Information disclosure / Uncontrolled SSO auto-login exposure via bootdata

PoC steps (demonstrates exposure of auto-login data and potential flow): Prerequisites: - Grafana 12.4.x with SSO (e.g., OIDC) configured. - An unauthenticated user can access Grafana's bootdata endpoint (e.g., /api/bootdata or the bootdata data embedded in the index.html). - An IdP session may exist in the browser (optional for demonstrating automatic login if IdP supports silent/auto login). 1) Retrieve bootdata as an unauthenticated user: curl -sS https://grafana.example.com/api/bootdata | python -m json.tool Expected (potential) exposure: { ..., "AutoLoginRedirectURL": "https://idp.example.com/sso/login?redirect=...", ... } 2) Observe that the bootdata contains an AutoLoginRedirectURL which would be used by the frontend to redirect unauthenticated users to the IdP for auto-login. 3) If a valid IdP session exists for a user, the redirection could lead to automatic authentication without a local Grafana login prompt (depending on IdP behavior). In a browser context, visiting Grafana when not signed in could automatically trigger the SSO redirect, resulting in a login without explicit Grafana prompt. 4) As a targeted check, load the Grafana homepage in a fresh browser session and monitor for an automatic redirect to the IdP (or observe bootdata-driven redirect if bootdata is loaded client-side before authentication). Notes: - The exact URLs and behavior depend on the IdP configuration and the implementation of getAutoLoginRedirectURL. The key risk is the exposure of auto-login configuration in bootdata and the potential for unprompted SSO redirects for unauthenticated users.

diff --git a/packages/grafana-data/src/types/featureToggles.gen.ts b/packages/grafana-data/src/types/featureToggles.gen.ts index 980a7ac85682..26644fdc8bb8 100644 --- a/packages/grafana-data/src/types/featureToggles.gen.ts +++ b/packages/grafana-data/src/types/featureToggles.gen.ts @@ -1481,11 +1481,6 @@ export interface FeatureToggles { */ logsTablePanelNG?: boolean; /** - * Returns SSO auto-login information in /bootdata to automatically log in users with SSO when they access Grafana - * @default false - */ - frontendServiceSSOAutoLogin?: boolean; - /** * Enables the splash screen modal for introducing new Grafana features on first session * @default false */ diff --git a/pkg/api/bootdata.go b/pkg/api/bootdata.go index 4272237a32cd..362cf5a449fd 100644 --- a/pkg/api/bootdata.go +++ b/pkg/api/bootdata.go @@ -26,7 +26,6 @@ import ( "github.com/grafana/grafana/pkg/setting" "github.com/grafana/grafana/pkg/tsdb/grafanads" "github.com/grafana/grafana/pkg/util" - "github.com/open-feature/go-sdk/openfeature" ) // GetBootdataAPI returns the same data we currently have rendered into index.html @@ -42,9 +41,7 @@ func (hs *HTTPServer) GetBootdata(c *contextmodel.ReqContext) { return } - ofClient := openfeature.NewDefaultClient() - autoLoginFlagEnabled := ofClient.Boolean(c.Req.Context(), featuremgmt.FlagFrontendServiceSSOAutoLogin, false, openfeature.TransactionContext(c.Req.Context())) - if autoLoginFlagEnabled && !c.IsSignedIn { + if !c.IsSignedIn { data.AutoLoginRedirectURL = hs.getAutoLoginRedirectURL(c) } diff --git a/pkg/services/featuremgmt/registry.go b/pkg/services/featuremgmt/registry.go index 8063f29e0029..bfa797c1705d 100644 --- a/pkg/services/featuremgmt/registry.go +++ b/pkg/services/featuremgmt/registry.go @@ -2775,15 +2775,6 @@ var ( Expression: "false", HideFromDocs: true, }, - { - Name: "frontendServiceSSOAutoLogin", - Description: "Returns SSO auto-login information in /bootdata to automatically log in users with SSO when they access Grafana", - Stage: FeatureStageExperimental, - Owner: grafanaFrontendPlatformSquad, - HideFromDocs: true, - Expression: "false", - Generate: Generate{LegacyGo: true, LegacyFrontend: true}, - }, { Name: "splashScreen", Description: "Enables the splash screen modal for introducing new Grafana features on first session", diff --git a/pkg/services/featuremgmt/toggles_gen.csv b/pkg/services/featuremgmt/toggles_gen.csv index b24aa11fb879..c78ad265fc6b 100644 --- a/pkg/services/featuremgmt/toggles_gen.csv +++ b/pkg/services/featuremgmt/toggles_gen.csv @@ -322,7 +322,6 @@ Created,Name,Stage,Owner,requiresDevMode,RequiresRestart,FrontendOnly 2026-05-22,yAxisTickControl,experimental,@grafana/dataviz-squad,false,false,true 2026-05-22,logsTablePanelNG,experimental,@grafana/observability-logs,false,false,true 2026-05-22,plugins.useMTPluginSettings,experimental,@grafana/grafana-frontend-platform,false,false,true -2026-05-22,frontendServiceSSOAutoLogin,experimental,@grafana/grafana-frontend-platform,false,false,false 2026-05-22,splashScreen,preview,@grafana/grafana-frontend-platform,false,false,true 2026-05-22,streamingForwardTeamHeadersTempo,privatePreview,@grafana/data-sources-plugins,false,false,false 2026-05-22,lokiAlignedQuerySplitting,experimental,@grafana/observability-logs,false,false,false diff --git a/pkg/services/featuremgmt/toggles_gen.go b/pkg/services/featuremgmt/toggles_gen.go index 07f8eb9f8d55..ceb3a4285428 100644 --- a/pkg/services/featuremgmt/toggles_gen.go +++ b/pkg/services/featuremgmt/toggles_gen.go @@ -866,10 +866,6 @@ const ( // Enables the advisor report integration with datasource pages FlagAdvisorDatasourceIntegration = "advisorDatasourceIntegration" - // FlagFrontendServiceSSOAutoLogin - // Returns SSO auto-login information in /bootdata to automatically log in users with SSO when they access Grafana - FlagFrontendServiceSSOAutoLogin = "frontendServiceSSOAutoLogin" - // FlagStreamingForwardTeamHeadersTempo // Enables forwarding team headers from tempo for streaming requests with LBAC rules FlagStreamingForwardTeamHeadersTempo = "streamingForwardTeamHeadersTempo" diff --git a/pkg/services/featuremgmt/toggles_gen.json b/pkg/services/featuremgmt/toggles_gen.json index 90c7b18aebbe..a9c9921e1ab8 100644 --- a/pkg/services/featuremgmt/toggles_gen.json +++ b/pkg/services/featuremgmt/toggles_gen.json @@ -2378,7 +2378,8 @@ "metadata": { "name": "frontendServiceSSOAutoLogin", "resourceVersion": "1779440584464", - "creationTimestamp": "2026-05-22T09:03:04Z" + "creationTimestamp": "2026-05-22T09:03:04Z", + "deletionTimestamp": "2026-07-01T09:29:14Z" }, "spec": { "description": "Returns SSO auto-login information in /bootdata to automatically log in users with SSO when they access Grafana",