Skip to content

fix(auth): Connect CoinPay without a session goes to the public /login - #145

Merged
sh1pt-actions-fleet[bot] merged 1 commit into
masterfrom
coinpay-connect-redirect
Oct 29, 2026
Merged

sh1pt-actions-fleet[bot] merged 1 commit into
masterfrom
coinpay-connect-redirect

Conversation

@sh1pt-actions-fleet

Copy link
Copy Markdown
Contributor

Follow-up to #144: /auth/login?mode=connect with no password session redirected to req.nextUrl.origin (http://localhost:8080 behind the proxy). It now uses the allowlisted request origin like the rest of the flow. Test updated.

🤖 Generated with Claude Code

…not the container origin

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

30 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 26 | LOW: 2

Severity Rule Location
HIGH sh-remote-script-execution public/install.sh:302
HIGH sh-remote-script-execution public/install.sh:305
MEDIUM js-open-redirect app/dashboard/[[...tab]]/page.tsx:67
MEDIUM js-open-redirect app/signup/page.tsx:51
MEDIUM js-unescaped-html-sink components/PitFooter.tsx:30
MEDIUM js-open-redirect components/PitSearch.tsx:118
MEDIUM js-unescaped-html-sink components/Tenant.tsx:29
MEDIUM js-unescaped-html-sink components/Tenant.tsx:30
MEDIUM js-unescaped-html-sink components/Tenant.tsx:78
MEDIUM js-unescaped-html-sink components/Tenant.tsx:150
MEDIUM sql-template-interpolation lib/db.ts:590
MEDIUM sql-template-interpolation lib/db.ts:1308
MEDIUM redos-nested-quantifier lib/markdown.ts:109
MEDIUM sql-template-interpolation lib/webhook-store.ts:95
MEDIUM sql-template-interpolation lib/webhook-store.ts:102
MEDIUM sql-template-interpolation lib/webhook-store.ts:108
MEDIUM sql-template-interpolation lib/webhook-store.ts:111
MEDIUM sql-template-interpolation lib/webhook-store.ts:116
MEDIUM sql-template-interpolation lib/webhook-store.ts:117
MEDIUM sql-template-interpolation lib/webhook-store.ts:121
MEDIUM sql-template-interpolation lib/webhook-store.ts:128
MEDIUM sql-template-interpolation lib/webhook-store.ts:133
MEDIUM sql-template-interpolation lib/webhook-store.ts:144
MEDIUM sql-template-interpolation lib/webhook-store.ts:154
MEDIUM sql-template-interpolation lib/webhooks.ts:207
MEDIUM sh-remote-script-execution public/install.sh:123
MEDIUM sh-remote-script-execution public/install.sh:127
MEDIUM sh-remote-script-execution public/install.sh:146
LOW secret-generic-credential tests/signup-profile.test.mjs:28
LOW secret-generic-credential tests/signup-profile.test.mjs:39

Snippets are redacted; ThreatCrush never prints matched credential material.

@sh1pt-actions-fleet
sh1pt-actions-fleet Bot merged commit c841d19 into master Oct 29, 2026
5 checks passed
@sh1pt-actions-fleet
sh1pt-actions-fleet Bot deleted the coinpay-connect-redirect branch October 29, 2026 05:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant