backend: OIDC: Return error on state generation failure by harrshita123 · Pull Request #5643 · kubernetes-sigs/headlamp

harrshita123 · 2026-05-14T13:34:58Z

Summary

This PR fixes the OIDC login path so Headlamp returns a normal error when OAuth state generation fails instead of panicking the backend handler.

Related Issue

Fixes #5630

Changes

Added a small helper to generate the OIDC state value and return an error on failure
Updated the OIDC login handler in backend/cmd/headlamp.go to log and return 500 Internal Server Error if state generation fails
Added a regression test for successful and failing state generation paths in backend/cmd/headlamp_test.go

Steps to Test

Run the backend command package tests.
Verify the new TestGenerateOidcState regression test passes.
Confirm the OIDC login path no longer uses panic(err) for state generation failure.

Screenshots

Not applicable.

Notes for the Reviewer

This change is intentionally small and isolated to the OIDC login path. It replaces the panic path with explicit error handling and keeps the rest of the login flow unchanged.

k8s-ci-robot · 2026-05-14T13:35:09Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: harrshita123
Once this PR has been reviewed and has the lgtm label, please assign joaquimrocha for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot

Pull request overview

This PR updates the backend OIDC login flow to avoid panicking when OAuth state generation fails, instead returning a controlled 500 Internal Server Error and logging the underlying failure. It also introduces a small helper to make state generation testable.

Changes:

Added generateOidcState() and a test seam (randRead) to return (state, error) instead of panicking on entropy read failures.
Updated the /oidc handler to log and return HTTP 500 when state generation fails.
Added a regression test covering success/failure paths for state generation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
backend/cmd/headlamp.go	Replaces panic-based state generation with an error-returning helper and graceful HTTP 500 handling in the OIDC login route.
backend/cmd/headlamp_test.go	Adds a regression test for `generateOidcState()` using an overridable randomness function.

illume

Thanks for this PR.

the PR has a merge-main commit; please rebase against main to keep the history clean.

Why this matters

Merge commits from main make the PR history harder to review. Please rebase your branch on top of the latest main instead, then update the PR with the rebased commits.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

backend/cmd/headlamp.go:1129

generateOidcState ignores the byte count returned by randRead. Since Read is allowed to return n < len(b) with err == nil, this can produce a state value with partially zero-filled bytes. Treat short reads as an error (e.g., check n != len(b) and return io.ErrUnexpectedEOF) and add a test for the partial-read case.

func generateOidcState() (string, error) {
	b := make([]byte, 32)

	if _, err := randRead(b); err != nil {
		return "", err
	}

illume

Thanks for this PR.

the PR has a merge-main commit; please rebase against main to keep the history clean.

Why this matters

Merge commits from main make the PR history harder to review. Please rebase your branch on top of the latest main instead, then update the PR with the rebased commits.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

illume

Thanks for these changes.

Can you please address the open review comments? Once you've resolved each one, please mark it as resolved.

harrshita123 · 2026-05-15T20:58:17Z

Thanks for these changes.

Can you please address the open review comments? Once you've resolved each one, please mark it as resolved.

@illume
I resolved copilot comment .

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

+func generateOidcState(read func([]byte) (int, error)) (string, error) {
+	b := make([]byte, 32)
+
+	n, err := read(b)
+	if err != nil {
+		return "", err
+	}
+
+	if n != len(b) {
+		return "", io.ErrUnexpectedEOF
+	}
+
+	return base64.RawURLEncoding.EncodeToString(b), nil
+}


+func generateOidcState(read func([]byte) (int, error)) (string, error) {
+	b := make([]byte, 32)
+
+	n, err := read(b)
+	if err != nil {
+		return "", err
+	}
+
+	if n != len(b) {
+		return "", io.ErrUnexpectedEOF
+	}
+


+func TestGenerateOidcState(t *testing.T) {
+	t.Run("success", func(t *testing.T) {
+		state, err := generateOidcState(func(b []byte) (int, error) {
+			for i := range b {
+				b[i] = byte(i)
+			}
+
+			return len(b), nil
+		})
+		require.NoError(t, err)
+		assert.Equal(t, "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8", state)
+	})
+
+	t.Run("failure", func(t *testing.T) {
+		state, err := generateOidcState(func([]byte) (int, error) {
+			return 0, errors.New("rand failure")
+		})
+
+		require.Error(t, err)
+		assert.Empty(t, state)


illume

Thanks for these changes.

