GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues 7 Pull requests 1 Projects Releases Packages Wiki Activity Actions

Start refusal: read headers only so the 4 KiB body bound limits the read #80

Merged
heimdall merged 2 commits from heimdall/start-refusal-headers-only into main 2026-11-12 14:54:30 +00:00
Conversation 0 Commits 2 Files changed 2 +7 -5
2 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs
View file

@ -121,10 +121,12 @@ public sealed class HeimdallAuthService(
new HeimdallHandoff("browser_completion"),
entitlementPolicy);
var response = await httpClient.PostAsJsonAsync(
$"/v1/oauth/{provider}/start",
request,
cancellationToken);
// Headers only: a refusal body is read through RefusedStartMessageAsync's own 4 KiB bound, not buffered whole.
using var startMessage = new HttpRequestMessage(HttpMethod.Post, $"/v1/oauth/{provider}/start")
{
Content = JsonContent.Create(request)
};
using var response = await httpClient.SendAsync(startMessage, HttpCompletionOption.ResponseHeadersRead, cancellationToken);
if (!response.IsSuccessStatusCode)
{

2
tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs
View file

@ -1172,7 +1172,7 @@ public sealed class HeimdallCompletionTests
[InlineData("text/html; charset=windows-1252")]
[InlineData("text/html; charset=bogus")]
[InlineData("text/html; charset=utf-7")]
public async Task A_refusal_whose_body_cannot_be_decoded_still_redirects_with_the_status(string contentType)
public async Task A_refusal_with_an_unusual_charset_still_redirects_with_the_status(string contentType)
{
using var host = new HeimdallHost();
host.Heimdall.StartStatus = HttpStatusCode.BadGateway;