| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-04-13 | 877 Bytes | |
| v4.0.0 source code.tar.gz | 2026-04-13 | 259.0 kB | |
| v4.0.0 source code.zip | 2026-04-13 | 302.6 kB | |
| Totals: 3 Items | 562.5 kB | 0 | |
4.0.0 (2026-04-13)
- fix(auth)!: validate redirect_uri in OAuthProxy.authorize (CWE-601) (5478753)
Bug Fixes
BREAKING CHANGES
- OAuthProxy no longer defaults allowedRedirectUriPatterns
to ["https://", "http://localhost:"]. Deployments that relied on the
old default must configure the URIs they trust explicitly, e.g.
allowedRedirectUriPatterns: ["https://yourapp.example.com/*"]. Without this, DCR will reject all registrations and /oauth/authorize will reject all requests.