security: harden OAuth discovery and token endpoints by jeremy · Pull Request #480 · basecamp/basecamp-cli

jeremy · 2026-05-30T05:58:16Z

Harden OAuth discovery and token endpoints

(Threat: T1 malicious/compromised OAuth/discovery server.)

authorization_endpoint scheme validation (auth.go buildAuthURL): the endpoint comes from the server-controlled discovery doc and is later handed to OpenBrowser → xdg-open/open. Now required to be https (or http on loopback); a file:///--leading value is rejected before dispatch.
registration_endpoint scheme validation (registerBC3Client): the DCR path now validates the endpoint against the stricter isSecureEndpointURL whitelist (absolute URL with a non-empty host; https, or http on loopback), and re-validates every redirect hop with the same rule.
No-redirect OAuth client (appctx/context.go): CheckRedirect: ErrUseLastResponse. The exchange/refresh requests set GetBody, so Go would replay refresh_token/auth code to a redirect target; RFC 6749 token endpoints don't legitimately 3xx-redirect POSTs. Mirrors the SDK API client's redirect guard.

Tests

TestBuildAuthURL_RejectsUnsafeScheme (accepts https / http-loopback, rejects file://, foreign http://, javascript:, -flag).

Part 3/6 of the stacked security series. Base: `security/02-output-ansi-sanitize`.

📚 Stack (merge bottom-up)

security: reject foreign-host URLs in api to prevent token leak #478 — reject foreign-host URLs in api (base main)
security: strip ANSI/OSC escapes from API-controlled output #479 — strip ANSI/OSC escapes from output
security: harden OAuth discovery and token endpoints #480 — harden OAuth discovery / token endpoints
security: close config trust-boundary gaps and gate completion loader #481 — close config trust-boundary gaps + completion gate
security: tighten config-dir perms and validate plugin scope argv #482 — tighten config-dir perms + plugin scope argv
security: pin the gitleaks download with a SHA-256 checksum #483 — bump toolchain/x-net + CI gates

Each is independent except #482 depends on #481 (shared root.go). #478 can land first/alone.

Copilot

Pull request overview

Hardens OAuth discovery-derived endpoints to reduce protocol abuse and credential replay risk when interacting with potentially malicious OAuth/discovery servers.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Changes:

Validates authorization endpoints before browser dispatch, allowing only HTTPS or loopback HTTP.
Validates BC3 dynamic client registration endpoints with existing secure URL checks.
Disables redirects for the auth HTTP client used by OAuth discovery/token refresh and adds coverage for unsafe authorization schemes.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
`internal/auth/auth.go`	Adds endpoint validation for dynamic registration and authorization URL construction.
`internal/auth/auth_test.go`	Adds regression coverage for accepted/rejected authorization endpoint schemes.
`internal/appctx/context.go`	Configures the auth HTTP client to avoid following redirects.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cubic-dev-ai

1 issue found across 3 files

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9e7bb58e48

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 396ecac645

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5aed6d002d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

- Scheme-validate the discovery authorization_endpoint (https, or http on loopback) before it's dispatched to the OS browser launcher, so a hostile discovery doc can't hand the OS a file:// (or other) URL. - Enforce RequireSecureURL on the DCR registration_endpoint. - Set CheckRedirect on the OAuth HTTP client so token exchange/refresh POST bodies (auth code, refresh_token) aren't replayed to a redirect target. Idempotent GET/HEAD (OAuth discovery) may still follow redirects, so we don't break discovery or force an unintended Launchpad fallback.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Copilot AI review requested due to automatic review settings May 30, 2026 05:58

github-actions Bot added tests Tests (unit and e2e) auth OAuth authentication labels May 30, 2026

Copilot started reviewing on behalf of jeremy May 30, 2026 05:58 View session

Copilot AI reviewed May 30, 2026

View reviewed changes

cubic-dev-ai Bot reviewed May 30, 2026

View reviewed changes

Comment thread internal/appctx/context.go Outdated

jeremy force-pushed the security/02-output-ansi-sanitize branch from 7b1d3ea to 61aea03 Compare May 30, 2026 06:05

jeremy force-pushed the security/03-oauth-hardening branch from d858f7f to 9e7bb58 Compare May 30, 2026 06:05

github-actions Bot added the bug Something isn't working label May 30, 2026

chatgpt-codex-connector Bot reviewed May 30, 2026

View reviewed changes

Comment thread internal/appctx/context.go Outdated

jeremy force-pushed the security/02-output-ansi-sanitize branch from 61aea03 to e06c5c2 Compare May 30, 2026 06:13

