PR Custody

fix: critical auth security — CORS, redirect URI, account linking

@sohamganatrachecks n/achecks…fix/critical-auth-security-cors-account-linking → master3 files · +24 −18review: @kaavee315review: @anshugarg15updated 2w ago

GitHub

▸Description · 2 noise

Summary

Fixes multiple critical vulnerabilities discovered during investigation of bulk account takeover attempts via Oxylabs residential proxy (79.116.161.224, Madrid, Spain). Datadog threat_intel flagged all requests as intention: suspicious, category: residential_proxy, risks: AD_FRAUD, CALLBACK_PROXY.

Attack vector identified

The OAuth callback endpoint echoed any Origin header with Access-Control-Allow-Credentials: true, and returned the JWT token in the response body. This enabled a bulk session-stealing attack:

Attacker embeds JS on any page (ad network, compromised site)
Any logged-in Composio user who visits that page — attacker's JS makes a credentialed cross-origin request to the callback endpoint
Browser sends .composio.dev session cookie (cookie domain is .composio.dev = all subdomains)
Response with JWT is readable by attacker's JS due to permissive CORS
Attacker replays stolen sessions from residential proxies

Changes

CORS origin whitelist (callback.ts): Replace echo-any-origin with isDashboardOrigin() validation. Only known dashboard origins get Access-Control-Allow-Origin + credentials: true. Unknown origins get no CORS headers.
Redirect URI validation (login.ts, callback.ts): Origin header validated against isDashboardOrigin() before constructing redirect URIs. Prevents open redirect to attacker-controlled domains.
Redirect URI parameter validation (login.ts): User-supplied redirectUri query param must start with the validated origin. Prevents arbitrary redirect injection.
Account linking hardening (better_auth/index.ts): Added trustedProviders: ['google', 'github'] to prevent untrusted providers from auto-linking to existing accounts by email.
Cryptographic state parameter (login.ts): Replaced Math.random().toString(36) with crypto.randomUUID().

Remaining follow-ups (not in this PR)

Validate OAuth state parameter on callback (store in Redis, verify on return)
Rate limit magic link send and verify endpoints
Remove hardcoded reusable magic link token in staging
Tighten cookie domain from .composio.dev to specific subdomains
Audit Access-Control-Allow-Origin: * in common.ts and with_rate_limit.ts

Test plan

Verify Google OAuth login still works from dashboard.composio.dev
Verify Google OAuth login still works from staging preview deploys
Verify cross-origin request from non-dashboard origin gets no CORS headers
Verify redirect URI cannot be overridden to external domain
Verify account linking still works for Google/GitHub providers
Verify magic link login still works (unaffected by this change)

🤖 Generated with Claude Code

▸ 2 bot/status comments hidden

@github-actions[bot]2w ago

🔍 Suggested Reviewers

Based on git blame analysis of 3 file(s):

Contributor	Contribution	Files
sarahsimionescu	50%	2
Rahul Tarak	35%	3
Himanshu Dixit	3%	2
Karan Vaidya	3%	2
Zen	2%	1

💡 Recommendation

Based on git history, sarahsimionescu or Rahul Tarak would be good reviewer(s) for this PR.

🤖 Based on git blame with recency weighting (recent edits count more).

@github-actions[bot]2w ago

🧪 Test Results Summary (E2E Tests)

loading diff…