Repository navigation
fix(oauth): send a same-origin path as the OAuth return - #1
Conversation
The agent refuses an absolute redirect_uri on another origin as an open redirect, so sign-in from scout.ciris.ai to agents on scoutapilb.ciris.ai failed for every user. Send the path; scoutapilb's nginx forwards /oauth-complete.html and /oauth/* back to scout.ciris.ai with the one-time code. Needs CIRISManager's web_client_origin forward deployed first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019ZeGbV8M3kbUSir7VvKGso
Deploying scoutgui with
|
| Latest commit: |
e74a6ac
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://6836c845.scoutgui.pages.dev |
| Branch Preview URL: | https://fix-oauth-same-origin-return.scoutgui.pages.dev |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
Sign-in on scout.ciris.ai fails for every user with "unsafe redirect_uri: the host is not this origin or loopback". The agent on scoutapilb.ciris.ai accepts only a same-origin path as the OAuth return.
This sends
/oauth-complete.html?…(login) and/oauth/<agent>/<provider>/callback(account linking) instead of absolutehttps://scout.ciris.ai/…URLs. After Google, the agent redirects the browser to that path on scoutapilb.ciris.ai. scoutapilb's nginx then forwards it to scout.ciris.ai with the query, including the one-timeciris_codethatoauth-complete.htmlredeems as before.Merge after the CIRISManager forward is live on scoutapilb. Until then the path would land on scoutapilb and 404.
tsc --noEmitis clean.🤖 Generated with Claude Code
https://claude.ai/code/session_019ZeGbV8M3kbUSir7VvKGso