fix(oauth): Validate state session ID in Oauth2 callback #5366
Conversation
2203853 to
acbe22a
Compare
acbe22a to
7556959
Compare
TBonnin
left a comment
There was a problem hiding this comment.
Have you tested this change? I don't think the public API currently support cookies.
Also what about the other oauth2 flows (mcp, oauth2cc, outbound, ...)? Are they also vulnerable?
afe5a0c to
46f08f3
Compare
I have tested this with several |
Thank you for checking. Makes sense to split the PRs. It would be good to address the other auth modes relatively quickly |
CVE-2023-36019 is out of the bag. We are affected by a similar vulnerability.
To mitigate, we validate
stateagainst an OOB cookie carried by the OAuth2 flow initiator.Consider this change high-risk, as some OAuth2 providers are known to not implement the specification correctly. That could lead to broken providers in Nango.
You can ignore the first commit in this PR, as it turned out to be tautological.
The controller now mints a secure, HTTP-only
oauth2-${session.id}cookie whenever it issues an authorization URL, the callback handler refuses token exchanges until that cookie is presented and then clears it, and cookie parsing is confined to the/oauth/callbackroute so the rest of the public router remains unaffected.This summary was automatically generated by @propel-code-bot