KRATOSandKRATOS 974fc036c2 fix(oauth): refuse redirects on credential POSTs (#729) (#741) ...

Token exchange/refresh and the device authorization/poll POSTs validated only
the initial endpoint, then let the http.Client follow a 307/308 that replays the
form body (code, PKCE verifier, refresh_token, client_secret) to an unvalidated
origin.

Add withoutRedirects(): a shallow client copy whose CheckRedirect refuses every
redirect (ErrUnsafeRedirect). Applied at PostToken (covers ExchangeCode, Refresh,
and MCP which delegate to it), RequestDeviceCode, and pollDeviceOnce. The caller's
client is never mutated; legitimate token endpoints that return 200 are unaffected.

Co-authored-by: KRATOS <[email protected]>

2026-07-20 08:19:37 +05:30

..

device_test.go

fix(oauth): refuse redirects on credential POSTs (#729) (#741)

2026-07-20 08:19:37 +05:30

device.go

fix(oauth): refuse redirects on credential POSTs (#729) (#741)

2026-07-20 08:19:37 +05:30

discovery.go

feat(oauth): reusable provider OAuth engine + zero auth CLI (#210)

2026-06-15 18:47:43 +05:30

encrypt_test.go

Align permission prompt rendering (#246)

2026-06-18 16:53:20 +05:30

encrypt.go

fix: address bugs found in a multi-agent codebase audit (#481)

2026-07-06 18:48:28 +08:00

flow_test.go

fix(oauth): refuse redirects on credential POSTs (#729) (#741)

2026-07-20 08:19:37 +05:30

flow.go

fix(oauth): refuse redirects on credential POSTs (#729) (#741)

2026-07-20 08:19:37 +05:30

lock.go

fix(lock): prevent POSIX lock file overwrite and leak on Windows/Unix (#628)

2026-07-13 21:45:08 +08:00

loopback_test.go

fix(oauth): make ChatGPT (Codex) login work end-to-end (#264)

2026-06-20 23:00:01 +05:30

loopback.go

fix(oauth): make ChatGPT (Codex) login work end-to-end (#264)

2026-06-20 23:00:01 +05:30

manager_test.go

fix(oauth): validate discovered endpoints before merge/use (#511) (#739)

2026-07-19 09:56:32 +05:30

manager.go

fix(oauth): validate discovered endpoints before merge/use (#511) (#739)

2026-07-19 09:56:32 +05:30

oauth.go

fix(oauth): refuse redirects on credential POSTs (#729) (#741)

2026-07-20 08:19:37 +05:30

pkce.go

feat(oauth): reusable provider OAuth engine + zero auth CLI (#210)

2026-06-15 18:47:43 +05:30

presets_test.go

fix(oauth): make xAI / Hugging Face OAuth actually launch from the wizard (#355)

2026-07-01 18:37:56 +05:30

presets.go

fix(oauth): make xAI / Hugging Face OAuth actually launch from the wizard (#355)

2026-07-01 18:37:56 +05:30

providers_test.go

feat(oauth): reusable provider OAuth engine + zero auth CLI (#210)

2026-06-15 18:47:43 +05:30

providers.go

OAuth / account login for providers (OpenRouter, xAI) + subscription-proxy support (#217)

2026-06-16 15:33:36 +05:30

refresh_singleflight_test.go

fix five concurrency/leak bugs (swarm, specialist, oauth, mcp, cron) (#265)

2026-06-20 10:39:55 +05:30

scheduler_test.go

Audit tail: remaining medium/low correctness fixes (CLI, config, OAuth, tools, LSP, TUI) (#275)

2026-06-20 22:21:48 +05:30

scheduler.go

Audit tail: remaining medium/low correctness fixes (CLI, config, OAuth, tools, LSP, TUI) (#275)

2026-06-20 22:21:48 +05:30

secret_access_other.go

Add request permissions flow (#248)

2026-06-18 20:00:35 +05:30

secret_access_windows.go

Add request permissions flow (#248)

2026-06-18 20:00:35 +05:30

store_keyring_test.go

Audit backlog: tui mouse API, notify webhook, swarm scheduling, daemon-remote bundles, MCP/oauth store unification, OS keyring, dead-code prune (#216)

2026-06-16 14:48:12 +05:30

store_test.go

feat(providers): OAuth login profiles and list-first /provider manager (#560)

2026-07-07 10:34:59 +08:00

store.go

feat(providers): OAuth login profiles and list-first /provider manager (#560)

2026-07-07 10:34:59 +08:00