Can you please address the open review comments? Once you've resolved each one, please mark it as resolved.

illume

Thanks for working on this.

Would you mind addressing the open Copilot review comments? Please mark each comment as resolved after addressing it.

illume

Thanks for working on this.

Would you mind addressing the open Copilot review comments? Please mark each comment as resolved after addressing it.

illume

Thanks for this PR.

The open review comments from Copilot still need attention — can you have a look? Once addressed, please mark them as resolved.

k8s-ci-robot · 2026-05-19T18:34:47Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

illume

Thanks for this PR.

There are git conflicts in this PR that need to be resolved.

How to resolve conflicts

Rebase or merge the latest main into your branch, resolve the conflicts, and push the updated branch.

The open review comments from Copilot still need attention — can you have a look? Once addressed, please mark them as resolved.

illume

Thanks for the contribution.

There are some open Copilot review comments — could you take a look at them? Please mark each one as resolved once you've addressed it.

illume

Thanks for the contribution.

There are some open Copilot review comments — could you take a look at them? Please mark each one as resolved once you've addressed it.

k8s-ci-robot requested review from skoeva and sniok May 14, 2026 13:35

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label May 14, 2026

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label May 14, 2026

harrshita123 force-pushed the fix-5630-oidc-state-generation branch from 0c97387 to 1adca74 Compare May 14, 2026 15:08

illume requested a review from Copilot May 14, 2026 15:11

Copilot started reviewing on behalf of illume May 14, 2026 15:12 View session

Copilot AI reviewed May 14, 2026

View reviewed changes

Comment thread backend/cmd/headlamp_test.go Outdated

illume requested a review from Copilot May 15, 2026 06:23

illume requested changes May 15, 2026

View reviewed changes

Copilot started reviewing on behalf of illume May 15, 2026 06:24 View session

Copilot AI reviewed May 15, 2026

View reviewed changes

Comment thread backend/cmd/headlamp.go Outdated

Comment thread backend/cmd/headlamp_test.go Outdated

illume requested a review from Copilot May 15, 2026 12:40

illume requested changes May 15, 2026

View reviewed changes

Copilot started reviewing on behalf of illume May 15, 2026 12:40 View session

Copilot AI reviewed May 15, 2026

View reviewed changes

illume marked this pull request as draft May 15, 2026 18:36

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 15, 2026

illume requested changes May 15, 2026

View reviewed changes

harrshita123 force-pushed the fix-5630-oidc-state-generation branch 2 times, most recently from b9a4a95 to 69474f0 Compare May 15, 2026 20:57

harrshita123 marked this pull request as ready for review May 17, 2026 09:02

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 17, 2026

k8s-ci-robot requested review from joaquimrocha and kahirokunn May 17, 2026 09:02

illume requested a review from Copilot May 17, 2026 10:33

Copilot started reviewing on behalf of illume May 17, 2026 10:34 View session

Copilot AI reviewed May 17, 2026

View reviewed changes

backend: OIDC: Return error on state generation failure

43e78cc

harrshita123 force-pushed the fix-5630-oidc-state-generation branch from de85233 to 43e78cc Compare May 17, 2026 11:13

illume requested a review from Copilot May 17, 2026 18:58

Copilot started reviewing on behalf of illume May 17, 2026 18:59 View session

Copilot AI reviewed May 17, 2026

View reviewed changes

illume requested changes May 18, 2026

View reviewed changes

illume requested changes May 19, 2026

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 19, 2026

illume requested changes May 20, 2026

View reviewed changes

illume requested changes May 21, 2026

View reviewed changes

illume requested changes May 22, 2026

View reviewed changes

Conversation

harrshita123 commented May 14, 2026

Summary

Related Issue

Changes

Steps to Test

Screenshots

Notes for the Reviewer

Uh oh!

k8s-ci-robot commented May 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

harrshita123 commented May 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented May 19, 2026

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants