0.22.0

⚠️ Security fix and breaking change

This release fixes an OAuth login CSRF vulnerability
(GHSA-wgrh-7h2j-rg46,
CWE-352), reported by @mohammedix88 (cystack.ps redteam).

SSOBase.requires_state defaulted to False, so the state validation added in 0.19.0 never ran
unless you opted in. Any application on the default configuration accepted a callback with nothing
bound to the caller's session. Upgrading is recommended for all users.

requires_state now defaults to True. A login flow that does not carry the sso_state cookie
back to your callback will now fail with 401 State cookie not found. This affects you if:

• you do not use the SSO instance as a context manager (async with sso:), so no state is generated
• your login and callback endpoints are served from different hosts, so the browser does not return
  the cookie
• you build the redirect yourself from get_login_url, which returns a URL and sets no cookie.
  This now emits a SecurityWarning at login time, so you will see it before your users do

If you cannot carry the cookie, you can opt out per instance and keep the old behaviour, at the cost
of losing CSRF protection:

sso = GoogleSSO(client_id, client_secret, redirect_uri)
sso.requires_state = False

The sso_state cookie is now also set HttpOnly, SameSite=lax, and Secure unless
allow_insecure_http is enabled.

What's Changed

• chore(deps): bump the all group across 1 directory with 5 updates by @dependabot[bot] in #297
• chore(deps-dev): bump the all group with 4 updates by @dependabot[bot] in #298
• chore(deps): bump the all group with 4 updates by @dependabot[bot] in #299
• chore(deps): bump the all group with 3 updates by @dependabot[bot] in #300
• chore(deps): bump the all group with 3 updates by @dependabot[bot] in #301
• chore(deps-dev): bump uvicorn from 0.52.0 to 0.52.1 in the all group by @dependabot[bot] in #302
• chore(deps-dev): bump the all group with 3 updates by @dependabot[bot] in #303
• chore(deps-dev): bump the all group with 3 updates by @dependabot[bot] in #305
• chore(deps-dev): bump the all group with 2 updates by @dependabot[bot] in #306
• fix!: enforce OAuth state validation by default by @autonomous-bot-agent-tomasvotava[bot] in #307

New Contributors

• @autonomous-bot-agent-tomasvotava[bot] made their first contribution in #307

Full Changelog: 0.21.1...0.22.0