fix(security): hold https_only across every redirect hop of the key fetch

Author: nmgarza5

backend/onyx/auth/jwt.py

@@ -55,11 +55,14 @@ def _fetch_public_key_payload(
         else:
             # Mirrors the PUT-time check: the configured SSRF level decides
             # whether private endpoints are reachable.
+            # https_only holds across redirect hops, so no hop can downgrade
+            # the key fetch to plaintext.
             response = ssrf_safe_get(
                 public_key_url,
                 allow_private_network=allow_private_network,
                 block_loopback_and_link_local=block_loopback_and_link_local,
                 block_link_local_only=block_link_local_only,
+                https_only=True,
             )
         response.raise_for_status()
     except (requests.RequestException, SSRFException, ValueError) as exc:

backend/onyx/utils/url.py

@@ -403,6 +403,7 @@ def _make_ssrf_safe_request(
     allow_private_network: bool = False,
     block_loopback_and_link_local: bool = True,
     block_link_local_only: bool = False,
+    https_only: bool = False,
     **kwargs: Any,
 ) -> requests.Response:
     """
@@ -421,12 +422,18 @@ def _make_ssrf_safe_request(
     it to ``block_link_local_only`` so loopback services are reachable while
     cloud-metadata stays blocked.
     """
+    if https_only and urlparse(url).scheme != "https":
+        raise SSRFException(
+            f"Invalid URL scheme '{urlparse(url).scheme}'. Only https is allowed."
+        )
+
     if allow_private_network:
         validate_outbound_http_url(
             url,
             allow_private_network=True,
             block_loopback_and_link_local=block_loopback_and_link_local,
             block_link_local_only=block_link_local_only,
+            https_only=https_only,
         )
         parsed = urlparse(url)
         hostname = parsed.hostname or ""
@@ -458,6 +465,7 @@ def ssrf_safe_get(
     allow_private_network: bool = False,
     block_loopback_and_link_local: bool = True,
     block_link_local_only: bool = False,
+    https_only: bool = False,
     **kwargs: Any,
 ) -> requests.Response:
     """
@@ -493,6 +501,7 @@ def ssrf_safe_get(
         allow_private_network=allow_private_network,
         block_loopback_and_link_local=block_loopback_and_link_local,
         block_link_local_only=block_link_local_only,
+        https_only=https_only,
         **kwargs,
     )
 
@@ -532,6 +541,7 @@ def ssrf_safe_get(
             allow_private_network=allow_private_network,
             block_loopback_and_link_local=block_loopback_and_link_local,
             block_link_local_only=block_link_local_only,
+            https_only=https_only,
             **kwargs,
         )
 

backend/tests/unit/onyx/utils/test_url_ssrf.py

@@ -607,3 +607,25 @@ def test_dns_failure_does_not_raise_with_floor(self) -> None:
                 block_loopback_and_link_local=True,
             )
             assert validated == "https://internal-only.company.com/"
+
+
+class TestSsrfSafeGetHttpsOnly:
+    def test_redirect_cannot_downgrade_to_http(self) -> None:
+        """A https_only fetch must refuse a redirect hop to plain http."""
+        redirect = MagicMock()
+        redirect.is_redirect = True
+        redirect.headers = {"Location": "http://cdn.example.com/keys"}
+
+        with patch("onyx.utils.url.socket.getaddrinfo") as mock_getaddrinfo:
+            mock_getaddrinfo.return_value = [(2, 1, 6, "", ("93.184.216.34", 443))]
+
+            with patch("onyx.utils.url.requests.Session") as mock_session_cls:
+                session = mock_session_cls.return_value.__enter__.return_value
+                session.get.return_value = redirect
+
+                with pytest.raises(SSRFException, match="Only https"):
+                    ssrf_safe_get("https://idp.example.com/keys", https_only=True)
+
+    def test_rejects_plain_http_upfront(self) -> None:
+        with pytest.raises(SSRFException, match="Only https"):
+            ssrf_safe_get("http://idp.example.com/keys", https_only=True)