fix(csp): resolve the consent form-action origin for PAR and localhost clients - #62
Merged
Merged
Conversation
…t clients consentFormActionOrigins only read redirect_uri from the query string, so PAR clients (client_id + request_uri, the flow the developer docs show) still rendered consent with form-action 'self' and Chromium blocked the approve 303 - the exact breakage b4684ab set out to fix. Resolve the redirect origin from the pushed request when only request_uri is present. Also allow http origins for localhost/127.0.0.1, matching the redirect URI rule enforced at app registration, so local dev clients can complete consent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
b4684ab widened
form-actionon/oauth/authorizefrom theredirect_uriquery param only. PAR clients (RFC 9126) arrive withclient_id+request_uriand no queryredirect_uri, so a signed-in user's Approve 303 was still CSP-blocked in Chromium - the exact breakage that commit set out to fix, on the flow the developer docs show as canonical. The https-only filter also broke documentedhttp://localhostclients.consentFormActionOriginsresolves the redirect origin from the pushed request (findPushedRequest) wheneverrequest_uriis present, taking precedence over any queryredirect_urito mirrorgetOAuthAuthorizeView- a crafted link carrying both params can no longer desync the CSP from the form target.scheme://host:portshape before entering the header, so hostname oddities cannot split the form-action directive.form-action 'self'(pre-fix behavior) rather than failing the request.Review attention:
proxy.tsnow imports the oauth repository, so the Node-runtime proxy bundle carries pg and lazily opens its own pool (up toDATABASE_POOL_MAX, default 10) once PAR consent traffic occurs - worth sizing againstmax_connectionswith the web and worker pools on the same host. The build was verified with the import in place. A longer-term alternative would retire the widening entirely: a same-origin continuation page after approve.