fix: no refresh replay after rotation, and origin check whatever the SameSite setting by Bccorb · Pull Request #30 · fells-code/seamless-auth-go

test: reproduce refresh replay, Lax origin bypass, empty allowlist and http JWKSURI

Bccorb

committed

85d015c

fix: share a refresh rotation only while it is in flight

Bccorb

committed

a569544

fix: check Origin on unsafe methods whatever the SameSite setting

Bccorb

committed

d8e5a40

fix: let body-less refresh and logout through the content type gate

Bccorb

committed

5447b2e

fix: sync the bundled manifest with seamless-auth-api 0.22.0

Bccorb

committed

6bf02d7

test: reproduce a null Origin passing with a non cross-site Sec-Fetch-Site

Bccorb

committed

28a1bef

fix: refuse a null Origin before checking Sec-Fetch-Site

Bccorb

committed

a4d4708

test: reproduce a cancelled caller or failed transport ending a refresh

Bccorb

committed

89b933a

fix: run refresh rotation detached and keep cookies on transport errors

Bccorb

committed

e8ba2f0

Merge remote-tracking branch 'origin/main' into fix/wave1-origin-and-refresh-replay

Bccorb

committed

a69537a

ci: hold conformance to the content-type gate contract

Bccorb

committed

b0962d7

test: reproduce a cookie replay just after its rotation signing a tab out

Bccorb

committed

8c55689

fix: keep a completed refresh for cookie transport for five seconds

Bccorb

committed

eb9524f

Navigation Menu

Repository navigation

fix: no refresh replay after rotation, and origin check whatever the SameSite setting - #30

fix: no refresh replay after rotation, and origin check whatever the SameSite setting#30
Bccorb merged 13 commits into
mainfrom
fix/wave1-origin-and-refresh-replay

Commits on Nov 3, 2026

test: reproduce refresh replay, Lax origin bypass, empty allowlist and http JWKSURI

fix: share a refresh rotation only while it is in flight

fix: check Origin on unsafe methods whatever the SameSite setting

fix: let body-less refresh and logout through the content type gate

fix: sync the bundled manifest with seamless-auth-api 0.22.0

test: reproduce a null Origin passing with a non cross-site Sec-Fetch-Site

fix: refuse a null Origin before checking Sec-Fetch-Site

test: reproduce a cancelled caller or failed transport ending a refresh

fix: run refresh rotation detached and keep cookies on transport errors

Merge remote-tracking branch 'origin/main' into fix/wave1-origin-and-refresh-replay

ci: hold conformance to the content-type gate contract

test: reproduce a cookie replay just after its rotation signing a tab out

fix: keep a completed refresh for cookie transport for five seconds