authn: the insecure JWKS transport ignores proxy env vars and DefaultTransport's defaults

[sthanikan2000]

Found while migrating nsw-agency from a forked copy of this package to core/authn v0.3.0 (OpenNSW/agency#213).

What

NewManager builds a bare http.Transport when InsecureSkipTLSVerify is set — authn/manager.go:

httpClient := &http.Client{Timeout: 10 * time.Second}
if authConfig.InsecureSkipTLSVerify {
    httpClient.Transport = &http.Transport{
        TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
    }
}

A zero-valued http.Transport has Proxy == nil, so it ignores HTTP_PROXY/HTTPS_PROXY/NO_PROXY, and it also drops http.DefaultTransport's connection-pool and dial defaults (MaxIdleConns, IdleConnTimeout, TLSHandshakeTimeout, HTTP/2 via ForceAttemptHTTP2).

In a dev environment where the IdP is only reachable through a proxy, the JWKS fetch fails and every token is rejected, with nothing in the error to suggest the proxy was bypassed.

Suggested fix

Clone the default transport instead of replacing it, which is what the code this package replaced in nsw-agency did:

if authConfig.InsecureSkipTLSVerify {
    if tr, ok := http.DefaultTransport.(*http.Transport); ok {
        customTransport := tr.Clone()
        customTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec
        httpClient.Transport = customTransport
    }
}

Scope

InsecureSkipTLSVerify is gated to development in nsw-agency (it refuses to start unless APP_ENV=development), so the secure path is unaffected — the default nil transport already resolves to http.DefaultTransport. This only bites the dev/self-signed path.