github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-06 03:27:53 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #2145] [MERGED] fix: avoid mutating global http.DefaultClient in webhook proxy #3967

New Issue
Closed
opened 2026-03-22 14:57:54 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-22 14:57:54 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2145
Author: @kolaente
Created: 1/24/2026
Status: ✅ Merged
Merged: 1/24/2026
Merged by: @kolaente

Base: main ← Head: fix/webhook-proxy-global-client

📝 Commits (1)

  • 4764a57 fix: avoid mutating global http.DefaultClient in webhook proxy

📊 Changes

6 files changed (+7 additions, -7 deletions)

View changed files

📝 pkg/models/webhooks.go (+1 -1)
📝 pkg/modules/avatar/gravatar/gravatar.go (+1 -1)
📝 pkg/modules/background/unsplash/proxy.go (+1 -1)
📝 pkg/modules/background/unsplash/unsplash.go (+2 -2)
📝 pkg/modules/migration/microsoft-todo/microsoft_todo.go (+1 -1)
📝 pkg/utils/avatar.go (+1 -1)

📄 Description

Summary

  • Fixes a bug where the webhook HTTP client was mutating http.DefaultClient (the global singleton), causing ALL HTTP requests in the application to use the webhook proxy
  • This broke OIDC authentication and other external HTTP calls when webhook proxy was configured
  • Creates new http.Client{} instances instead of mutating the global across all affected files

Root Cause

In pkg/models/webhooks.go:248, the code was doing:

client = http.DefaultClient  // Assigns pointer to global singleton
client.Transport = &http.Transport{Proxy: ...}  // Mutates global!

This meant any code using http.DefaultClient (including the go-oidc library for OIDC authentication) would route requests through the webhook proxy.

Changes

  • pkg/models/webhooks.go - Create new http.Client{} instead of using http.DefaultClient
  • pkg/utils/avatar.go - Use own HTTP client
  • pkg/modules/avatar/gravatar/gravatar.go - Use own HTTP client
  • pkg/modules/background/unsplash/proxy.go - Use own HTTP client
  • pkg/modules/background/unsplash/unsplash.go - Use own HTTP client (2 locations)
  • pkg/modules/migration/microsoft-todo/microsoft_todo.go - Use own HTTP client

Test plan

  • Configure webhook proxy settings
  • Verify webhooks still work through the proxy
  • Verify OIDC authentication works when webhook proxy is configured
  • Verify avatar downloads, Gravatar, Unsplash backgrounds still work

Fixes #2144

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2145 **Author:** [@kolaente](https://github.com/kolaente) **Created:** 1/24/2026 **Status:** ✅ Merged **Merged:** 1/24/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `fix/webhook-proxy-global-client` --- ### 📝 Commits (1) - [`4764a57`](https://github.com/go-vikunja/vikunja/commit/4764a5709eeaede75994ef410333d5e174fa1e53) fix: avoid mutating global http.DefaultClient in webhook proxy ### 📊 Changes **6 files changed** (+7 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `pkg/models/webhooks.go` (+1 -1) 📝 `pkg/modules/avatar/gravatar/gravatar.go` (+1 -1) 📝 `pkg/modules/background/unsplash/proxy.go` (+1 -1) 📝 `pkg/modules/background/unsplash/unsplash.go` (+2 -2) 📝 `pkg/modules/migration/microsoft-todo/microsoft_todo.go` (+1 -1) 📝 `pkg/utils/avatar.go` (+1 -1) </details> ### 📄 Description ## Summary - Fixes a bug where the webhook HTTP client was mutating `http.DefaultClient` (the global singleton), causing ALL HTTP requests in the application to use the webhook proxy - This broke OIDC authentication and other external HTTP calls when webhook proxy was configured - Creates new `http.Client{}` instances instead of mutating the global across all affected files ## Root Cause In `pkg/models/webhooks.go:248`, the code was doing: ```go client = http.DefaultClient // Assigns pointer to global singleton client.Transport = &http.Transport{Proxy: ...} // Mutates global! ``` This meant any code using `http.DefaultClient` (including the go-oidc library for OIDC authentication) would route requests through the webhook proxy. ## Changes - `pkg/models/webhooks.go` - Create new `http.Client{}` instead of using `http.DefaultClient` - `pkg/utils/avatar.go` - Use own HTTP client - `pkg/modules/avatar/gravatar/gravatar.go` - Use own HTTP client - `pkg/modules/background/unsplash/proxy.go` - Use own HTTP client - `pkg/modules/background/unsplash/unsplash.go` - Use own HTTP client (2 locations) - `pkg/modules/migration/microsoft-todo/microsoft_todo.go` - Use own HTTP client ## Test plan - [ ] Configure webhook proxy settings - [ ] Verify webhooks still work through the proxy - [ ] Verify OIDC authentication works when webhook proxy is configured - [ ] Verify avatar downloads, Gravatar, Unsplash backgrounds still work Fixes #2144 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-22 14:57:54 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#3967
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?