Fixed: CSRF nonce on OAuth authorize/callback flow #84

New Issue

2026-05-29T05:30:23Z

jmiller commented

2026-05-29 05:30:23 +00:00

Fixed in commit `8dd6fdd`

Severity: Critical

What was wrong:
OAuth callback endpoint had no CSRF protection. A malicious link could trick a logged-in admin into connecting a service to an attacker-controlled account.

Fix applied:

Added session-based nonce generation in authorize() action
Timing-safe nonce validation via hash_equals() in callback()
Nonce embedded in OAuth state parameter and cleared after use

Files: OauthController.php, OAuthHelper.php

Label: priority: critical, status: pending-testing

## Fixed in commit 8dd6fdd **Severity:** Critical **What was wrong:** OAuth callback endpoint had no CSRF protection. A malicious link could trick a logged-in admin into connecting a service to an attacker-controlled account. **Fix applied:** - Added session-based nonce generation in `authorize()` action - Timing-safe nonce validation via `hash_equals()` in `callback()` - Nonce embedded in OAuth state parameter and cleared after use **Files:** `OauthController.php`, `OAuthHelper.php` **Label:** `priority: critical`, `status: pending-testing`

jmiller commented

2026-05-29 05:30:24 +00:00

Branch created: feature/84-fixed-csrf-nonce-on-oauth-authorize-call

git fetch origin
git checkout feature/84-fixed-csrf-nonce-on-oauth-authorize-call

Branch created: [`feature/84-fixed-csrf-nonce-on-oauth-authorize-call`](https://git.mokoconsulting.tech/MokoConsulting/MokoJoomCross/src/branch/feature/84-fixed-csrf-nonce-on-oauth-authorize-call) ```bash git fetch origin git checkout feature/84-fixed-csrf-nonce-on-oauth-authorize-call ```

Sign in to join this conversation.

Type Bug

Status —

Priority Critical

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomCross#84