Repository navigation

fix(oauth): forbid framing of the consent and setup pages and show where approval sends access - #747

Merged

aliasunder merged 18 commits into

mainfrom

worktree-oauth-consent-framing

Nov 7, 2026

Merged

fix(oauth): forbid framing of the consent and setup pages and show where approval sends access#747
aliasunder merged 18 commits into
mainfrom
worktree-oauth-consent-framing

Commits on Nov 7, 2026
- fix(oauth): forbid framing and set security headers on every response
  
  aliasunder
  and
  claude
  committed
  d1ce461
- fix(oauth): stop browsers caching consent decisions and setup pages
  
  aliasunder
  and
  claude
  committed
  14d9ea1
- fix(oauth): show where approval sends access and grant every sign-in the vault scope
  
  aliasunder
  and
  claude
  committed
  e52949d
- docs: describe the consent page's destination row, the granted scope and the response headers
  
  aliasunder
  and
  claude
  committed
  63f79e0
- test: use neutral example hosts in the consent page destination vectors
  
  aliasunder
  and
  claude
  committed
  b7cbbbb
- docs: give the response headers their own SECURITY.md section
  
  aliasunder
  and
  claude
  committed
  57aec84
- docs: name the server and setup mode in the response headers section
  
  aliasunder
  and
  claude
  committed
  49ce00a
- fix(review): describe the consent decision's parser-error response accurately
  
  aliasunder
  and
  claude
  committed
  fdb9e03
- style: clarify the response-header, consent-page and setup-server comments
  
  aliasunder
  and
  claude
  committed
  731b86d
- refactor(oauth): let the consent page own its name fallback, and name the reveal toggle's variables
  
  aliasunder
  and
  claude
  committed
  2ad0bd6
- test: name each caching and header test for the behaviour it checks, and pin the setup page's reveal toggle
  
  aliasunder
  and
  claude
  committed
  85acbcc
- test: read the consent page's reveal toggle without non-null assertions
  
  aliasunder
  and
  claude
  committed
  5e7e8dd
- fix(docs): say that Express's 404 page answers any request no route handles
  
  aliasunder
  and
  claude
  committed
  3c08e20
- fix(oauth): show the client ID when a client's registered name is empty
  
  aliasunder
  and
  claude
  committed
  db36121
- refactor(oauth): name the only scope VAULT_SCOPE, and reflow the scope paragraph
  
  aliasunder
  and
  claude
  committed
  1394d15
- test: pin no-store on the consent page, and say which layer answers an oversized form
  
  aliasunder
  and
  claude
  committed
  2e5198b
- style: say an empty client name also shows the client ID, and give the consent page its own paragraph
  
  aliasunder
  and
  claude
  committed
  a1bf47d
- test: pin the full server's 500 for an oversized consent form as not cacheable
  
  aliasunder
  and
  claude
  committed
  4bd0391

Commits

Commits on Nov 7, 2026