Copilot AI review requested due to automatic review settings May 30, 2026 06:13

jeremy force-pushed the security/03-oauth-hardening branch from 9e7bb58 to 3f9352d Compare May 30, 2026 06:13

Copilot started reviewing on behalf of jeremy May 30, 2026 06:13 View session

Copilot AI reviewed May 30, 2026

View reviewed changes

Comment thread internal/auth/auth.go Outdated

jeremy force-pushed the security/02-output-ansi-sanitize branch from e06c5c2 to 9103d13 Compare May 30, 2026 06:23

jeremy force-pushed the security/03-oauth-hardening branch from 3f9352d to 396ecac Compare May 30, 2026 06:24

chatgpt-codex-connector Bot reviewed May 30, 2026

View reviewed changes

Comment thread internal/appctx/context.go Outdated

Copilot AI review requested due to automatic review settings May 30, 2026 07:51

jeremy force-pushed the security/03-oauth-hardening branch from 396ecac to 6a3a964 Compare May 30, 2026 07:51

jeremy force-pushed the security/02-output-ansi-sanitize branch from 9103d13 to dd63a13 Compare May 30, 2026 07:51

Copilot started reviewing on behalf of jeremy May 30, 2026 07:51 View session

Copilot AI reviewed May 30, 2026

View reviewed changes

Comment thread internal/auth/auth.go Outdated

jeremy force-pushed the security/02-output-ansi-sanitize branch from dd63a13 to 4566262 Compare May 30, 2026 08:27

jeremy force-pushed the security/03-oauth-hardening branch from 6a3a964 to 8add014 Compare May 30, 2026 08:27

jeremy force-pushed the security/03-oauth-hardening branch from e907e53 to 99167ce Compare July 13, 2026 23:23

Copilot started reviewing on behalf of jeremy July 13, 2026 23:24 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread internal/auth/auth.go

jeremy force-pushed the security/02-output-ansi-sanitize branch from e4b743e to 60dcdca Compare July 13, 2026 23:48

Copilot AI review requested due to automatic review settings July 13, 2026 23:48

jeremy force-pushed the security/03-oauth-hardening branch from 99167ce to 772fb95 Compare July 13, 2026 23:48

Copilot started reviewing on behalf of jeremy July 13, 2026 23:48 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread internal/auth/auth.go

jeremy force-pushed the security/02-output-ansi-sanitize branch from 60dcdca to 8c19e62 Compare July 14, 2026 00:07

Copilot AI review requested due to automatic review settings July 14, 2026 00:07

jeremy force-pushed the security/03-oauth-hardening branch from 772fb95 to 5aed6d0 Compare July 14, 2026 00:07

Copilot started reviewing on behalf of jeremy July 14, 2026 00:08 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Comment thread internal/auth/auth.go

chatgpt-codex-connector Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread internal/auth/auth.go

jeremy force-pushed the security/02-output-ansi-sanitize branch from 8c19e62 to e1e0036 Compare July 14, 2026 00:28

Copilot AI review requested due to automatic review settings July 14, 2026 00:28

jeremy force-pushed the security/03-oauth-hardening branch from 5aed6d0 to 35af249 Compare July 14, 2026 00:28

Copilot started reviewing on behalf of jeremy July 14, 2026 00:28 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Comment thread internal/auth/auth.go

Comment thread internal/auth/auth.go

jeremy force-pushed the security/02-output-ansi-sanitize branch from e1e0036 to 76fcf9e Compare July 14, 2026 01:06

Copilot AI review requested due to automatic review settings July 14, 2026 01:06

jeremy force-pushed the security/03-oauth-hardening branch from 35af249 to 6c221e2 Compare July 14, 2026 01:06

Copilot started reviewing on behalf of jeremy July 14, 2026 01:07 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Comment thread internal/auth/auth.go

Comment thread internal/auth/auth_test.go

Comment thread internal/auth/auth_test.go

jeremy force-pushed the security/02-output-ansi-sanitize branch from 76fcf9e to 1e3cb4c Compare July 14, 2026 01:35

Copilot AI review requested due to automatic review settings July 14, 2026 01:35

jeremy force-pushed the security/03-oauth-hardening branch from 6c221e2 to fdf0fc8 Compare July 14, 2026 01:35

Copilot started reviewing on behalf of jeremy July 14, 2026 01:35 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Uh oh!

Conversation

jeremy commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Harden OAuth discovery and token endpoints

Tests

Part 3/6 of the stacked security series. Base: security/02-output-ansi-sanitize.

📚 Stack (merge bottom-up)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

jeremy commented May 30, 2026 •

edited

Loading

Part 3/6 of the stacked security series. Base: `security/02-output-ansi-sanitize`.

cubic-dev-ai Bot left a comment •

edited

Loading