Repository navigation

fix: stop leaking secrets through logs and session storage - #206

Open

KomanRudden wants to merge 22 commits into

mainfrom

fix/stop-leaking-secrets

Open

fix: stop leaking secrets through logs and session storage#206
KomanRudden wants to merge 22 commits into
mainfrom
fix/stop-leaking-secrets

Commits on Sep 26, 2026
- fix: stop leaking secrets through logs and session storage
  KomanRudden
  committed
  7e539fb
Commits on Sep 27, 2026
- fix(auth): require OAuth callback state and validate ID token nonce
  KomanRudden
  committed
  445f44c
- test: disable GC around SmartOAuth timing loops
  KomanRudden
  committed
  ad0c2ee
Commits on Sep 29, 2026
- fix(auth): keep configured client secret and strip legacy secrets from sessions
  
  KomanRudden
  and
  claude
  committed
  3fe1664
Commits on Oct 1, 2026
- Merge branch 'fix/stop-leaking-secrets' into fix/oauth-callback-state-nonce
  
  KomanRudden
  and
  claude
  committed
  2a2c7aa
- fix(auth): always validate the ID token nonce; return 400 from the FastAPI callback
  
  KomanRudden
  and
  claude
  committed
  514f840
Commits on Oct 5, 2026
- Merge pull request #209 from kinde-oss/fix/oauth-callback-state-nonce
  Koosha-Owji
  authored
  c8a01f5
Commits on Oct 6, 2026
- fix(auth): stop leaking token errors and keep sessions across workers
  
  KomanRudden
  and
  cursoragent
  committed
  70b2cb8
Commits on Oct 8, 2026
- fix(auth): only call the Account API over HTTPS
  KomanRudden
  committed
  ddab53f
Commits on Oct 9, 2026
- test: cover the remaining lines changed in this PR
  KomanRudden
  committed
  6bf860b
Commits on Oct 10, 2026
Commits on Oct 19, 2026
- fix(auth): check the ID token issuer, audience and expiry; clean old sessions on load
  KomanRudden
  committed
  d7d64c7
Commits on Oct 30, 2026
- fix: log out before clearing the session; redact legacy helper errors
  KomanRudden
  committed
  100274d
- test: refuse an Account API host with an invalid port
  KomanRudden
  committed
  ee69be8
Commits on Nov 3, 2026
- fix(auth): keep a client secret passed to set_user_data() in memory
  KomanRudden
  committed
  4e1ceb7
- test: check that logout revokes the access token
  KomanRudden
  committed
  b515150
Commits on Nov 4, 2026
- fix(auth): keep a client secret passed to set_user_data() on that session only
  KomanRudden
  committed
  9619f94
- chore: ignore local env files, .DS_Store, Wrangler state and workspaces
  KomanRudden
  committed
  07a60c8
Commits on Nov 5, 2026
- fix(auth): sign out even if SDK logout fails; fail generation when a spec fix can't be applied
  KomanRudden
  committed
  9307506

Navigation Menu

Repository navigation

fix: stop leaking secrets through logs and session storage - #206

fix: stop leaking secrets through logs and session storage#206
KomanRudden wants to merge 22 commits into
mainfrom
fix/stop-leaking-secrets

Commits on Sep 26, 2026

fix: stop leaking secrets through logs and session storage

Commits on Sep 27, 2026

fix(auth): require OAuth callback state and validate ID token nonce

test: disable GC around SmartOAuth timing loops

Commits on Sep 29, 2026

fix(auth): keep configured client secret and strip legacy secrets from sessions

Commits on Oct 1, 2026

Merge branch 'fix/stop-leaking-secrets' into fix/oauth-callback-state-nonce

fix(auth): always validate the ID token nonce; return 400 from the FastAPI callback

Commits on Oct 5, 2026

Merge pull request #209 from kinde-oss/fix/oauth-callback-state-nonce

Commits on Oct 6, 2026

fix(auth): stop leaking token errors and keep sessions across workers

Commits on Oct 8, 2026

fix(auth): only call the Account API over HTTPS

Commits on Oct 9, 2026

test: cover the remaining lines changed in this PR

Commits on Oct 10, 2026

fix(storage): log a failed device ID write instead of ignoring it

fix(auth): only use the token issuer as Account API host when it matches the configured host

fix(fastapi): return 500, not 400, for unexpected callback errors

fix(flask): return 500, not 400, for unexpected callback errors

Commits on Oct 19, 2026

fix(auth): check the ID token issuer, audience and expiry; clean old sessions on load

Commits on Oct 30, 2026

fix: log out before clearing the session; redact legacy helper errors

test: refuse an Account API host with an invalid port

Commits on Nov 3, 2026

fix(auth): keep a client secret passed to set_user_data() in memory

test: check that logout revokes the access token

Commits on Nov 4, 2026

fix(auth): keep a client secret passed to set_user_data() on that session only

chore: ignore local env files, .DS_Store, Wrangler state and workspaces

Commits on Nov 5, 2026

fix(auth): sign out even if SDK logout fails; fail generation when a spec fix can't be applied