WaveSpeed CMS OAuth proxy

Vercel serverless OAuth and upload proxy used by the internal WaveSpeed blog CMS.

Production endpoints

• OAuth proxy: https://netlify-cms-oauth-github-ws-blog.vercel.app
• OAuth callback: https://netlify-cms-oauth-github-ws-blog.vercel.app/callback
• Authorized CMS origin: https://wavespeed.ai (/blog/admin)

Required Vercel environment variables

OAUTH_GITHUB_CLIENT_ID=<GitHub OAuth app client ID>
OAUTH_GITHUB_CLIENT_SECRET=<GitHub OAuth app client secret>
WAVESPEED_UPLOAD_API_KEY=<server-side upload key>

Optional hardening/configuration variables:

OAUTH_BASE_URL=https://netlify-cms-oauth-github-ws-blog.vercel.app
OAUTH_ALLOWED_ORIGINS=https://wavespeed.ai
GITHUB_ORG=WaveSpeedAI
MAX_UPLOAD_BYTES=4500000

For local CMS development, explicitly add the loopback origin, for example:

OAUTH_ALLOWED_ORIGINS=https://wavespeed.ai,http://localhost:3000

Security model

• OAuth state is bound to a short-lived HttpOnly, Secure, host-only cookie.
• The callback sends the GitHub token only to an allowlisted opener origin.
• Only active WaveSpeedAI organization members receive a token or may upload.
• Upload CORS is allowlist-based; wildcard origins are not permitted.
• OAuth and token-bearing responses are no-store and use a restrictive CSP.

Validation

npm test