Repository navigation

fix(auth): require OAuth callback state and validate ID token nonce - #209

Merged

Koosha-Owji merged 4 commits into

fix/stop-leaking-secretsfrom

fix/oauth-callback-state-nonce

Oct 5, 2026

Merged

fix(auth): require OAuth callback state and validate ID token nonce#209
Koosha-Owji merged 4 commits into
fix/stop-leaking-secretsfrom
fix/oauth-callback-state-nonce

Commits on Sep 27, 2026
- fix(auth): require OAuth callback state and validate ID token nonce
  KomanRudden
  committed
  445f44c
- test: disable GC around SmartOAuth timing loops
  KomanRudden
  committed
  ad0c2ee
Commits on Oct 1, 2026
- Merge branch 'fix/stop-leaking-secrets' into fix/oauth-callback-state-nonce
  
  KomanRudden
  and
  claude
  committed
  2a2c7aa
- fix(auth): always validate the ID token nonce; return 400 from the FastAPI callback
  
  KomanRudden
  and
  claude
  committed
  514f840