Skip to content

fix(oauth): reject invalid CIMD client identifiers - #1603

Draft
betegon wants to merge 1 commit into
mainfrom
bt/oauth-invalid-client-identifiers
Draft

betegon wants to merge 1 commit into
mainfrom
bt/oauth-invalid-client-identifiers

Conversation

@betegon

@betegon betegon commented Oct 22, 2026

Copy link
Copy Markdown
Member

Return a local 400 for malformed CIMD client IDs instead of wrapping URL validation failures as CimdFetchError and returning 500. The existing provider patch reuses its URL validator before authorization metadata lookup.

Valid-URL metadata failures retain their existing behavior. Regression tests exercise the production Worker; DCR and token flows are unchanged.

@vercel

vercel Bot commented Oct 22, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
sentry-local Ready Ready Preview Oct 22, 2026 5:14pm UTC

Request Review

This branch was successfully deployed

1 active deployment
Preview — b6198e36 Deployed Oct 22, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant