cliffhall
1e501fa5cb
fix: redact sensitive query values from timeout diagnostics ( #2319 round 23) ...
The timeout message interpolated the raw request URL, and
createFetchTracker records that message verbatim into the Network log
and the persisted session. An OAuth endpoint's query string can carry a
`code`, an `access_token` or a `client_secret` — exactly the fields
fetchTracking already redacts everywhere else it records a URL — so a
stalled signed endpoint would have written its secret to both.
Redacted with the existing `redactUrlQuery`, in the
OAuthRequestTimeoutError constructor rather than at each display site,
so both the message and the public `url` field are covered by
construction and no future consumer can reintroduce it. The route's own
proxied-timeout message and the URL in its 504 marker get the same
treatment, since both cross back to the browser and are recorded there.
The path and every non-sensitive parameter survive, so the endpoint
stays identifiable — which was the point of naming it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YFnM6RqB4nXqNysgUYmjmq
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-09-11 07:57:38 -04:00
Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage.
2026-07-04 21:56:45 -07:00
fix: delegate issuer context and discovery state through the EMA wrapper
2026-09-07 02:38:13 -04:00
fix(auth): make the stuck-lock guidance conditional, not an instruction ( #2082 )
2026-08-23 12:49:06 -04:00
Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage.
2026-07-04 21:56:45 -07:00
feat: per-server custom OAuth authorization-request parameters ( #2018 )
2026-08-15 19:31:41 -04:00
fix(auth): pass the challenge's resource_metadata URL to SDK auth()
2026-08-24 19:48:40 -04:00
fix: read the SDK's own discovery state instead of a marker of our own
2026-09-07 02:03:12 -04:00
fix(auth): require JWT shape before trusting exp as proof of validity
2026-08-24 07:46:10 -04:00
fix(oauth): walk the candidates in the CLI refresh path too
2026-08-26 00:34:27 -04:00
perf(auth): gate the override wrapper on the discovery request, and guard disk values
2026-08-16 22:11:16 -04:00
fix: make the proxy deadline per-request, not unconditional ( #2319 round 13)
2026-09-11 05:24:24 -04:00
fix: the classifier does not survive structuredClone, and the test now proves it
2026-09-07 11:16:51 -04:00
fix(auth): explicit re-authorize when the OAuth callback state was lost ( #1808 ) ( #1810 )
2026-07-27 18:08:31 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
fix(auth): keep oauth-persist browser-safe (move Node file backend out)
2026-07-08 16:20:31 -04:00
fix: use Node storage in the revocation e2e, and drop the now-dead storage API ( #2144 )
2026-08-28 08:36:58 -04:00
fix: usable IPv6 spelling, and drop a SEP label that means something else here (round 2)
2026-09-07 09:54:17 -04:00
fix: release the discarded discovery response on every throw ( #2319 round 22)
2026-09-11 07:42:17 -04:00
fix: read the SDK's own discovery state instead of a marker of our own
2026-09-07 02:03:12 -04:00
fix: redact sensitive query values from timeout diagnostics ( #2319 round 23)
2026-09-11 07:57:38 -04:00
fix: cancel the discarded proxy stream, refresh revocation docs ( #2319 round 8)
2026-09-11 04:00:44 -04:00
fix(oauth): filter the step-up scope union too, not just the provider
2026-08-24 23:05:14 -04:00
feat(web,core): enterprise-managed authorization (EMA) ( #1509 ) ( #1512 )
2026-06-24 22:15:12 -04:00
fix(auth): stop a config-only PUT deleting stored secrets ( #2084 )
2026-08-22 23:30:17 -04:00
fix: read the SDK's own discovery state instead of a marker of our own
2026-09-07 02:03:12 -04:00
fix: read the SDK's own discovery state instead of a marker of our own
2026-09-07 02:03:12 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
1e501fa5cb