From b7d440b1834c30c24806fd5944fa9ec3ce103105 Mon Sep 17 00:00:00 2001
From: Ronni Skansing <rskansing@gmail.com>
Date: Sat, 28 Feb 2026 01:28:56 +0100
Subject: [PATCH] add missing timeout to oauth handler

Signed-off-by: Ronni Skansing <rskansing@gmail.com>
---
 backend/service/sso.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/backend/service/sso.go b/backend/service/sso.go
index b8a185f..2a759f1 100644
--- a/backend/service/sso.go
+++ b/backend/service/sso.go
@@ -7,6 +7,7 @@ import (
 	"io"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/AzureAD/microsoft-authentication-library-for-go/apps/confidential"
 	"github.com/gin-gonic/gin"
@@ -220,7 +221,9 @@ func (s *SSO) HandlEntraIDCallback(
 }
 
 func (s *SSO) getMsGraphMe(ctx context.Context, accessToken string) (*MsGraphUserInfo, error) {
-	client := &http.Client{}
+	client := &http.Client{
+		Timeout: 10 * time.Second,
+	}
 	req, err := http.NewRequestWithContext(ctx, "GET", "https://graph.microsoft.com/v1.0/me", nil)
 	if err != nil {
 		return nil, errs.Wrap(err)