karanshukla / kodamachi / 36931713608

100%

push

github

fix(server): bind the OAuth callback to the browser that started the login (#526)

The OAuth state was never tied to the browser, and AppSessionData.oauthState
was declared but unused, so a callback or oauth_token from someone else's
login could sign this browser into their account.

/login now stores a random state in the session cookie and passes it to
authorize. /oauth/callback redirects with oauth_failed unless the returned
state matches, then clears it. /oauth/consume only confirms the DID the
callback already set on this browser.

1068 of 1068 branches covered (100.0%)

Branch coverage included in aggregate %.

14 of 14 new or added lines in 2 files covered. (100.0%)

4602 of 4602 relevant lines covered (100.0%)

62.61 hits per line