mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 20:53:06 +00:00
Oliver Kieselbach
384ac0d380
Address three review findings on the OAuth proxy: 1. (Medium) client_id was optional at /oauth/authorize, falling back to the host allowlist alone — bypassing the per-client redirect_uri binding by simply omitting client_id. The cold-start reason for tolerating absence is gone now that client_id is a stateless, replica-portable signed token, and every conforming MCP client registers first. client_id is now REQUIRED (400 invalid_request when missing). 2. (Medium/Low) /oauth/callback signed-state + client enforcement had no route-level tests. Added coverage: valid signed state+client forwards the code, forged client_id, redirect_uri not registered to the client, tampered state, missing state, expired state (10-min replay window), and the missing-code case from finding 3. 3. (Low) /oauth/callback redirected with code=undefined when Entra returned neither error nor code. Now returns 400 invalid_request on a missing code instead of forwarding a malformed query. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>