Skip to content

fix(auth): require state before GitHub callback exchange - #649

Merged
harlan-zw merged 1 commit into
mainfrom
fix/oauth-callback-state
Oct 14, 2026
Merged

fix(auth): require state before GitHub callback exchange#649
harlan-zw merged 1 commit into
mainfrom
fix/oauth-callback-state

Conversation

@harlan-zw

@harlan-zw harlan-zw commented Oct 13, 2026

Copy link
Copy Markdown
Collaborator

🔗 Linked issue

Related to the source security review.

❓ Type of change

  • 📖 Documentation
  • 🐞 Bug fix
  • 👌 Enhancement
  • ✨ New feature
  • 🧹 Chore
  • ⚠️ Breaking change

📚 Description

GitHub callbacks could reach token exchange when both query state and the browser state cookie were absent. Require one nonempty state string matching a nonempty cookie before passing callback codes to the provider.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

@harlan-zw harlan-zw added the harlan-agent-review Pull request triage requires an adversarial Review. Adding this label manually always forces one. label Oct 13, 2026
@harlan-zw

harlan-zw commented Oct 13, 2026

Copy link
Copy Markdown
Collaborator Author

Agent verification, written by Codex using Harlan Agent Kit.

I ran 13 OAuth cases through local H3 and this site's installed provider.
The provider used dummy tokens and sessions. No live provider requests were sent.

Missing, empty, repeated, or mismatched state stopped before token exchange and session creation.
Matching state, initiation, stale-state restart, and provider denial preserved expected paths.
The same harness failed before the gate. Local typechecks and route lint passed.

@harlan-github-agent harlan-github-agent Bot added harlan-agent-review-required Pull request triage requires an adversarial Review for this head commit. harlan-agent-running An Agent holds a Task on this issue or pull request right now. and removed harlan-agent-review Pull request triage requires an adversarial Review. Adding this label manually always forces one. labels Oct 13, 2026
@harlan-github-agent

harlan-github-agent Bot commented Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-14 00:45 UTC.

GitHub merged this pull request.

No material findings were recorded.

40b0f5d1-7998-4d94-8d0a-932113e12631

@harlan-github-agent harlan-github-agent Bot added harlan-agent-ready The automated Review passed every gate on this head commit. and removed harlan-agent-running An Agent holds a Task on this issue or pull request right now. harlan-agent-review-required Pull request triage requires an adversarial Review for this head commit. labels Oct 13, 2026
harlan-github-agent[bot]
harlan-github-agent Bot reviewed Oct 13, 2026
View reviewed changes

@harlan-github-agent harlan-github-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results

@harlan-zw
harlan-zw merged commit 901ae12 into main Oct 14, 2026
8 checks passed
@harlan-github-agent harlan-github-agent Bot removed the harlan-agent-ready The automated Review passed every gate on this head commit. label Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@harlan-github-agent harlan-github-agent[bot] harlan-github-agent[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@harlan-zw