Skip to content

fix(auth): validate Slack workspace origins - #128

Open
dwaxe wants to merge 1 commit into
stablyai:mainfrom
dwaxe:dwaxe/validate-slack-workspace-origins
Open

fix(auth): validate Slack workspace origins#128
dwaxe wants to merge 1 commit into
stablyai:mainfrom
dwaxe:dwaxe/validate-slack-workspace-origins

Conversation

@dwaxe

@dwaxe dwaxe commented Jul 23, 2026

Copy link
Copy Markdown
Contributor
  • Restrict stored, imported, parsed, and resolved workspace URLs to canonical HTTPS Slack and GovSlack origins.
  • Revalidate browser-auth destinations immediately before requests and reject redirects.
  • Route GovSlack browser and standard-token clients to the correct origins.
  • Keep browser cookies realm-aware and fail closed on invalid credential stores.
  • Add regression coverage and synchronize the README and bundled skill.

Browser credentials could previously be sent to an insufficiently constrained configured origin. HTTP Slack URLs were accepted, while valid GovSlack URLs were rejected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant