lundberg/porchlight
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
porchlight/tests
History
Johan Lundberg cdde3e3754
fix(security): reject consent scopes outside the original request 
The /consent POST handler trusted the scope values submitted in the form,
so a forged consent submission could approve (and persist consent for)
scopes that were never part of the originating authorization request —
a scope-escalation vector.

Intersect the submitted scopes with the originally requested set stored in
the session before saving consent and completing the flow.

Refs: porchlight-a03

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-04 10:26:55 +02:00
..
e2e test: allow disabling rate limiting for e2e runs 2026-06-03 16:32:32 +02:00
test_admin fix: resolve all ruff lint errors and type checker warnings 2026-03-31 15:48:46 +02:00
test_auth_routes feat: require current password when changing password, add zxcvbn strength check 2026-03-31 15:34:43 +02:00
test_authn fix: resolve all ruff lint errors and type checker warnings 2026-03-31 15:48:46 +02:00
test_invite fix: resolve all ruff lint errors and type checker warnings 2026-03-31 15:48:46 +02:00
test_manage chore: create package structure with src layout 2026-02-12 14:39:07 +01:00
test_oidc fix(security): reject consent scopes outside the original request 2026-06-04 10:26:55 +02:00
test_store fix: resolve all ruff lint errors and type checker warnings 2026-03-31 15:48:46 +02:00
__init__.py chore: create package structure with src layout 2026-02-12 14:39:07 +01:00
conftest.py feat: add rate limiting middleware for authentication endpoints 2026-03-31 15:23:51 +02:00
test_admin_groups_validation.py style: apply ruff formatting to new files 2026-03-31 15:36:08 +02:00
test_admin_invite_validation.py style: apply ruff formatting to new files 2026-03-31 15:36:08 +02:00
test_app.py fix: resolve all ruff lint errors and type checker warnings 2026-03-31 15:48:46 +02:00
test_authn_active.py style: apply ruff formatting to new files 2026-03-31 15:36:08 +02:00
test_cli.py feat: add initial-admin CLI command 2026-02-18 11:29:13 +01:00
test_client_registration.py refactor: fix lint warnings and remove stale type: ignore comments 2026-02-18 13:08:03 +01:00
test_config.py refactor: fix lint warnings and remove stale type: ignore comments 2026-02-18 13:08:03 +01:00
test_csrf.py feat: wire CSRF middleware and harden session cookie 2026-02-19 13:45:58 +01:00
test_manage_profile.py feat: wire ProfileUpdate validation into manage profile route 2026-03-10 15:36:47 +01:00
test_models.py update all imports in test files: fastapi_oidc_op → porchlight 2026-02-16 15:34:53 +01:00
test_password_change.py style: apply ruff formatting to new files 2026-03-31 15:36:08 +02:00
test_rate_limit.py feat: add rate limiting middleware for authentication endpoints 2026-03-31 15:23:51 +02:00
test_userid.py update all imports in test files: fastapi_oidc_op → porchlight 2026-02-16 15:34:53 +01:00
test_validation.py fix(security): escape user input in validation error HTML 2026-06-04 10:23:32 +02:00