From 31ced94f2aecef8fb23432ec9b3a5fefaaea227d Mon Sep 17 00:00:00 2001 From: Heimdall Date: Thu, 12 Nov 2026 14:48:30 +0000 Subject: [PATCH] Start refusal: read headers only so the 4 KiB bound limits the read; narrow the swallow to non-cancellation Soul re-pass on 87a1bb6b: PostAsJsonAsync buffered the whole body before the cap applied. Test renamed to say what it pins. Co-Authored-By: Claude Sonnet 5.5 --- .../Features/Heimdall/HeimdallAuthService.cs | 12 +++++++----- tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs | 2 +- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs b/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs index b34a21d..87ffdfd 100644 --- a/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs +++ b/src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs @@ -83,7 +83,7 @@ public sealed class HeimdallAuthService( detail += ", " + code; } } - catch (Exception) when (!cancellationToken.IsCancellationRequested) + catch (Exception error) when (error is not OperationCanceledException) { } @@ -121,10 +121,12 @@ public sealed class HeimdallAuthService( new HeimdallHandoff("browser_completion"), entitlementPolicy); - var response = await httpClient.PostAsJsonAsync( - $"/v1/oauth/{provider}/start", - request, - cancellationToken); + // Headers only: a refusal body is read through RefusedStartMessageAsync's own 4 KiB bound, not buffered whole. + using var startMessage = new HttpRequestMessage(HttpMethod.Post, $"/v1/oauth/{provider}/start") + { + Content = JsonContent.Create(request) + }; + using var response = await httpClient.SendAsync(startMessage, HttpCompletionOption.ResponseHeadersRead, cancellationToken); if (!response.IsSuccessStatusCode) { diff --git a/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs b/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs index da9463a..9f91425 100644 --- a/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs +++ b/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs @@ -1172,7 +1172,7 @@ public sealed class HeimdallCompletionTests [InlineData("text/html; charset=windows-1252")] [InlineData("text/html; charset=bogus")] [InlineData("text/html; charset=utf-7")] - public async Task A_refusal_whose_body_cannot_be_decoded_still_redirects_with_the_status(string contentType) + public async Task A_refusal_with_an_unusual_charset_still_redirects_with_the_status(string contentType) { using var host = new HeimdallHost(); host.Heimdall.StartStatus = HttpStatusCode.BadGateway;