Skip to content

webui-auth-edge: auth handler does not fail closed when handle() rejects #115

Open

Description

@royosherove

In packs/kirocrew/webui-auth-edge/index.js line 167, the code is return auth.handle(event); with no await.

If handle() rejects, the catch block does not run. Thus the function does not send the 503 "fail closed" response.

Fix: use return await auth.handle(event);.

Found by a static read of the code at commit 1f66a8f. The code was not run.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions