chadtmiller.com/knotless

Switch repository

Loading…

What changes

harness/authorize.mjs, which stands in for the browser on the reference PDS's authorization page, sends the Referer a browser would: the page's URL, or its origin alone once that URL is longer than 4096 bytes, as Chrome and Firefox cut it. Every test that logs in over OAuth through it, the command line's loopback client among them, on the stock PDS and the spaces alpha, now meets the provider's Referer check as a user does.

Why

knotless login failed for users with "Invalid referrer" once its authorize URL grew past 4096 bytes, fixed by knotless login's page fits in the browser's Referer again. The tests never saw it: node sends a Referer of any length, so the approver passed a URL no browser would. oauth::tests::login_page_url_fits_a_referer holds the URL's length; this holds the whole login to it, against the PDS itself, whatever makes the URL long.

How it was checked

Against the harness's reference PDS (node harness/pds.mjs --accounts seed), with this approver as KNOTLESS_BROWSER: the 0.7.0 client's knotless login fails at sign-in with 400 {"error":"invalid_request","error_description":"Invalid referrer http://localhost:…/"}, the user's error, and the published 0.8.0's logs in. CI runs the OAuth tests through it on both nets.

Changeset: none

The approver in harness/authorize.mjs now sends the Referer a browser would. That is the page URL, or ${origin}/ once the URL is over 4096 bytes. Both places that set a Referer use it: the call helper and the final redirect fetch. A WHATWG URL.href is always ASCII, so .length counts bytes. The origin-only fallback is what Chrome and Firefox send. The change is small and test-only, so there are no docs to update, and the body's Changeset: none is right. I didn't check CI results, and I didn't run the harness against the PDS. The comment at line 37 says the provider refuses a long Referer, but it is the long URL it rejects, so the wording is slightly off. That isn't worth a change.