "><code>@JRaspass</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/972 ">go-chi/chi#972</a></li>
<li>Apply fieldalignment fixes to optimize struct memory layout by <a
href="https://github.com/pixel365 "><code>@pixel365</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/974 ">go-chi/chi#974</a></li>
<li>go 1.24 by <a
href="https://github.com/pkieltyka "><code>@pkieltyka</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/977 ">go-chi/chi#977</a></li>
<li>chore: delint ioutil usage by <a
href="https://github.com/costela "><code>@costela</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/962 ">go-chi/chi#962</a></li>
<li>Fixed typo in Router interface definition by <a
href="https://github.com/mithileshgupta12 "><code>@mithileshgupta12</code></a>
in <a
href="https://redirect.github.com/go-chi/chi/pull/958 ">go-chi/chi#958</a></li>
<li>Add support for TinyGo by <a
href="https://github.com/efraimbart "><code>@efraimbart</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/978 ">go-chi/chi#978</a></li>
<li>Exclude middleware/profiler.go in TinyGo, as there's no
net/http/pprof pkg by <a
href="https://github.com/cxjava "><code>@cxjava</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/982 ">go-chi/chi#982</a></li>
<li>Make use of strings.Cut by <a
href="https://github.com/scop "><code>@scop</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1005 ">go-chi/chi#1005</a></li>
<li>Change install command format to code block by <a
href="https://github.com/sglkc "><code>@sglkc</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/1001 ">go-chi/chi#1001</a></li>
<li>Correct documentation by <a
href="https://github.com/mrdomino "><code>@mrdomino</code></a> in <a
href="https://redirect.github.com/go-chi/chi/pull/992 ">go-chi/chi#992</a></li>
</ul>
<h2>Security fix</h2>
<ul>
<li>Fixes <a
href="https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93 ">GHSA-vrw8-fxc6-2r93</a>
- "Host Header Injection Leads to Open Redirect in
RedirectSlashes" <a
href="https://github.com/go-chi/chi/commit/1be7ad938cc9c5b39a9dea01a5c518848928ab65 ">commit</a>
<ul>
<li>a lower-severity Open Redirect that can't be exploited in browser or
email client, as it requires manipulation of a Host header</li>
<li>reported by Anuraag Baishya, <a
href="https://github.com/anuraagbaishya "><code>@anuraagbaishya</code></a>.
Thank you!</li>
</ul>
</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/pixel365 "><code>@pixel365</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/974 ">go-chi/chi#974</a></li>
<li><a
href="https://github.com/mithileshgupta12 "><code>@mithileshgupta12</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/958 ">go-chi/chi#958</a></li>
<li><a
href="https://github.com/efraimbart "><code>@efraimbart</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/978 ">go-chi/chi#978</a></li>
<li><a href="https://github.com/cxjava "><code>@cxjava</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/982 ">go-chi/chi#982</a></li>
<li><a href="https://github.com/sglkc "><code>@sglkc</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/1001 ">go-chi/chi#1001</a></li>
<li><a href="https://github.com/mrdomino "><code>@mrdomino</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-chi/chi/pull/992 ">go-chi/chi#992</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-chi/chi/compare/v5.2.1...v5.2.2 ">https://github.com/go-chi/chi/compare/v5.2.1...v5.2.2 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-chi/chi/commit/23c395f8524a30334126ca16fb4d37b88745b9b9 "><code>23c395f</code></a>
Correct documentation (<a
href="https://redirect.github.com/go-chi/chi/issues/992 ">#992</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/5516d147c14a2b03824be7076fc6200bed906901 "><code>5516d14</code></a>
docs: change install code to code block (<a
href="https://redirect.github.com/go-chi/chi/issues/1001 ">#1001</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/e235052c10146fb724439442fc9d9a23e19fe931 "><code>e235052</code></a>
Make use of strings.Cut (<a
href="https://redirect.github.com/go-chi/chi/issues/1005 ">#1005</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/1be7ad938cc9c5b39a9dea01a5c518848928ab65 "><code>1be7ad9</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/go-chi/chi/commit/d7034fdfdaefd10f1bc1a7b813bc979f2eda3a36 "><code>d7034fd</code></a>
Exclude profiler when use tinygo (<a
href="https://redirect.github.com/go-chi/chi/issues/982 ">#982</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/d04703412f631922c8dd1527c6500627174828c1 "><code>d047034</code></a>
support tinygo (<a
href="https://redirect.github.com/go-chi/chi/issues/978 ">#978</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/fe2c065bc046056aecfa141022509a1e25bdd04b "><code>fe2c065</code></a>
Fixed the typo (<a
href="https://redirect.github.com/go-chi/chi/issues/958 ">#958</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/1aae5b2d2dc8f9e8ea1f68a7462693aaaa5f368c "><code>1aae5b2</code></a>
chore: delint ioutil usage (<a
href="https://redirect.github.com/go-chi/chi/issues/962 ">#962</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/c6225e35a4880a9a884c135b5f847a74e1e3a01e "><code>c6225e3</code></a>
go 1.24 (<a
href="https://redirect.github.com/go-chi/chi/issues/977 ">#977</a>)</li>
<li><a
href="https://github.com/go-chi/chi/commit/e846b8304c769c4f1a51c9de06bebfaa4576bd88 "><code>e846b83</code></a>
Apply fieldalignment fixes to optimize struct memory layout (<a
href="https://redirect.github.com/go-chi/chi/issues/974 ">#974</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/go-chi/chi/compare/v5.2.1...v5.2.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/zitadel/zitadel/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <[email protected]
2025-07-02 12:32:16 +00:00
Max Peintner and GitHub
325aa1f184
fix(login): ensure correct i18n locale context ( #10156 )
...
This PR ensures that the correct locale context is set for the new login
2025-07-02 09:43:19 +00:00
2928c6ac2b
chore(login): migrate nextjs login to monorepo ( #10134 )
...
# Which Problems Are Solved
We move the login code to the zitadel repo.
# How the Problems Are Solved
The login repo is added to ./login as a git subtree pulled from the
dockerize-ci branch.
Apart from the login code, this PR contains the changes from #10116
# Additional Context
- Closes https://github.com/zitadel/typescript/issues/474
- Also merges #10116
- Merging is blocked by failing check because of:
- https://github.com/zitadel/zitadel/pull/10134#issuecomment-3012086106
---------
Co-authored-by: Max Peintner <[email protected] [email protected] [email protected]
2025-07-02 10:04:19 +02:00
Max PeintnerandGitHub
Elio BischofandGitHub
