Merge branch 'main' into username-and-subject-claims

internal/oidc/callback/callback_handler.go

@@ -17,6 +17,7 @@ import (
 	"github.com/ory/fosite/token/jwt"
 
 	"go.pinniped.dev/internal/httputil/httperr"
+	"go.pinniped.dev/internal/httputil/securityheader"
 	"go.pinniped.dev/internal/oidc"
 	"go.pinniped.dev/internal/oidc/csrftoken"
 	"go.pinniped.dev/internal/oidc/provider"
@@ -29,7 +30,7 @@ func NewHandler(
 	stateDecoder, cookieDecoder oidc.Decoder,
 	redirectURI string,
 ) http.Handler {
-	return httperr.HandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
+	return securityheader.Wrap(httperr.HandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
 		state, err := validateRequest(r, stateDecoder, cookieDecoder)
 		if err != nil {
 			return err
@@ -92,7 +93,7 @@ func NewHandler(
 		oauthHelper.WriteAuthorizeResponse(w, authorizeRequester, authorizeResponder)
 
 		return nil
-	})
+	}))
 }
 
 func authcode(r *http.Request) string {

internal/oidc/callback/callback_handler_test.go

@@ -502,6 +502,8 @@ func TestCallbackEndpoint(t *testing.T) {
 			t.Logf("response: %#v", rsp)
 			t.Logf("response body: %q", rsp.Body.String())
 
+			testutil.RequireSecurityHeaders(t, rsp)
+
 			if test.wantExchangeAndValidateTokensCall != nil {
 				require.Equal(t, 1, test.idp.ExchangeAuthcodeAndValidateTokensCallCount())
 				test.wantExchangeAndValidateTokensCall.Ctx = req.Context()