fix(auth): bind OAuth callback listener to loopback only (#6238)

The interactive login callback server bound ":port" (all interfaces)
while advertising a localhost redirect URL. For the lifetime of a
login, any host on the LAN could probe the listener and abort the
flow by hitting /callback?error=... (no state needed on the error
path). Login-code theft is not possible: the 128-bit state is
validated before token exchange, so the impact is login DoS only.

Bind 127.0.0.1 explicitly, matching the redirect URL host and the
loopback address the port-availability probe already uses. Added
TestListenAddrLoopback asserting the listener address is loopback.

Signed-off-by: Sasha Mitchell <sash.t.mitchell@gmail.com>

Author: SashaMIT

pkg/auth/oauth/flow.go

@@ -187,6 +187,14 @@ func (f *Flow) generateState() error {
 	return nil
 }
 
+// listenAddr returns the address the callback server binds to. The redirect
+// URL points at localhost, so the listener is bound to the IPv4 loopback
+// instead of all interfaces: a wildcard bind would expose the callback
+// endpoint to every host on the LAN for the lifetime of the login.
+func (f *Flow) listenAddr() string {
+	return fmt.Sprintf("127.0.0.1:%d", f.port)
+}
+
 // Start starts the OAuth authentication flow
 func (f *Flow) Start(ctx context.Context, skipBrowser bool) (*TokenResult, error) {
 	// Create channels for communication
@@ -199,7 +207,7 @@ func (f *Flow) Start(ctx context.Context, skipBrowser bool) (*TokenResult, error
 	mux.HandleFunc("/", f.handleRoot())
 
 	f.server = &http.Server{
-		Addr:              fmt.Sprintf(":%d", f.port),
+		Addr:              f.listenAddr(),
 		Handler:           mux,
 		ReadHeaderTimeout: 10 * time.Second,
 	}

pkg/auth/oauth/flow_test.go

@@ -9,6 +9,7 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -739,6 +740,26 @@ func TestStart(t *testing.T) {
 	}
 }
 
+func TestListenAddrLoopback(t *testing.T) {
+	t.Parallel()
+	config := &Config{
+		ClientID: "test-client",
+		AuthURL:  "https://example.com/auth",
+		TokenURL: "https://example.com/token",
+	}
+
+	flow, err := NewFlow(config)
+	require.NoError(t, err)
+
+	host, port, err := net.SplitHostPort(flow.listenAddr())
+	require.NoError(t, err)
+	assert.Equal(t, fmt.Sprintf("%d", flow.port), port, "listen address should use the flow's callback port")
+
+	ip := net.ParseIP(host)
+	require.NotNil(t, ip, "listen host should be an IP address, got %q", host)
+	assert.True(t, ip.IsLoopback(), "callback listener must bind to a loopback address, got %q", host)
+}
+
 func TestWriteSuccessPage(t *testing.T) {
 	t.Parallel()
 	flow := &Flow{}