Skip to content

1.0.124

Choose a tag to compare

View all tags
@nictuku nictuku released this 22 Sep 20:28
· 4 commits to main since this release
1.0.124
9365b94
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security: fixes the remaining item of GHSA-75j5-qp3x-mx37 — the local OAuth callback server minted and validated no state parameter (RFC 6749 §10.12), so a page that could reach it during the authorization window could hand it an authorization code of the attacker's choosing. The other two items in that report (reflected XSS, /token disclosure) were fixed in 1.0.121.

What's changed

  • fix(security): mint a random state per authorization request, carry it in the authorization URL, and require it on the callback — missing, mismatched or replayed state means the code is rejected and never stored (#164).
  • The callback server now binds 127.0.0.1 explicitly and shuts down as soon as it has handled a valid callback, instead of idling out the full 180-second window.

Full changelog: 1.0.123...1.0.124

Assets 2
Loading