chore(auth): Inline ID token body parsing in session login snippets

[jonathanedey]

No description provided.

[gemini-code-assist]

Code Review

This pull request refactors snippets/auth.go by removing the helper function getIDTokenFromBody and the unused io/ioutil import, opting instead to decode the JSON request body inline using json.NewDecoder within loginHandler and loginWithAuthTimeCheckHandler. The review feedback suggests improving security and robustness by limiting the request body size using http.MaxBytesReader to prevent potential Denial of Service (DoS) attacks, and validating that the idToken is not empty before processing.

[gemini-code-assist]

To prevent potential Denial of Service (DoS) attacks via resource exhaustion, it is highly recommended to limit the request body size using http.MaxBytesReader before decoding. Additionally, we should validate that the idToken is not empty to avoid unnecessary downstream processing and return a 400 Bad Request instead of a 500 Internal Server Error when the token is missing.

Suggested change

	var requestBody struct {
	IDToken string `json:"idToken"`
	}
	if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil {
	http.Error(w, err.Error(), http.StatusBadRequest)
	return
	}
	r.Body = http.MaxBytesReader(w, r.Body, 1048576)
	var requestBody struct {
	IDToken string `json:"idToken"`
	}
	if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil {
	http.Error(w, err.Error(), http.StatusBadRequest)
	return
	}
	if requestBody.IDToken == "" {
	http.Error(w, "idToken is required", http.StatusBadRequest)
	return
	}

[gemini-code-assist]

To prevent potential Denial of Service (DoS) attacks via resource exhaustion, it is highly recommended to limit the request body size using http.MaxBytesReader before decoding. Additionally, we should validate that the idToken is not empty to avoid unnecessary downstream processing and return a 400 Bad Request instead of a 401 Unauthorized when the token is missing.

		r.Body = http.MaxBytesReader(w, r.Body, 1048576)
		var requestBody struct {
			IDToken string `json:"idToken"`
		}
		if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil {
			http.Error(w, err.Error(), http.StatusBadRequest)
			return
		}
		if requestBody.IDToken == "" {
			http.Error(w, "idToken is required", http.StatusBadRequest)
			return
		}