Skip to content

id(web): redirect to a clean URL after exchanging a bootstrap token for a cookie #5746

New issue
New issue
Closed
#6236
Closed
id(web): redirect to a clean URL after exchanging a bootstrap token for a cookie#5746
#6236
Assignees
dezren39
Labels
app/idPackage/app: id (pkgs/ or apps/ in this repo)kind/bugSomething isn't working (prefixed form of the classic bug label)priority/normalOrdinary priority (the default)task/triageQueue packet kind: verify, reproduce, and route this item

Description

@dezren39
dezren39
opened on Nov 5, 2026

Problem

The web-token bootstrap accepts a bearer token in the query string and sets a cookie, but does not remove the token from the browser URL. In pkgs/id/src/web/security.rs around lines 191-218, the CLI directs users to open the token URL (pkgs/id/src/cli.rs:434-439). After cookie issuance the query remains in browser history and can leak through copied URLs, same-origin Referer headers, and access logs.

Existing tests prove cookie creation but do not assert URL cleanup (security.rs around lines 465-484).

Required behavior

After successful bootstrap, set the cookie and redirect to the same request path without the token parameter. Build the target from the validated request path; do not accept an arbitrary redirect destination. Keep other query parameters only if the contract requires them.

Acceptance criteria

  • A successful bootstrap sets the auth cookie and redirects to the clean same-origin path.
  • The Location header contains no token value or token parameter.
  • Missing or invalid tokens behave as before and issue no cookie.
  • Tests cover redirect status, cookie flags, and the handling of permitted query parameters.

Activity

  1. dezren39
    added
    kind/bugSomething isn't working (prefixed form of the classic bug label)
    priority/normalOrdinary priority (the default)
    app/idPackage/app: id (pkgs/ or apps/ in this repo)
    on Nov 5, 2026

  2. developing-today commented on Nov 5, 2026

    @developing-today
    developing-todayBot
    on Nov 5, 2026 – with developing.today
    Contributor

    CODE-1436

  3. github-actions
    assigned
    dezren39
    on Nov 5, 2026
  4. dezren39
    added
    queue/queuedHas a queued task in the Supabase agent queue
    task/triageQueue packet kind: verify, reproduce, and route this item
    work/assignedQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    status/in-progressQueue worker lifecycle state
    and removed
    queue/queuedHas a queued task in the Supabase agent queue
    on Nov 5, 2026

  5. dezren39 commented on Nov 5, 2026

    @dezren39
    dezren39
    on Nov 5, 2026
    MemberAuthor

    🤖 Agent note · done (triaged)

    • Agent: queue worker (repo-worker-code), lane code-r
    • Session / ID: task 10159
    • Found via: queue claim
    • Task: Triage of the bootstrap-token URL leak at current main.
    • Expectation: triaged — bug confirmed, fix enqueued as task 10530; issue stays open for that fix.
    • Links: follow-up task 10530 (small_fix, queued)

    Triage findings (task 10159, 2026-11-05)

    Confirmed on current main (04f7869), exactly as filed. In pkgs/id/src/web/security.rs, the middleware accepts the query token (ok_query), sets the id_token cookie when ok_query && !ok_cookie, then runs the handler and returns its response with Set-Cookie appended — there is no redirect anywhere in the middleware, so the bearer token remains in the browser URL, history, Referer headers, and access logs. The existing bootstrap test (~lines 465–484) asserts status 200 and the cookie flags only; nothing asserts a Location header. PR search for this issue/bootstrap redirect found no existing or in-flight fix. Issue #2090-style blockers: none; no hard-stop labels.

    Fix enqueued as task 10530 (small_fix): on successful query-token bootstrap, short-circuit with a redirect (Set-Cookie unchanged) whose Location is built only from the validated request path with the token parameter removed and other query parameters preserved — never from a parameter or header, so no open redirect. Bearer/cookie paths and the missing/invalid-token 401 behavior stay unchanged. Tests: redirect status + cookie flags, Location carries no token param/value, invalid token still 401 with no cookie, cookie-auth request still succeeds without a redirect.

  6. dezren39
    added
    status/triagedTriaged and routed (see agent note)
    and removed
    status/in-progressQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    on Nov 5, 2026

  7. 3 remaining items

  8. developing-today
    added
    work/assignedQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    status/in-progressQueue worker lifecycle state
    and removed
    status/triagedTriaged and routed (see agent note)
    on Nov 5, 2026

  9. developing-today commented on Nov 5, 2026

    @developing-today
    developing-todayBot
    on Nov 5, 2026 – with developing.today
    Contributor

    🤖 Agent note · picked up

    • Agent: queue worker (repo-worker-code), lane code-g
    • Session / ID: task 10530
    • Found via: queue claim
    • Task: implement the issue id(web): redirect to a clean URL after exchanging a bootstrap token for a cookie #5746 fix — redirect to the clean URL after successful bootstrap token exchange in pkgs/id/src/web/security.rs, with tests
    • Expectation: effort s — done = branch + PR with the redirect and tests, merged under the standing criteria if verified
  10. developing-today
    added
    status:in-review
    on Nov 5, 2026
  11. developing-today
    added a commit that references this issue on Nov 5, 2026

    Merge pull request #6236 from developing-today/queue/10530-5746-boots…

    ffdd4f5
  12. developing-today
    closed this as completedin #6236on Nov 5, 2026
  13. developing-today
    added
    status:done
    and removed
    status:in-review
    on Nov 5, 2026

  14. developing-today commented on Nov 5, 2026

    @developing-today
    developing-todayBot
    on Nov 5, 2026 – with developing.today
    Contributor

    🤖 Agent note · done

    • Agent: queue worker (repo-worker-code), lane code-g
    • Session / ID: task 10530
    • Found via: queue claim
    • Task: implement the issue id(web): redirect to a clean URL after exchanging a bootstrap token for a cookie #5746 fix — clean-URL redirect after bootstrap token exchange
    • Result: PR id(web): redirect to clean URL after bootstrap token exchange (#5746) #6236 merged (merge commit ffdd4f5); this issue auto-closed by the merge. GET query-token bootstrap now answers 303 to the same path with the token parameter removed (other parameters preserved), Set-Cookie riding the redirect; non-GET and cookie/bearer auth unchanged.
    • Tests: cargo test --features web web::security on the laptop worktree — 17 passed, 0 failed, including the updated bootstrap test and three new ones (param preservation + token absence in Location, cookie-auth no-redirect, invalid token 401/no-cookie/no-redirect). PR checks were still queued at merge time (congested CI); merged under the standing merge authority on the verified targeted tests. Note for local runs: the crate's web feature needs pkgs/id/web/dist present (git-ignored build output) or RustEmbed fails — the worktree borrowed the primary clone's dist via symlink.
  15. developing-today
    removed
    status:done
    status/in-progressQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    work/assignedQueue worker lifecycle state
    on Nov 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

app/idPackage/app: id (pkgs/ or apps/ in this repo)kind/bugSomething isn't working (prefixed form of the classic bug label)priority/normalOrdinary priority (the default)task/triageQueue packet kind: verify, reproduce, and route this item

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions