stacklok / toolhive / 36266379326

71%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

* Bind OAuth callback to the initiating browser

The embedded authorization server loaded a pending authorization at
/oauth/callback purely by the upstream state parameter. Nothing tied the
record to the browser that called /oauth/authorize, so an attacker could
start a flow for their own client, hand the upstream IdP URL to a victim,
and receive an authorization code minted for the victim's identity
(GHSA-2gjv-f568-6cxp).

/oauth/authorize now sets a per-flow, HttpOnly, SameSite=Lax cookie whose
SHA-256 is stored on the pending record, and the callback completes a leg
only when the calling browser presents a matching cookie. The cookie uses
the __Host- prefix whenever the browser-facing authorize URL is https so
a sibling subdomain cannot plant a matching value. Each multi-upstream
chain leg mints its own binding. A callback without a valid binding is
answered with a plain 400 and consumes the record; it is never redirected
to the client's redirect URI. Records without a binding hash are refused
by storage and rejected at the callback. Config validation warns at
startup when an upstream's redirect_uri host differs from the authorize
host, since a host-only cookie cannot bridge them.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Bind device-flow login to the submitting browser

The device flow's verification page shares /oauth/callback with the
authorization-code flow and had the same gap: POST /oauth/device stored a
PendingDeviceLogin keyed only by the upstream state, so whoever reached the
callback with that state completed the login. A user_code holder could hand
the upstream URL to someone else and have that person's identity land on the
confirmation page for the holder's device (RFC 8628 Section 5.4).

The submit handler now mints the same browser-binding cookie and stores its
hash on the PendingDeviceLogin. Both the completion path and the
upstream-error path require the cookie; a foreign browser gets 400, ... (continued)

Coverage Stats

185 of 201 new or added lines in 10 files covered. (92.04%)

22 existing lines in 5 files now uncovered.

84545 of 119266 relevant lines covered (70.89%)

108.28 hits per line