Relism/Flash5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ext-security): add an OAuth 2.1 authorization server #18

Merged
Relism merged 1 commits from feature/ext-security/oauth-server into master 2026-09-22 11:42:27 +00:00
Conversation 0 Commits 1 Files Changed 35
+1958 -80
Relism commented 2026-09-22 11:42:11 +00:00
Owner
Copy Link
Copy Source

Adds flash-ext-security-oauth-server: an OAuth 2.1 authorization server for resources on the application's own origin (code + PKCE S256, CIMD and DCR clients, RFC 8707 resources, RFC 9068 access tokens, rotating refresh tokens).

Around it:

  • SecurityExtension resolves a configured origin; Request.origin() no longer trusts X-Forwarded-*.
  • Mechanisms expose schemes(); a route can be restricted to some mechanisms, and McpConfig.mechanisms(...) uses that.
  • OIDC bearers must be typed at+jwt.
  • PublicUrl guards outbound fetches (OIDC discovery, CIMD) against internal addresses.
  • OAuthTestClient in flash-ext-security-test.

Tests: flash core (711) and the security/MCP/OpenAPI modules pass.

🤖 Generated with Claude Code

Adds `flash-ext-security-oauth-server`: an OAuth 2.1 authorization server for resources on the application's own origin (code + PKCE S256, CIMD and DCR clients, RFC 8707 resources, RFC 9068 access tokens, rotating refresh tokens). Around it: - `SecurityExtension` resolves a configured origin; `Request.origin()` no longer trusts `X-Forwarded-*`. - Mechanisms expose `schemes()`; a route can be restricted to some mechanisms, and `McpConfig.mechanisms(...)` uses that. - OIDC bearers must be typed `at+jwt`. - `PublicUrl` guards outbound fetches (OIDC discovery, CIMD) against internal addresses. - `OAuthTestClient` in flash-ext-security-test. Tests: flash core (711) and the security/MCP/OpenAPI modules pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Relism added 1 commit 2026-09-22 11:42:11 +00:00
feat(ext-security): add an OAuth 2.1 authorization server f28fc43150 
flash-ext-security-oauth-server issues RFC 9068 access tokens (code + PKCE S256,
CIMD and DCR clients, RFC 8707 resources, rotating refresh tokens) for resources on
the application's own origin. Around it: SecurityExtension resolves a configured
origin instead of X-Forwarded-* headers, mechanisms expose schemes() and a route can
be restricted to some of them, McpConfig.mechanisms(...) uses that, OIDC bearers must
be typed at+jwt, and PublicUrl guards outbound fetches against internal addresses.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Relism merged commit 6d44f9e7b1 into master 2026-09-22 11:42:27 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Relism (Zakaria El Orche)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Relism/Flash5#18