Alle Dateien
patches/HXA-2026-002-oauth-pkce-and-origin.diff
# HXA-2026-002 — derive the callback origin server-side and enable PKCE (S256)## Defensive patch. Two changes: (1) stop trusting the client-supplied `origin`, deriving# the OAuth callback origin from the request host / a configured base URL instead;# (2) enable PKCE so the authorization code cannot be redeemed from a foreign callback. --- a/core/routes/authentication/oauthMethods.ts+++ b/core/routes/authentication/oauthMethods.ts@@- // origin comes straight from the query string — attacker-controlled- const callbackUrl = origin + `/${purpose}/callback`;+ // Never trust a client-supplied origin. Derive it from the (proxy-aware) request host+ // or a configured base URL allowlist; reject anything that does not match.+ const callbackOrigin = resolveTrustedCallbackOrigin(ctx);+ const callbackUrl = callbackOrigin + `/${purpose}/callback`;@@+ // Enable PKCE (S256). The IDMS issuer metadata advertises code_challenge_methods_supported.+ const codeVerifier = generators.codeVerifier();+ const codeChallenge = generators.codeChallenge(codeVerifier);+ ctx.sessTools.set({ oauthCodeVerifier: codeVerifier }); --- a/core/modules/AdminStore/providers/CitizenFX.ts+++ b/core/modules/AdminStore/providers/CitizenFX.ts@@- return client.authorizationUrl({ response_type: 'code', scope, state });+ return client.authorizationUrl({+ response_type: 'code',+ scope,+ state,+ code_challenge: codeChallenge,+ code_challenge_method: 'S256',+ });