Relism/Flash5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ext-security): add an OAuth 2.1 authorization server

Browse Source 
flash-ext-security-oauth-server issues RFC 9068 access tokens (code + PKCE S256,
CIMD and DCR clients, RFC 8707 resources, rotating refresh tokens) for resources on
the application's own origin. Around it: SecurityExtension resolves a configured
origin instead of X-Forwarded-* headers, mechanisms expose schemes() and a route can
be restricted to some of them, McpConfig.mechanisms(...) uses that, OIDC bearers must
be typed at+jwt, and PublicUrl guards outbound fetches against internal addresses.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Zakaria El Orche
2026-09-22 11:39:09 +00:00
co-authored by Claude Opus 5
parent 7f225e0faf
commit f28fc43150
35 changed files with 1958 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flash/src/main/java/dev/relism/flash/models/Request.java
+4 -6
View File
@@ -195,14 +195,12 @@ public class Request {
public List<String> headers() { checkActive(); return requestLine.getHeaders().all(); }
/**
* The scheme and authority the client addressed, e.g. {@code https://example.com}: from
* {@code X-Forwarded-Proto}/{@code X-Forwarded-Host} when present, otherwise the connection and
* the {@code Host} header. Only meaningful behind a proxy that sets or strips those headers.
* The scheme and authority the client addressed, e.g. {@code https://example.com}: the connection's
* scheme and the {@code Host} header. The client chooses both, so nothing that must not be misled
* reads this alone; it reads an origin the application configured, falling back to this one.
*/
public String origin() {
String proto = header("X-Forwarded-Proto");
String host = header("X-Forwarded-Host");
return (proto != null ? proto : isSecure() ? "https" : "http") + "://" + (host != null ? host : header("Host"));
return (isSecure() ? "https" : "http") + "://" + header("Host");
}
/**