Fix FedCM authentication, scope consent, and code-binding issues - #322

Open

pfefferle wants to merge 11 commits into

trunkfrom

fix/fedcm-review-findings

Commits on Jul 15, 2026

Fix FedCM authentication, scope consent, and code-binding issues
pfefferle
committed
4897273
Fix alignment of $user variable assignment
pfefferle
committed
99e137a

Commits on Aug 6, 2026

Merge branch 'trunk' into fix/fedcm-review-findings
pfefferle
authored
a703384
check the code before reading the scope
pfefferle
committed
09ad28d
tighten the fedcm nonce exemption
pfefferle
committed
4c6db58
keep the code alive when redirect_uri is just missing
pfefferle
committed
6f2dd9a
compare fedcm origins case-insensitive
pfefferle
committed
7236f02
store each fedcm scope only once
pfefferle
committed
c9330a5
close the code probing oracle and fix the fedcm cors headers
pfefferle
committed
98946aa
require a usable pkce challenge for fedcm codes
pfefferle
committed
a78bece
check the code binding in one place
pfefferle
committed
2f677f7