oidcccl: HTTP client should respect timeouts #123605
Labels
C-bug
Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.
T-product-security
Describe the problem
Currently, the HTTP client used by the code in the OIDC feature does not respect any timeouts we might have set on our default http client.
Internal client timeout:
cockroach/pkg/util/httputil/client.go
Line 26 in a892ee8
OIDC Provider:
cockroach/pkg/ccl/oidcccl/authentication_oidc.go
Line 259 in 44d7da5
Requests made here:
cockroach/pkg/ccl/oidcccl/authentication_oidc.go
Lines 226 to 230 in 44d7da5
We should consider adding the timeout to the HTTP context, or overriding the client used in the OIDC library if possible.
Jira issue: CRDB-38416
The text was updated successfully, but these errors were encountered: