unkin/artifactapi
3
0
Fork 0
Code Issues 5 Pull Requests 5 Actions Packages Projects Releases 1 Wiki Activity

Accept OAuth2 POST form credentials on registry /v2/token #180

Open
unkin-agent wants to merge 2 commits from benvin/registry-token-oauth-post into master
pull from: benvin/registry-token-oauth-post
merge into: unkin:master
Conversation 2 Commits 2 Files Changed 4
+233 -9
unkin-agent commented 2026-11-02 21:39:14 +11:00
Member
Copy Link
Copy Source

Registry write gating broke buildkit pushes: containerd's resolver fetches tokens with an OAuth2 POST form (credential in the body, not an Authorization header), so /v2/token issued the anonymous token and uploads 401'd with invalid token.

  • read the credential from the password or refresh_token field of a urlencoded POST /v2/token body, capped at 16 KiB; multipart is never parsed
  • add tests for the grant forms, multipart/oversized bodies, and a push/pull through the real containerd resolver (test-only containerd v2 dependency)
Registry write gating broke buildkit pushes: containerd's resolver fetches tokens with an OAuth2 POST form (credential in the body, not an Authorization header), so `/v2/token` issued the anonymous token and uploads 401'd with `invalid token`. - read the credential from the `password` or `refresh_token` field of a urlencoded `POST /v2/token` body, capped at 16 KiB; multipart is never parsed - add tests for the grant forms, multipart/oversized bodies, and a push/pull through the real containerd resolver (test-only containerd v2 dependency)
unkin-agent added 1 commit 2026-11-02 21:39:15 +11:00
Accept OAuth2 POST form credentials on /v2/token
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/build Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
e168eeb274 
containerd/buildkit fetch registry tokens with a password or refresh_token
grant form; read the credential from it so buildx pushes get a real token.
unkin-agent commented 2026-11-02 21:40:45 +11:00
Author
Member
Copy Link
Copy Source
  • internal/auth/oidc.go:204 — r.PostFormValue calls ParseMultipartForm, so an unauthenticated multipart/form-data POST to /v2/token is parsed with no body cap: files over 32MB spill to temp files on disk, and nothing upstream sets MaxBytesReader. Verified with a 60MB multipart body (temp file written). → wrap r.Body in http.MaxBytesReader (a few KB) and use r.ParseForm() + r.PostForm.Get(...), so multipart is never parsed.
- internal/auth/oidc.go:204 — `r.PostFormValue` calls `ParseMultipartForm`, so an unauthenticated `multipart/form-data` POST to `/v2/token` is parsed with no body cap: files over 32MB spill to temp files on disk, and nothing upstream sets `MaxBytesReader`. Verified with a 60MB multipart body (temp file written). → wrap `r.Body` in `http.MaxBytesReader` (a few KB) and use `r.ParseForm()` + `r.PostForm.Get(...)`, so multipart is never parsed.
unkin-agent added 1 commit 2026-11-02 21:43:41 +11:00
cap /v2/token form body and skip multipart parsing
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/build Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
cdc137b9ae
unkin-agent commented 2026-11-02 21:45:07 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
All checks were successful
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details
ci/woodpecker/pr/build Pipeline was successful
Required
Details
ci/woodpecker/pr/test Pipeline was successful
Required
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin benvin/registry-token-oauth-post:benvin/registry-token-oauth-post
git checkout benvin/registry-token-oauth-post
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/artifactapi#180
Delete Branch "benvin/registry-token-oauth-post"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?