starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] OIDC nil deref when visiting invalid/old callback urls #903

New Issue
Closed
opened 2025-12-29 02:25:36 +01:00 by adam · 0 comments
adam commented 2025-12-29 02:25:36 +01:00
Owner
Copy Link

Originally created by @ToxicMushroom on GitHub (Jan 8, 2025).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

nil deref when visiting invalid/old callback urls

Expected Behavior

no nil deref and just an access denied error page, could mention: possibly expired link/session expired.

Steps To Reproduce

  1. log in and keep the callback url
  2. restart the headscale server
  3. visit the callback url again

Environment

- OS: Debian 12
- Headscale version: ghcr.io/juanfont/headscale:0.24.0-beta.2-debug
- Tailscale version: 1.78.1

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Anything else?

headscale     | 2025/01/08 12:37:09 http: panic serving 172.18.0.16:56944: runtime error: invalid memory address or nil pointer dereference
headscale     | goroutine 306 [running]:
headscale     | net/http.(*conn).serve.func1()
headscale     | 	/nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:1947 +0xbe
headscale     | panic({0x1e5d320?, 0x3654b60?})
headscale     | 	/nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/runtime/panic.go:785 +0x132
headscale     | github.com/juanfont/headscale/hscontrol.(*AuthProviderOIDC).OIDCCallbackHandler(0xc0005d6ae0, {0x2541680, 0xc0006c1ce0}, 0xc0003f6640)
headscale     | 	/home/runner/work/headscale/headscale/hscontrol/oidc.go:299 +0x566
headscale     | net/http.HandlerFunc.ServeHTTP(0xb1b9e8?, {0x2541680?, 0xc0006c1ce0?}, 0xc0006c1c80?)
headscale     | 	/nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:2220 +0x29
headscale     | github.com/juanfont/headscale/hscontrol.prometheusMiddleware.func1({0x2541520, 0xc0005de1c0}, 0xc0003f6640)
headscale     | 	/home/runner/work/headscale/headscale/hscontrol/metrics.go:89 +0x293
headscale     | net/http.HandlerFunc.ServeHTTP(0xc0003f6500?, {0x2541520?, 0xc0005de1c0?}, 0x4c04e9?)
headscale     | 	/nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:2220 +0x29
headscale     | github.com/gorilla/mux.(*Router).ServeHTTP(0xc000176d80, {0x2541520, 0xc0005de1c0}, 0xc0003f6280)
headscale     | 	/home/runner/go/pkg/mod/github.com/gorilla/mux@v1.8.1/mux.go:212 +0x1e2
headscale     | net/http.serverHandler.ServeHTTP({0xc0006c0960?}, {0x2541520?, 0xc0005de1c0?}, 0x6?)
headscale     | 	/nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:3210 +0x8e
headscale     | net/http.(*conn).serve(0xc000698000, {0x2545798, 0xc0000a9d10})
headscale     | 	/nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:2092 +0x5d0
headscale     | created by net/http.(*Server).Serve in goroutine 77
headscale     | 	/nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:3360 +0x485
Originally created by @ToxicMushroom on GitHub (Jan 8, 2025). ### Is this a support request? - [X] This is not a support request ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current Behavior nil deref when visiting invalid/old callback urls ### Expected Behavior no nil deref and just an access denied error page, could mention: possibly expired link/session expired. ### Steps To Reproduce 1. log in and keep the callback url 2. restart the headscale server 3. visit the callback url again ### Environment ```markdown - OS: Debian 12 - Headscale version: ghcr.io/juanfont/headscale:0.24.0-beta.2-debug - Tailscale version: 1.78.1 ``` ### Runtime environment - [X] Headscale is behind a (reverse) proxy - [X] Headscale runs in a container ### Anything else? ``` headscale | 2025/01/08 12:37:09 http: panic serving 172.18.0.16:56944: runtime error: invalid memory address or nil pointer dereference headscale | goroutine 306 [running]: headscale | net/http.(*conn).serve.func1() headscale | /nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:1947 +0xbe headscale | panic({0x1e5d320?, 0x3654b60?}) headscale | /nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/runtime/panic.go:785 +0x132 headscale | github.com/juanfont/headscale/hscontrol.(*AuthProviderOIDC).OIDCCallbackHandler(0xc0005d6ae0, {0x2541680, 0xc0006c1ce0}, 0xc0003f6640) headscale | /home/runner/work/headscale/headscale/hscontrol/oidc.go:299 +0x566 headscale | net/http.HandlerFunc.ServeHTTP(0xb1b9e8?, {0x2541680?, 0xc0006c1ce0?}, 0xc0006c1c80?) headscale | /nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:2220 +0x29 headscale | github.com/juanfont/headscale/hscontrol.prometheusMiddleware.func1({0x2541520, 0xc0005de1c0}, 0xc0003f6640) headscale | /home/runner/work/headscale/headscale/hscontrol/metrics.go:89 +0x293 headscale | net/http.HandlerFunc.ServeHTTP(0xc0003f6500?, {0x2541520?, 0xc0005de1c0?}, 0x4c04e9?) headscale | /nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:2220 +0x29 headscale | github.com/gorilla/mux.(*Router).ServeHTTP(0xc000176d80, {0x2541520, 0xc0005de1c0}, 0xc0003f6280) headscale | /home/runner/go/pkg/mod/github.com/gorilla/mux@v1.8.1/mux.go:212 +0x1e2 headscale | net/http.serverHandler.ServeHTTP({0xc0006c0960?}, {0x2541520?, 0xc0005de1c0?}, 0x6?) headscale | /nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:3210 +0x8e headscale | net/http.(*conn).serve(0xc000698000, {0x2545798, 0xc0000a9d10}) headscale | /nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:2092 +0x5d0 headscale | created by net/http.(*Server).Serve in goroutine 77 headscale | /nix/store/zhq8dnjbhwspzdglyq28j74axvqyk86q-go-1.23.3/share/go/src/net/http/server.go:3360 +0x485 ```
adam added the bugOIDC labels 2025-12-29 02:25:36 +01:00
adam closed this issue 2025-12-29 02:25:36 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label OIDC bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#903
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?