KRATOSandKRATOS ce4a996ffa fix(oauth): validate discovered endpoints before merge/use (#511) (#739) ...

Discovery metadata was merged without the https/loopback endpoint rule that
configured endpoints already pass, letting a malicious issuer downgrade the
authorization/token/device/registration endpoint after config validation.

- Add exported ValidateEndpointURL as the single endpoint-safety rule;
  validateTokenEndpoint now delegates to it.
- Backstop in BuildAuthorizationURL (the choke point both the provider and MCP
  flows build their browser URL through).
- Validate each discovered endpoint before merge in the provider resolveEndpoints
  and validate resolved MCP metadata in both branches; fail closed on insecure.

Co-authored-by: KRATOS <[email protected]>

2026-07-19 09:56:32 +05:30

..

client_test.go

fix(mcp): block cross-origin credential redirects (#396)

2026-07-03 06:02:05 +08:00

client.go

Deep-audit remediation + sandbox hardening (batches 1–35) (#189)

2026-06-13 21:32:48 +05:30

config_test.go

fix(mcp): silence startup warning for unconfigured default servers (#563)

2026-07-08 08:57:56 +08:00

config.go

fix: harden MCP credential boundaries (#597)

2026-07-10 09:00:17 +08:00

hang_test.go

MCP hardening: nested-schema passthrough + hung-server timeout (#124)

2026-06-07 21:35:25 +05:30

network_client_test.go

fix(mcp): block cross-origin credential redirects (#396)

2026-07-03 06:02:05 +08:00

network_client.go

fix: harden MCP credential boundaries (#597)

2026-07-10 09:00:17 +08:00

network_redirect.go

fix(mcp): block cross-origin credential redirects (#396)

2026-07-03 06:02:05 +08:00

oauth_store_test.go

fix: harden MCP credential boundaries (#597)

2026-07-10 09:00:17 +08:00

oauth_store.go

fix: harden MCP credential boundaries (#597)

2026-07-10 09:00:17 +08:00

oauth_test.go

fix(oauth): validate discovered endpoints before merge/use (#511) (#739)

2026-07-19 09:56:32 +05:30

oauth.go

fix(oauth): validate discovered endpoints before merge/use (#511) (#739)

2026-07-19 09:56:32 +05:30

permissions_lock_unix.go

[codex] add Go extension backend commands (#61)

2026-06-05 12:11:36 +05:30

permissions_lock_windows.go

[codex] add Go extension backend commands (#61)

2026-06-05 12:11:36 +05:30

permissions_test.go

[codex] add Go extension backend commands (#61)

2026-06-05 12:11:36 +05:30

permissions.go

[codex] add Go extension backend commands (#61)

2026-06-05 12:11:36 +05:30

prompts_test.go

wedge M2: MCP server resources/prompts + sandbox scoped egress + MCP OAuth (#179)

2026-06-12 20:41:59 +05:30

prompts.go

wedge M2: MCP server resources/prompts + sandbox scoped egress + MCP OAuth (#179)

2026-06-12 20:41:59 +05:30

protocol_test.go

audit: address PR review findings (security, correctness, tests)

2026-06-11 15:02:09 +05:30

protocol.go

mcp: cap framed message size and use newline-delimited stdio framing

2026-06-11 15:02:09 +05:30

registry_test.go

fix(mcp): silence startup warning for unconfigured default servers (#563)

2026-07-08 08:57:56 +08:00

registry.go

fix(mcp): silence startup warning for unconfigured default servers (#563)

2026-07-08 08:57:56 +08:00

resources_test.go

feat: add MCP manager UX (#188)

2026-06-13 22:20:42 +05:30

resources.go

wedge M2: MCP server resources/prompts + sandbox scoped egress + MCP OAuth (#179)

2026-06-12 20:41:59 +05:30

schema_test.go

MCP hardening: nested-schema passthrough + hung-server timeout (#124)

2026-06-07 21:35:25 +05:30

schema.go

MCP hardening: nested-schema passthrough + hung-server timeout (#124)

2026-06-07 21:35:25 +05:30

server_test.go

feat: add MCP server protocol

2026-06-05 14:03:47 +05:30

server.go

wedge M2: MCP server resources/prompts + sandbox scoped egress + MCP OAuth (#179)

2026-06-12 20:41:59 +05:30