All issues

Search results

/login propagates CSRF-state storage failures as a raw error response; /callback redirects with a reason code

P3Priority: P3

Status: Open.

Bug

#227 In HarperFast/oauth;

· heskew opened on Sep 2, 2026

Harden the sessionValidator periodic-validation regression test to assert persistence (follow-up to #223)

P3Priority: P3

Status: Open.

Task

#224 In HarperFast/oauth;

· heskew opened on Sep 1, 2026

mcp.signingKeyPem resolving to empty string silently switches from pinned key to self-generated (no startup validation)

Status: Open.

#221 In HarperFast/oauth;

· tps-flint opened on Aug 29, 2026

A request that invalidates an OAuth session still runs once as the old user (global middleware next() without clearing request.user)

bugSomething isn't workingSomething isn't working

Status: Open.

#213 In HarperFast/oauth;

· heskew opened on Aug 24, 2026

Session invalidation is not atomic vs a concurrent token refresh — logout/expiry can be resurrected (no CAS)

bugSomething isn't workingSomething isn't working

P2Priority: P2

Status: Open.

Bug

#212 In HarperFast/oauth;

· heskew opened on Aug 24, 2026

Remove the http://localhost:9926 redirectUri fallback — silent loopback default turns missing config into an authorization-code interception hazard

Status: Open.

#208 In HarperFast/oauth;

· heskew opened on Aug 14, 2026

2.5.0: unresolved env placeholder on an mcp boolean gate now drops to its default (behavior change not in CHANGELOG)

Status: Open.

#207 In HarperFast/oauth;

· tps-flint opened on Aug 14, 2026

Conformance audit: MCP authorization spec 2026-07-28 (docs pin 2025-06-18 — two revisions stale)

Status: Open.

#202 In HarperFast/oauth;

· heskew opened on Aug 13, 2026

MCP OAuth v1.1: remaining 2026-07-28 spec forward-work (SEP-2350 scope step-up)

enhancementNew feature or requestNew feature or request

Status: Open.

#156 In HarperFast/oauth;

· heskew opened on Jul 2, 2026