3 Commits

Author	SHA1	Message	Date
Tink bot	aa1956e1aa	fix(oauth2server): accept all loopback redirect forms ... Hardcoding the three exact strings localhost / 127.0.0.1 / ::1 rejected legitimate loopback redirects like 127.0.0.2:1234 (anywhere in 127.0.0.0/8) or [0:0:0:0:0:0:0:1]:1234 (expanded IPv6 loopback). Use net.IP.IsLoopback() to cover the full loopback ranges, and match "localhost" case-insensitively. 0.0.0.0 stays rejected as it is not a loopback address. https://claude.ai/code/session_01LsTDrCJ7trE6WQ4FYf78UB	2026-05-07 22:03:49 +00:00
Tink bot	c6bda7a2dd	feat(oauth2server): accept loopback redirect URIs ... Previously the OAuth server rejected every redirect_uri that did not start with a vikunja- custom scheme. Native apps that cannot register a custom scheme (e.g. CLIs, desktop tools) need loopback redirects per RFC 8252, so also allow http://localhost, http://127.0.0.1 and http://[::1] (any port). Non-loopback http:// and https:// targets remain rejected. https://claude.ai/code/session_01LsTDrCJ7trE6WQ4FYf78UB	2026-05-07 22:03:49 +00:00
kolaente	649043aceb	test: add tests for OAuth 2.0 authorization flow ... Add web tests covering the authorize endpoint, token exchange, PKCE verification, single-use codes, and refresh token rotation. Add unit tests for redirect URI validation and PKCE. Add E2E test for the full browser-based authorization code flow with login redirect. Extract setupApiUrl helper for E2E tests to avoid duplication.	2026-03-27 23:05:04 +00:00