Skip to content

v0.3.1 — fix OAuth consent POST 401 in real browsers

Choose a tag to compare

View all tags
@ricbwood ricbwood released this 05 Jun 19:53
· 26 commits to main since this release
v0.3.1
1bd4dad
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes the OAuth consent Approve returning 401 access_denied / "Authentication required" in real browsers

The consent page sent Referrer-Policy: no-referrer, which per the Fetch spec makes browsers send Origin: null on its form POST. Payload rejects null-origin cookie auth on mutations, so POST /api/oauth/consent lost req.user → 401. The GET render worked (no Origin on navigations), so the failure only appeared on the Approve submit — and only in a real browser (the install-test POSTs programmatically, so CI never caught it).

Fix: consent page (and htmlResponse) now use Referrer-Policy: strict-origin-when-cross-origin — the value the threat model (row I6) already specified. Keeps the real Origin on the same-origin consent POST while still stripping the full URL from the cross-origin client callback.

This affects any deployment doing the OAuth flow through a real browser (e.g. Claude.ai custom connectors). Upgrade from 0.3.0.

Full diff: #46

Assets 2
Loading