mirror of
https://github.com/hanzoai/base.git
synced 2026-10-21 03:41:50 +00:00
zeekayandHanzo Dev
436c3191ee
/v1/iam/oauth/authorize answers 302 to the redirect_uri, and that redirect IS the code flow — the browser has to receive it. Go's default client follows up to ten, and this proxy set no policy, so the redirect was consumed here: the process fetched the app's own callback URL, the browser never saw a location, and the caller got 500 "iam unreachable" whenever that URL was not reachable FROM THE SERVER — which is the normal case for a location meant for a browser. So sign-in could not complete through the proxy at all. Found from a bank whose PKCE round trip died at exactly that hop. It also stops the upstream naming a URL this process will then go and fetch. Verified by making the policy follow again: the test says the proxy chased the redirect and the browser never sees the location. Co-authored-by: Hanzo Dev <[email protected]>