fix: validate OAuth state before token exchange - #381
Open
ryanduguid wants to merge 4 commits into
Open
Conversation
ryanduguid
marked this pull request as draft
August 12, 2026 17:49
ryanduguid
marked this pull request as ready for review
August 18, 2026 15:08
…allback validate_state only rejected a callback when params['state'] differed from @State. @State is nil unless the consumer passes state: in credentials, so the pre-exchange check was inert in the default configuration and a callback with no state parameter passed straight through to token_request and set_token_set. - Reject a missing or blank callback state whenever a state is configured, and raise before the authorization code is exchanged. - Compare the nonce in constant time over SHA-256 digests instead of String#==, which short circuits on length and then memcmps. - Keep the no-state-configured path permissive to avoid a breaking API change, and document the CSRF risk of omitting state in the README. Specs: the mismatched-state test used the symbol key 'state': so params['state'] was nil and it actually exercised the missing-state branch. Use the string key and cover matching, mismatched, absent and blank states separately, plus an end-to-end case asserting no token request or mutation on an absent state.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This preserves the SDK's existing optional-state compatibility: callers that do not configure state continue to work. It makes the existing configured-state protection effective before the mutating token exchange occurs.
Validation
git diff --checkThe full RSpec suite could not run locally because this Windows environment lacks MSYS2/native gem build support. The focused spec retains explicit no-token-request and no-token-mutation assertions, and now also proves that neither synthetic state value appears in the error.