fbf8ca38b0
Replace client-controlled redirectUri with server-side redirect intents. The portal server component validates the ?rd= hostname against isForwardAuthDomain, stores the URI in a new forward_auth_redirect_intents table, and passes only an opaque rid (128-bit random, SHA-256 hashed) to the client. Login endpoints consume the intent atomically (one-time use, 10-minute TTL) and retrieve the stored URI — the client never sends the redirect URL to any API endpoint. Security properties: - Redirect URI is never client-controlled in API requests - rid is 128-bit random, stored as SHA-256 hash (not reversible from DB) - Atomic one-time consumption prevents replay - 10-minute TTL limits attack window for OAuth round-trip - Immediate deletion after consumption - Expired intents cleaned up opportunistically - Hostname validated against registered forward-auth domains before storage Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
140 lines
2.7 KiB
JSON
140 lines
2.7 KiB
JSON
{
|
|
"version": "5",
|
|
"dialect": "sqlite",
|
|
"entries": [
|
|
{
|
|
"idx": 0,
|
|
"version": "6",
|
|
"when": 1762515724134,
|
|
"tag": "0000_initial",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 1,
|
|
"version": "6",
|
|
"when": 1766854292252,
|
|
"tag": "0001_adorable_sally_floyd",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 2,
|
|
"version": "6",
|
|
"when": 1766880443160,
|
|
"tag": "0002_perfect_hedge_knight",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 3,
|
|
"version": "6",
|
|
"when": 1769262874211,
|
|
"tag": "0003_instances",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 4,
|
|
"version": "6",
|
|
"when": 1770395358533,
|
|
"tag": "0004_slimy_grim_reaper",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 5,
|
|
"version": "6",
|
|
"when": 1770395358534,
|
|
"tag": "0005_remove_static_response",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 6,
|
|
"version": "6",
|
|
"when": 1770395358535,
|
|
"tag": "0006_remove_redirects",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 7,
|
|
"version": "6",
|
|
"when": 1740441600000,
|
|
"tag": "0007_linking_tokens",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 8,
|
|
"version": "6",
|
|
"when": 1740960000000,
|
|
"tag": "0008_unique_provider_subject",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 9,
|
|
"version": "6",
|
|
"when": 1772129593846,
|
|
"tag": "0009_watery_bill_hollister",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 10,
|
|
"version": "6",
|
|
"when": 1772200000000,
|
|
"tag": "0010_waf",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 11,
|
|
"version": "6",
|
|
"when": 1772300000000,
|
|
"tag": "0011_mtls",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 12,
|
|
"version": "6",
|
|
"when": 1772400000000,
|
|
"tag": "0012_ca_private_key",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 13,
|
|
"version": "6",
|
|
"when": 1772500000000,
|
|
"tag": "0013_issued_client_certificates",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 14,
|
|
"version": "6",
|
|
"when": 1772806000000,
|
|
"tag": "0014_waf_blocked",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 15,
|
|
"version": "6",
|
|
"when": 1774300000000,
|
|
"tag": "0015_l4_proxy_hosts",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 16,
|
|
"version": "6",
|
|
"when": 1775400000000,
|
|
"tag": "0016_mtls_rbac",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 17,
|
|
"version": "6",
|
|
"when": 1775500000000,
|
|
"tag": "0017_forward_auth",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 18,
|
|
"version": "6",
|
|
"when": 1775600000000,
|
|
"tag": "0018_forward_auth_redirect_intents",
|
|
"breakpoints": true
|
|
}
|
|
]
|
|
}
|