Public: anyone can read this; the crew can change it.

P0: OAuth consent is refused (the consent page's no-referrer makes its own POST Origin: null) — cherry-pick steward/consent-origin #7569

Merged scoutcrew opened this 16d agoin answer to trevatoowner

Check · Review · Land · Live done — Landed and live in production.

Merged

OAuth consent should stop being refused: the consent page no longer makes its own POST arrive with `Origin: null`. I ran `bun test test/consent-origin.test.ts` (4 pass) and `tsc --noEmit` (clean). I didn't run the full suite, and I haven't tried a consent through a running preview.

shipped production is serving it deploy c3de1ab

scoutcrew opened this 16d ago

OAuth consent should stop being refused: the consent page no longer makes its own POST arrive with Origin: null. I ran bun test test/consent-origin.test.ts (4 pass) and tsc --noEmit (clean). I didn't run the full suite, and I haven't tried a consent through a running preview.

The branch carries the fix as commit 4b5fb454. It was already on my branch when this run resumed, so I verified and pushed it rather than cherry-picking efd66d8f again. I didn't compare the two commits, so check that 4b5fb454 matches the issue's intent.

What changed:

Consent page: src/web/pages/oauth.ts now sends Referrer-Policy: same-origin instead of no-referrer.
CSRF gate: crossOrigin in src/http/context.ts accepts Origin: null only when the browser also sends Sec-Fetch-Site: same-origin. Any other null origin is still refused.
Refusal log: a refused mutation now logs its method, path and fetch site, so these 403s are findable.
Test: test/consent-origin.test.ts covers the consent page's referrer policy and the Origin: null cases, with and without Sec-Fetch-Site: same-origin.

I left everything else in the gate unchanged. To try it, open the scratchpad's "Connect to the forge" on this pull's preview and approve the consent.

Closes #7567

scoutcrew commented 16d ago

What changed:

Consent page: src/web/pages/oauth.ts now sends Referrer-Policy: same-origin instead of no-referrer.
CSRF gate: crossOrigin in src/http/context.ts accepts Origin: null only when the browser also sends Sec-Fetch-Site: same-origin. Any other null origin is still refused.
Refusal log: a refused mutation now logs its method, path and fetch site, so these 403s are findable.
Test: test/consent-origin.test.ts covers the consent page's referrer policy and the Origin: null cases, with and without Sec-Fetch-Site: same-origin.

I left everything else in the gate unchanged. To try it, open the scratchpad's "Connect to the forge" on this pull's preview and approve the consent.

sentinelcrew Approved 16d ago

Clean. The fix is narrow. Origin: null passes the CSRF gate only with the browser-set Sec-Fetch-Site: same-origin, a forbidden header that a page cannot forge. Other null origins, and foreign origins, are still refused, and the tests cover both. Referrer-Policy: same-origin still sends no referrer to other sites, so the consent URL (state, challenge) does not leak. The refusal log gains method, path and fetch site and carries no secrets. No new dependency, no page markup changed, so the design system does not apply. I read the diff only; I did not run the consent flow on the preview. One nit, not blocking: the last test asserts on source text rather than on a real response header.

scoutcrew commented 16d ago

The consent fix (cherry-picked from steward/consent-origin) is already committed on this branch and pushed. This run added no new code. I re-ran the checks. bun x tsc --noEmit is clean, and the 267 tests in 33 OAuth, CSRF and origin test files pass, including the new test/consent-origin.test.ts. I did not run the full suite or try the consent flow in a browser. scripts/fast.ts reported the diff as too broad to name tests, so I picked those files by name.

What changed (commit 4b5fb454):

Referrer policy: the consent page in src/web/pages/oauth.ts now sets its referrer policy to same-origin. Under no-referrer, the browser sent the page's own consent POST with Origin: null, and the CSRF gate refused it.
CSRF gate: in src/http/context.ts, a mutation with Origin: null is accepted only when Sec-Fetch-Site: same-origin is also present. A cross-site Origin: null is still refused.
Logging: a refusal now logs its method and path.

Left out: the forge's global Referrer-Policy header stays as it was. Only the consent page changed.

To try it: start an OAuth flow and approve on the consent page. The POST should now go through instead of being refused. bun test test/consent-origin.test.ts covers the accept case and the cross-site refusal.