Merge pull request #3419 from fredrikblau/fix/3413-oidc-nil-provider

fix(middleware): reject empty OIDC providers safely

pkg/middleware/oidc.go

@@ -2,6 +2,7 @@ package middleware
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"strings"
 	"sync"
@@ -61,7 +62,10 @@ func OidcAuth(opts ...Option) func(http.Handler) http.Handler {
 						provider, err = providerFunc()
 					}
 					initializeProviderLock.Unlock()
-					if err != nil {
+					if err != nil || provider == nil {
+						if err == nil {
+							err = errors.New("OIDC provider initialization returned nil")
+						}
 						opt.Logger.Error().Err(err).Msg("could not initialize OIDC provider")
 						w.WriteHeader(http.StatusInternalServerError)
 						return
@@ -82,6 +86,12 @@ func OidcAuth(opts ...Option) func(http.Handler) http.Handler {
 					w.WriteHeader(http.StatusUnauthorized)
 					return
 				}
+				if userInfo == nil {
+					opt.Logger.Error().Msg("OIDC provider returned empty user info")
+					w.Header().Add("WWW-Authenticate", `Bearer`)
+					w.WriteHeader(http.StatusUnauthorized)
+					return
+				}
 				claims := map[string]any{}
 				err = userInfo.Claims(&claims)
 				if err != nil {