starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Add support for form_post OIDC callbacks #618

New Issue
Closed
opened 2025-12-29 02:21:15 +01:00 by adam · 2 comments
adam commented 2025-12-29 02:21:15 +01:00
Owner
Copy Link

Originally created by @paxswill on GitHub (Jan 28, 2024).

Why

Some OIDC providers only support response_mode=form_post for the callback (ex: Apple, which requires form_post when including the email scope).

Description

Instead of performinga GET with data encoded in query parameters, form_post tells the provider to perform a POST to the callback endpoint. The changes are pretty straightforward:

  • The callback handler needs to be configured to accept both GET and POST (right now it only accepts GET)
  • The implementation of the callback endpoint should be able to extract the code and state values from either the URL (as query parameters) or form data.

Sample/Test Implementation

I went and implemented these changes in a fork, and with these changes Sign in with Apple works where it would fail before with an unexpected 404 (technically should be a 405).

Originally created by @paxswill on GitHub (Jan 28, 2024). ## Why Some OIDC providers only support `response_mode=form_post` for the callback (ex: Apple, which requires `form_post` when including the email scope). ## Description Instead of performinga GET with data encoded in query parameters, `form_post` tells the provider to perform a POST to the callback endpoint. The changes are pretty straightforward: * The callback handler needs to be configured to accept both GET and POST (right now it only accepts GET) * The implementation of the callback endpoint should be able to extract the `code` and `state` values from either the URL (as query parameters) or form data. ## Sample/Test Implementation I went and implemented these changes in [a fork](https://github.com/paxswill/headscale/tree/oidc-callback-post), and with these changes *Sign in with Apple* works where it would fail before with an unexpected 404 (technically should be a 405).
adam added the enhancementstale labels 2025-12-29 02:21:15 +01:00
adam closed this issue 2025-12-29 02:21:15 +01:00
adam commented 2025-12-29 02:21:15 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Apr 28, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Apr 28, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:21:15 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (May 5, 2024):

This issue was closed because it has been inactive for 14 days since being marked as stale.

@github-actions[bot] commented on GitHub (May 5, 2024): This issue was closed because it has been inactive for 14 days since being marked as stale.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#618
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?