fix(mesh): validate redirect_uri in oauth-proxy to prevent OAuth hijacking#3110
Merged
viktormarinho merged 5 commits intodecocms:mainfrom Apr 14, 2026
Conversation
…cking The oauth-proxy authorize endpoint was forwarding any redirect_uri to the upstream auth server without validation. An attacker could supply a malicious redirect_uri (e.g. https://evil.com) and steal authorization codes after consent. Now the proxy requires redirect_uri and rejects any host that is not studio.decocms.com (or subdomains) or localhost/127.0.0.1. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
🧪 BenchmarkShould we run the Virtual MCP strategy benchmark for this PR? React with 👍 to run the benchmark.
Benchmark will run on the next push after you react. |
Contributor
Release OptionsSuggested: Patch ( React with an emoji to override the release type:
Current version:
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
1 issue found across 1 file
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/mesh/src/api/app.ts">
<violation number="1" location="apps/mesh/src/api/app.ts:672">
P1: `redirect_uri` validation only checks one occurrence, but duplicate `redirect_uri` params are still forwarded, enabling potential authorize-flow bypass via parser differences.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Per RFC 6749 §4.1.1, redirect_uri is not always required. Only validate it when present to avoid breaking authorize requests that omit it. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/mesh/src/api/app.ts">
<violation number="1" location="apps/mesh/src/api/app.ts:673">
P2: Missing redirect_uri now bypasses validation: the authorize handler only checks allowlisted origins when redirect_uri is present, so requests without it are forwarded upstream with no local enforcement.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
apps/mesh/src/api/app.ts
Outdated
| redirectHost === "localhost" || | ||
| redirectHost === "127.0.0.1" || | ||
| redirectHost === "studio.decocms.com" || | ||
| redirectHost.endsWith(".studio.decocms.com"); |
…d hosts Use getSettings().baseUrl (falling back to request origin) to validate the redirect_uri origin, instead of a hardcoded allowlist of hostnames. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Canonicalize redirect_uri with searchParams.set() after validation so duplicate params are collapsed to the single checked value, closing a parser-differential bypass vector. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The oauth-proxy authorize endpoint was forwarding any redirect_uri to the upstream auth server without validation. An attacker could supply a malicious redirect_uri (e.g. https://evil.com) and steal authorization codes after consent.
Now the proxy requires redirect_uri and rejects any host that is not studio.decocms.com (or subdomains) or localhost/127.0.0.1.
Summary by cubic
Secures the oauth-proxy authorize endpoint by validating redirect_uri (optional per RFC 6749) to prevent OAuth hijacking. If present, its origin must match getSettings().baseUrl (or the request origin); invalid values return 400 invalid_request and duplicate redirect_uri params are collapsed to a single validated value.
Written for commit 21c0be5. Summary will update on new commits.