[aterga]

Summary

Hardens the hosted-redirect allow-list (from #69) against a real gap: it matched on the registrable domain only, but several allow-listed origins also serve third-party, script-capable content on the same origin — perplexity.ai/page/…, chatgpt.com/g/… and /share/…. Domain-only matching let an attacker register a redirect_uri on such a path; through the same-browser flow the victim's browser lands there with ?code=…, on-origin JS reads location and exfiltrates, and the attacker (the PKCE-self-satisfied client) exchanges the code for a token bound to the victim's principal. In effect the token-security invariant was outsourced to eight third parties' XSS hygiene.

This pins the path as well as the domain, so a registered redirect always lands on a vendor-controlled OAuth-callback endpoint, never a user-content path.

Credit: reported as a follow-up security finding on the #69 allow-list.

Related issues

Follows #69 (hosted-redirect allow-list, CWE-601). No GitHub issue open.

Changes

• redirect_uri_permitted: each allow-list entry is now a (registrable domain, callback-path prefix) pair. A hosted redirect must be https, carry no userinfo, match an allow-listed domain/subdomain, and have a path within that vendor's pinned prefix. path_within_prefix checks a segment boundary, so /api/mcp/auth_callback admits /api/mcp/auth_callback and /api/mcp/auth_callback/… but not /api/mcp/auth_callbackEVIL.
• Seeded from the real callback paths in oauth-clients.json: claude.ai /api/mcp/auth_callback, chatgpt.com /connector/oauth/, cursor.com /agents/mcp/oauth/callback (registered as www.cursor.com), perplexity.{ai,com} (+ www/staging/enterprise/n subdomains) /rest/connections/oauth_callback, grok.com (/connector/oauth/, /connectors-oauth-exchange-code/, /mcp/callback), antigravity.google /oauth-callback. All verified to match the actual registrations.
• Dropped vscode.dev: its only registered path is /redirect — a web-to-desktop forwarding endpoint, i.e. the query-forwarding shape this finding warns about. Left out pending confirmation that vscode.dev/redirect doesn't let a caller steer where the ?code= goes. Easy to re-add as ("vscode.dev", "/redirect") if that endpoint is a safe fixed handoff.
• Env override renamed OAUTH_ALLOWED_REDIRECT_DOMAINS → OAUTH_ALLOWED_REDIRECT_PREFIXES: entries are full https://host/path origins; an entry with no path (or root /) is refused with a warning, so ops can't reopen the domain-wide hole.
• Tests: hosted_redirect_allow_list asserts the finding's payloads are rejected (perplexity.ai/page/…, www.perplexity.ai/page/…, chatgpt.com/g/…, chatgpt.com/share/…), plus wrong-path (claude.ai/foo, cursor.com/oauth/callback), the segment-boundary near-miss (…/auth_callbackEVIL), and that vscode.dev no longer passes; the allowed cases (incl. www.cursor.com/agents/mcp/oauth/callback) use each vendor's pinned path.
• Module docs, the /oauth/register error message, and the README Companion-control note updated.

Notes / out of scope

• claude.ai is the model done right — its artifacts execute on a separate sandboxed claudeusercontent.com origin that is deliberately not on the allow-list, so claude.ai itself never runs an attacker's JS.
• Native (device-local) redirects are unaffected: loopback (http://127.0.0.1/localhost, any port) stays exempt, and Cursor's cursor://… private-use scheme is still rejected by the allow-list exactly as before this PR — the allow-list only gates hosted redirects, and Cursor also registers loopback + hosted callbacks. Supporting cursor://-style schemes per RFC 8252 would be a separate change (and must denylist javascript:/data: etc.).

Testing

• cargo build --locked --all-targets (via the test build)
• cargo test --locked — 128 passing
• cargo clippy --all-targets — no new warnings in auth.rs
• npm test --prefix monitoring/mcp-status — not applicable (no dashboard change; a path-pin monitor check could be a follow-up)

Checklist

• I have read the Contributing guidelines.
• Docs (README / comments) updated for any user-visible change.
• No secrets, credentials, or internal-only information are included.

Rollout note

OAUTH_ALLOWED_REDIRECT_DOMAINS is no longer read — deployments that set it must switch to OAUTH_ALLOWED_REDIRECT_PREFIXES with full https://host/path entries. Every current hosted registration matches a seeded prefix (verified against oauth-clients.json) except the two stale test entries (example.com/example.org, correctly rejected) and vscode.dev (dropped, see above); Cursor keeps working via its loopback callbacks and its now-pinned hosted callback.

🤖 Generated with Claude Code

https://claude.ai/code/session_014T9N8USDfNK5yzznPGg7Ym

[Copilot]

Pull request overview

This PR hardens OAuth dynamic client registration and authorization by tightening the hosted redirect_uri allow-list from domain-only matching to vendor-specific domain + callback path prefix matching, closing a CWE-601 gap where user-content paths on allow-listed origins could capture authorization codes.

Changes:

• Replace the hosted redirect allow-list from registrable domains to (domain, callback-path prefix) pairs, and enforce segment-boundary path-prefix matching.
• Rename the deployment override from OAUTH_ALLOWED_REDIRECT_DOMAINS to OAUTH_ALLOWED_REDIRECT_PREFIXES and require full https://host/path entries (rejecting bare-domain/root-path entries).
• Update tests and documentation to cover the newly rejected user-content paths and the pinned callback-path behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/auth.rs	Implements domain+path pinned allow-list, env override rename/validation, and expands tests for the hardened redirect rules.
README.md	Updates security documentation to reflect the path-pinned hosted-redirect allow-list and new env var name/format.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

src/auth.rs:242

• parse_redirect_prefix currently rejects any URL that includes an explicit port via u.port().is_some(). In url::Url, an explicit :443 yields Some(443), so this code would incorrectly drop entries like https://vendor.example:443/mcp/callback even though the doc comment and unit test expect :443 to be accepted as same-origin.

    if u.port().is_some()

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.