mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-17 02:59:11 +02:00
016b9f90e0* Add consent binding cookie to prevent confused deputy attacks (GHSA-rww4-4w9c-7733) The OAuthProxy's consent page verified user intent but didn't bind the consenting browser to the IdP callback. An attacker could intercept the upstream authorization URL after consent and send it to a victim, whose browser would complete the flow without having the consent cookie. This adds a signed consent binding cookie set during consent approval (both manual and auto-approve paths) and verified in the IdP callback handler. A different browser won't have this cookie and gets a 403. * Use startswith for URL assertion in consent binding test * Store consent bindings as per-transaction map to support parallel flows * Only accept __Host- consent binding cookie on HTTPS * chore: Update SDK documentation --------- Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| authentication.mdx | ||
| full-oauth-server.mdx | ||
| oauth-proxy.mdx | ||
| oidc-proxy.mdx | ||
| remote-oauth.mdx | ||
| token-verification.mdx | ||