fix: guard unsafe requests whatever the SameSite setting, and no refresh replay after rotation by Bccorb · Pull Request #270 · fells-code/seamless-auth-server

test: reproduce body-less form POST CSRF under SameSite=Lax

Bccorb

committed

1f64072

fix: guard unsafe auth requests whatever the SameSite setting

Bccorb

committed

9eb1b63

test(core): reproduce replay of a completed refresh rotation

Bccorb

committed

00468d9

fix(core): share a refresh rotation only while it is in flight

Bccorb

committed

41bc08b

test: reproduce guards that skip the origin check

Bccorb

committed

09f599b

fix: run the origin check in the Express and Fastify guards

Bccorb

committed

e5608a5

docs: describe the content-type gate and guard origin check

Bccorb

committed

674d414

test(express): reproduce forwarding a client IP under a trust-everything proxy setting

Bccorb

committed

30f1301

fix(express): detect any trust-everything proxy setting before forwarding the client IP

Bccorb

committed

a63c4f6

test(core): keep keys served at the host root from verifying prefixed auth server tokens

Bccorb

committed

0ccda2d

test(core): reproduce client credentials tokens that look like users

Bccorb

committed

cdab867

fix(core): mark client credentials tokens on the resource server user

Bccorb

committed

1fc3b9c

test(core): reproduce resource server guards that cannot require a user

Bccorb

committed

29ce8fc

feat: let verify-only resource servers require a user

Bccorb

committed

8aa4bbe

Merge remote-tracking branch 'origin/main' into fix/wave1-origin-and-refresh-replay

Bccorb

committed

c81aaf6

ci: run conformance from seamless-cli v0.27.2 and hold Next.js to the content-type gate

Bccorb

committed

e054f5b

test(core): reproduce a second tab losing its session on a late refresh cookie

Bccorb

committed

fa9c5b9

fix: keep a completed refresh for cookie transport for five seconds

Bccorb

committed

595dfaa

Navigation Menu

Repository navigation

fix: guard unsafe requests whatever the SameSite setting, and no refresh replay after rotation - #270

fix: guard unsafe requests whatever the SameSite setting, and no refresh replay after rotation#270
Bccorb merged 18 commits into
mainfrom
fix/wave1-origin-and-refresh-replay

Commits on Nov 3, 2026

test: reproduce body-less form POST CSRF under SameSite=Lax

fix: guard unsafe auth requests whatever the SameSite setting

test(core): reproduce replay of a completed refresh rotation

fix(core): share a refresh rotation only while it is in flight

test: reproduce guards that skip the origin check

fix: run the origin check in the Express and Fastify guards

docs: describe the content-type gate and guard origin check

test(express): reproduce forwarding a client IP under a trust-everything proxy setting

fix(express): detect any trust-everything proxy setting before forwarding the client IP

test(core): keep keys served at the host root from verifying prefixed auth server tokens

test(core): reproduce client credentials tokens that look like users

fix(core): mark client credentials tokens on the resource server user

test(core): reproduce resource server guards that cannot require a user

feat: let verify-only resource servers require a user

Merge remote-tracking branch 'origin/main' into fix/wave1-origin-and-refresh-replay

ci: run conformance from seamless-cli v0.27.2 and hold Next.js to the content-type gate

test(core): reproduce a second tab losing its session on a late refresh cookie

fix: keep a completed refresh for cookie transport for five seconds